{ "Event": { "published": true, "date": "2023-09-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-11", "timestamp": 1694476982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7cae884a-e8ef-4b4d-825e-d557069a9a11", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef46969-50a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694437873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437873, "uuid": "82487d7c-945f-4934-a91a-01195b0393cf", "comment": "Malware payload (AgentTesla)", "value": "6bb737b24ac9e51dd319dfcfbb49340d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437873, "uuid": "41c7d299-026d-48c1-8a1d-b13f0d5a64f8", "comment": "Malware payload (AgentTesla)", "value": "00300381185e5af687e6763d45ce0f0fd56c85a5d057e11ab9fac823079ec5eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437873, "uuid": "191a09d8-f9e2-4a64-92f3-bda17aebf1e6", "comment": "Malware payload (AgentTesla)", "value": "ef73efa298d354ea5995b59c88c596a46b68392d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437873, "uuid": "3b1cde2c-0ebf-4bed-83f8-7bb7c7f37710", "comment": "Malware payload (AgentTesla)", "value": "9d0d8e0c946796c6e57557d5b82f6eb44ce8cdb1f8e1b746808f291143e8c3e1ae4622794a3b61c32cc22f529d23e702", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437873, "uuid": "00f0e082-fa55-480e-b79a-6b8cb72d9e18", "value": "T1B634EE037E88EB11D2583D3B82DF6D2413F2A0C706B3D64BAF49AE6529512436D6E37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437873, "uuid": "1f6c910f-70b0-4651-87bd-ea175643aa27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437873, "uuid": "2abc8f54-3790-497c-b800-74b82a7ac263", "value": "3072:ULYnnlcU0x9T4HbEEjYCrmJCet96mlYY:U8nWU0x9T4bEiLrmJR6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437873, "uuid": "4a81775a-97d7-43da-b650-90a9bd1d354a", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437873, "uuid": "5f823cc1-4ef3-46e0-9a94-cc3b00647424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437873, "uuid": "e9e38a05-2aec-4e67-800d-dd8b8ea4d5c0", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e2acf5-5098-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694432647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432647, "uuid": "14759e42-7199-49b8-96c9-3217e29e373b", "comment": "Malware payload", "value": "702bdd7767158da87f81444161e4484e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432647, "uuid": "10b3485f-f76a-4ed6-929d-2cf4278cc024", "comment": "Malware payload", "value": "00990ca214bcf759bb7af559a0abd0a82fceb5bdaf5cd44326c38f820b901189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432647, "uuid": "c1b1cc1f-66b9-4799-bd68-9ac817c9108e", "comment": "Malware payload", "value": "9a3233ce58357ab664378cd9c77e3b79badf482b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432647, "uuid": "8def0d44-900f-4db5-8b6c-64a549463219", "comment": "Malware payload", "value": "2b0664f3764837e9095516c0caf85db89b90f20f505a3355fe4c5c89a64e6ae8fac4af727e73fe3fb2b6a8c38b07f4a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432647, "uuid": "eec37ea5-3c21-4a66-a0cb-cc53fa778d27", "value": "T1880412454674D633CD99CF3B65DBA695023662A3B89073493DACF7AE39233C0C750C96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432647, "uuid": "6cf46da3-e32b-4876-8e56-a9d5d07634fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432647, "uuid": "462bacb6-fa86-49d3-9d2a-c0a63435c709", "value": "3072:IsOI0UK/DGqPJStY7J1uai/c/3U8W/S8mluFb++MfopzZfBTCt4t8TDagBywmU9J:IsxQ/6qPGaisO6qLtCtJByknk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694432647, "uuid": "c5206536-b818-49ac-8c30-d2e0ec574513", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694432647, "uuid": "dad2d8ba-3572-42c9-bbba-592980259251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432647, "uuid": "c1050284-e618-49d8-85f7-26babb249e8b", "value": "z1Ehroeyp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d97372-50a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694435955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435955, "uuid": "e1682c9d-f9fe-4966-af7a-65a565287317", "comment": "Malware payload (AgentTesla)", "value": "0c3184ca19242b5c868f1efcff06355c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435955, "uuid": "dde1ecd8-52cf-47c2-862f-a58b5dadc116", "comment": "Malware payload (AgentTesla)", "value": "00ec18a18e5816731a60f69bcbe7c9296ae4084e5e390e8b545d475e1a37c7d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435955, "uuid": "4a0d37f8-d457-4311-8d3f-af00b1bc9492", "comment": "Malware payload (AgentTesla)", "value": "bd8a5438c4ef63d73493be4f8640a1cd18c1a509", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435955, "uuid": "3dd9f7d3-ff0b-466f-ad11-bf3b31e23fff", "comment": "Malware payload (AgentTesla)", "value": "18a686702057e9f3baaa1face8a5ccb3268b593e7e1ac71c7206dc661e68dad3955d2093673b2528d740ae6d516c1805", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435955, "uuid": "99d2d728-8bc5-4597-a512-fa2cd53f95b5", "value": "T1DEC4234728B98FB8D73F13B60C27DBD2477D6C185645E5EB58AE728E0813C9B4A01D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435955, "uuid": "d41351cc-929b-4274-9b14-1ff883506872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435955, "uuid": "984af0c0-82f1-4c86-9236-56af66eeb291", "value": "12288:+2iNHxWoOsss2X4VWsWQnnelxilw+RLks5rJmaa:+11xjjs5X/onEilw+RLL5r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694435955, "uuid": "7a6d0a68-7ccd-48a3-aba9-eab7437678dc", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694435955, "uuid": "be5bcfa8-011f-49b3-8b30-a8c5c3ed3b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435955, "uuid": "63f01fbf-0741-4685-9b01-8d2fddf47950", "value": "PURCHASE ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45137282-5081-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694422663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422663, "uuid": "91dc6086-cbe3-48de-a1ef-523601e7f85e", "comment": "Malware payload (AgentTesla)", "value": "b955cdfe7f3ac436562ebfb0d2d3a57b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422663, "uuid": "9545d3bb-61c2-4d6f-8d45-d6a7d99b088c", "comment": "Malware payload (AgentTesla)", "value": "0476ceb526335762f947806fb00c374181e27040eb133c15a30a901d6a098b78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422663, "uuid": "c7d330e7-fd89-467d-8faa-47ba9273b33f", "comment": "Malware payload (AgentTesla)", "value": "e12410592b18061f050bb593eb308c397d56495e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422663, "uuid": "c77d2390-b7c2-4639-8077-0fccea6b8210", "comment": "Malware payload (AgentTesla)", "value": "7d3f2fdf446e3382540063b8fd496b70e37de3399799571d9a6d8fd34208858b840ebb686507f011bb6eb9d937fa0e89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422663, "uuid": "441413e4-b9de-40cb-befe-5f5322b6e0ef", "value": "T1ACD412242396EB88F17E97798A61640443F6F4476673F62F5FED40E90F91F8087A2B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422663, "uuid": "196c31af-ec5d-4dd0-b268-4cf670d73825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422663, "uuid": "a196fc6b-2be4-4244-a239-a7b750b492a0", "value": "12288:fbrxAbpEWlPoI5Gm3cmBCKThxQLbVWZGoaQ5bMcFRQU9aAGpu:jrCpVtDcmo6cL5Jof44QtAcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694422663, "uuid": "c30dc7e7-18ee-449a-a031-55cc57b74015", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694422663, "uuid": "9df10cf0-22b7-4442-8842-f5a9ccdcc06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422663, "uuid": "d83c28c4-b357-478a-91f3-5f2e486daf02", "value": "Doc 132023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb06c21a-5078-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694419022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694419022, "uuid": "6cdad4f0-cd99-4b33-b38a-bd94a4bb2340", "comment": "Malware payload (LummaStealer)", "value": "ef9728a0916c18e4f90b6b32798dd564", "object_relation": "md5", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694419022, "uuid": "fab66c46-998c-4013-b597-6f8cddb2cd33", "comment": "Malware payload (LummaStealer)", "value": "053b71bdb52ee7aa00dd3a7e91c7bd134ebde2336b473cc729413b87f0a6b446", "object_relation": "sha256", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694419022, "uuid": "bc02e8c3-4dfd-4f9e-8f84-22b66c0448a6", "comment": "Malware payload (LummaStealer)", "value": "6ca713e4df7774b6ef9b3420604dc5c610a7af90", "object_relation": "sha1", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694419022, "uuid": "9699c19a-8365-4387-aee6-4a52f6e5e822", "comment": "Malware payload (LummaStealer)", "value": "ddedc00a95069527e6dd5b24a75c490b8920927782fb1abd1daaa8c6c8337513e8f43e31b4c5c4c9e4ac20a1cfe6812c", "object_relation": "sha3-384", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694419022, "uuid": "18d99764-06fa-43b4-adc5-babd7855478f", "value": "T12BD4AE9DB7D0C9B3EB2B2232B61035E5489DB0DCE70AB3B752CC737A2131595D99D288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694419022, "uuid": "92140d8b-499c-4e0d-b031-1f20fb5feeb0", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694419022, "uuid": "624312ca-0c72-48d3-bdfb-30d02ffe32fc", "value": "12288:EBLHkCA16BInLyl+GbRoBhV40o3u5jP4yJLcwqQfIpQO7yra7Q8QZ:EBICImUml+OyBz4Du54qLlqDQiyra7XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694419022, "uuid": "52aa3523-7211-4836-8767-a9706161765c", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694419022, "uuid": "06c35242-5f62-40be-8889-99640abb0f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694419022, "uuid": "e44f20d2-eba0-4dd3-a062-f4bf0d913c34", "value": "Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbe3c42-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694427023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427023, "uuid": "91f3e126-4367-4bd2-a1f9-61aceb996888", "comment": "Malware payload (Amadey)", "value": "8d3bacef1cc2a7c99b8691928a995785", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427023, "uuid": "f36f7e1f-0a3a-44ac-9392-1bafd402ab90", "comment": "Malware payload (Amadey)", "value": "0929c0184adc9235d079cdf797f014a56f16e9a705d344edff3c7d09d5c429a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427023, "uuid": "f4795c57-3b06-4522-a96e-bd2e1c003cf0", "comment": "Malware payload (Amadey)", "value": "dd7d461118ce5340ff1996fbfee4690f95f6f56f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427023, "uuid": "4e7c497f-c5f8-4cb8-af4c-b8e672e825fb", "comment": "Malware payload (Amadey)", "value": "6e8f0f04064073206d37affe9f294f5c0313dd8f9a5b70d68a552045ade22e99c383078f65bbd576bd0cfbc6b8a192b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427023, "uuid": "1a7a20c4-bf80-4923-9510-3b0d830de970", "value": "T1A365120038E08932D561153C05E0F3B5AD3EBD211B9DEAFB57E50EBE8E245A1EA352D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427023, "uuid": "a38ef40b-419d-4a72-b3ac-935ec6384b37", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427023, "uuid": "a3bc88e0-0182-497e-9659-08e43afbb3cc", "value": "24576:eaUCJccjMlfhX/6i92Gg6o2+C11Xy0p78ilw66Z/xIJMqwmycX4cPZ1Au1Hg:JUCJccYlfMitqlCROZ/IicRPZ1d1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427023, "uuid": "b1ef2ff6-d3c4-4ede-aaa5-e307871af703", "value": 1471352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427023, "uuid": "f101a143-755d-465c-9ffe-71200e607d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427023, "uuid": "5818d62f-bc53-46fa-966c-82b56709c752", "value": "8d3bacef1cc2a7c99b8691928a995785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0a1294-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694416502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416502, "uuid": "19d71840-bd95-4f01-8bdb-b86ff267c3af", "comment": "Malware payload (Loki)", "value": "c227d7da2c7a3370e22e13cff8adfbfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416502, "uuid": "575a2954-d0ab-4e1d-9861-16369943fb23", "comment": "Malware payload (Loki)", "value": "09342291e780620bcde0be6434ae217fb6241a7b115a2babebefd9f84dc44599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416502, "uuid": "173758f1-0121-4b3b-b28e-645d04971d2c", "comment": "Malware payload (Loki)", "value": "abbca77dd27e66bb5609d398af85649f8ade58b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416502, "uuid": "be1d86ba-fd5d-4d38-9584-f5499ce8e426", "comment": "Malware payload (Loki)", "value": "5aabe370b06c8e3a84187fd594ba4f0b0b374ca75e241509d270657c6e246d27c8067737e1ce60b4de5ca05396d659b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416502, "uuid": "fc01cc73-ca63-461c-8246-caadfd39695a", "value": "T1C8E46BEC765075DFC917CD76DAA82C64EA2024BB830BD203906305ADAA0DAE7DF145F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416502, "uuid": "dc18078a-d146-4d7f-b920-8ae59e9de961", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416502, "uuid": "c7529243-4e76-4159-ae27-0e6af538d5c8", "value": "12288:vjNXupI0Z2iNHkDwMD8TH5rTD8weUIsYOzsg0t+8XBy5ggBOmLaO87yUpEU2WZEm:rkI0Z1RkDV8JiUwBt+8g5gsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416502, "uuid": "720625e6-2b6f-4b53-96a5-75528a97b056", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416502, "uuid": "98c8c87c-cfeb-46d8-b067-9af371ca7021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416502, "uuid": "97404b7f-a04f-43f0-8411-58d6407d4fb3", "value": "Order Confirmation 004172019Sep order_00417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d5058d-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395504, "uuid": "6e1dfb6c-4525-4aa7-951c-1556f9c53a94", "comment": "Malware payload (Mirai)", "value": "d53c34189698da96777d7e012dfcebfd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395504, "uuid": "25354dcc-abf5-4b35-851b-e0f1780b9432", "comment": "Malware payload (Mirai)", "value": "094bded2ae6e74d6de599c718ea704968e05c9d9922f9c55615df0730cc9e824", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395504, "uuid": "35b0085e-5a58-4a47-9c64-4ecf8a277a5e", "comment": "Malware payload (Mirai)", "value": "61858cf812e515b6ca49e4472c75766df32025f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395504, "uuid": "b6677328-5247-44f8-8940-709cbc9078f9", "comment": "Malware payload (Mirai)", "value": "7f73ca8a41dae1f41ac175db7b1f5da5641d082e3639a291e4b656a76b9eea5a469b617b4745cbe0e0956fd26d34fdca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395504, "uuid": "9c5fcf0c-8690-4724-af06-0fccaab4d471", "value": "T190F31A46EB408B13C0962BB5FADF43513323AB5497EB73059528ABF43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395504, "uuid": "ff7ee13a-0d39-4c32-9346-daf64931a374", "value": "3072:rgeO9JVn9koakTSp2xTruI063Pvb/szDDohM/REp6sZ:G9JVuoakTSpqTqG3b/cshM/RNsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395504, "uuid": "7eb3591a-7240-46c5-b02f-5b9f967d3b1e", "value": 168100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395504, "uuid": "91e0fa67-0923-4c24-83bc-0a2dd97925c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395504, "uuid": "ecad2793-f9d0-41fd-a45b-f1a48a7cc8f6", "value": "cundi.arm7-20230911-0125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a63dccc-50b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694444549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444549, "uuid": "053a3bd9-b8a7-49f8-a418-be7db43fc8b3", "comment": "Malware payload (AgentTesla)", "value": "db94e5e098c35ae298ab739fd3c816a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444549, "uuid": "fdc4aabb-55db-4caa-90a4-08ecc0db7d47", "comment": "Malware payload (AgentTesla)", "value": "0b0439705aad99584cb07cdbdb81841151de89649eeb7faa70b8cadb91134e59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444549, "uuid": "7700f26f-8002-4ec0-876a-b69f150fb8da", "comment": "Malware payload (AgentTesla)", "value": "96bd5b665ebb5100c215a6c33dcb23ddc07517c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444549, "uuid": "b738627c-1608-424d-9124-3525f40a13f2", "comment": "Malware payload (AgentTesla)", "value": "4cc15aa303430e02ce27ba663cf6bdbd4cfcce211a1a1e09a35d50f652c2fd86d72042962f08ca07aa53c8dddb52892d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444549, "uuid": "eee1fc28-d433-4113-b536-69c188bf5558", "value": "T194B423825196990AE08D3BBF4588048DFE168C82CDEE7C2FFB42EDD4D3D4F55D2A8558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444549, "uuid": "f3cb4859-fa56-4962-b913-987fc0658ecd", "value": "12288:u7C228SV+xZD5advr2ioS44y81IAZHh8E0bw:F2hSMkBr1oSHfZBBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694444549, "uuid": "48b9fb42-636a-4019-9ca4-19d6eb91ddde", "value": 508673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694444549, "uuid": "5fb49006-2ac4-49f7-96fc-e9c34d45d3d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444549, "uuid": "4afab7cb-2833-4d97-a0f3-27f5d72461c2", "value": "Scan Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805ee80d-5068-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694412025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412025, "uuid": "f12beea9-7f49-4a03-809d-216823a480e6", "comment": "Malware payload (Amadey)", "value": "2fc7c1576ab04ca4c1ecf193148cd3dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412025, "uuid": "306572aa-e824-496a-8aac-5a71b22ea072", "comment": "Malware payload (Amadey)", "value": "0bf720a90e9e183f9c8785506ec44d2059c26c1a04302e944bb57bcbe5bfa8d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412025, "uuid": "1334745a-30b4-4dcc-a332-ed6013185ed1", "comment": "Malware payload (Amadey)", "value": "098276a2b11e0b1dc216b5f259a0e2625d94c251", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412025, "uuid": "3477f72b-4e7f-45b6-8a84-2c2ad93f82ce", "comment": "Malware payload (Amadey)", "value": "5a1fdd69fc7db435f402859cf2c6b011f8b6143f2060c2da48d2ef5142f81337e66a6be17325e6f404b0b9041a110f25", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412025, "uuid": "d4851211-1bcc-4fed-b843-f19e71a29626", "value": "T1B7651201BDE39473D4370E340EE896B5593E38618A52ADBF23A54FDE8F311F05669A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412025, "uuid": "8cbfa28d-2aee-451f-862e-efa76820b79c", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412025, "uuid": "9afe556f-7a74-4d8d-aba0-1514f64bed02", "value": "24576:DzQCJ0J2ptnyAq8CuRcJ4y/D0cSJDO8zK/tafh6EFn6vOGKr2Uk8p3PlMnmEEOu6:fQCJ0JInr2/CygDJDPWk1Fn6vOr3k6Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694412025, "uuid": "aaf50262-0474-4b05-abed-1d23282bfe85", "value": 1470328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694412025, "uuid": "16bfb8fe-9ba9-4f13-bf2c-82b7c0533490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412025, "uuid": "46b6ae4e-64c3-4c82-9a10-ee3cb3bdab3f", "value": "2fc7c1576ab04ca4c1ecf193148cd3dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de393246-50a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694439241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439241, "uuid": "6563b428-baf9-473d-b5b7-41cb95c0c6c7", "comment": "Malware payload (GuLoader)", "value": "44e6a64ec8b7fc68c3612df50a575028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439241, "uuid": "628ef1e5-3709-4ee5-b66a-4bc6deee1726", "comment": "Malware payload (GuLoader)", "value": "0cf2dbfa57e155dfc6c1258cdbb652945c0309d4af6331562181248b16c2e804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439241, "uuid": "796d7ce3-f4db-49ef-9e9c-1836f8e7c0c3", "comment": "Malware payload (GuLoader)", "value": "d2b2560aaef6320c6d4bafc8b4039ab8f6224c66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439241, "uuid": "698adf42-73fd-4632-8af8-563dade25d3b", "comment": "Malware payload (GuLoader)", "value": "2ba5fe3f4369da868116fb62fa83a866cf2b10c7c8a5b0b9183e815416327c18e719b7b0b8d9cbc3abd8712708dc9b82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439241, "uuid": "2df011e6-3eba-407d-8b3c-3db0c6c65369", "value": "T1DDC401002F6ECA06F0AF1C701DB5D5EAA2B99DC11C7A66025F337E4D9B3ABC5B249153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439241, "uuid": "9c6a4af2-0d4b-41ba-9af8-e5c5d12e7748", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439241, "uuid": "f210195a-1e5b-45a5-a1fa-c5f1959f8987", "value": "12288:6NgR2Q2Ko786wBQ5e+IGobUDte1k4iZKuA9z+/rKz:6Ngfo7WQLIrbUDt4k4noTKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694439241, "uuid": "ad0f3427-f6e9-4de1-bf77-f7205b1257cc", "value": 585624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694439241, "uuid": "47224e85-5816-4853-82fb-5711c5e30dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439241, "uuid": "e52fccc6-b528-42eb-97ec-5a41650689f8", "value": "xdlsuthdjke456jd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f790673-50f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694472019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472019, "uuid": "3471382b-7d96-4e52-99f1-b7791c538e9f", "comment": "Malware payload (Stealc)", "value": "68edf8c9eaf4c2dbdacbd9510fe4d140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472019, "uuid": "525d6ce5-6898-4034-b4dd-67498d33e0ab", "comment": "Malware payload (Stealc)", "value": "0dc23d6fa01f29fa19e27e2a5008d97129db31378964a1c04740253a6bd9e25e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472019, "uuid": "fb4ccff9-401f-41c9-8ec3-38cd536dae8a", "comment": "Malware payload (Stealc)", "value": "8514f008d1dfc60915faf47ae7d329ee5129cb03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472019, "uuid": "0b4afa3f-04c0-4c54-845f-b0b62d80b266", "comment": "Malware payload (Stealc)", "value": "088da5701084173ea995c7a94e6e90fe399155c24cbadc29cdc755b1389d24eb782f36726e780034e44049b67cedd8bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472019, "uuid": "ccab6554-863f-4386-89d2-385fac5b1905", "value": "T109544B1393A2BD64E52E9A325E2FC6F4361DB6508F5977BB22186B2F07B01F2C172750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472019, "uuid": "0048057e-17e4-42ae-a76e-1548808012e2", "value": "fd6dfb11bfd672e911229df79ae69bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472019, "uuid": "0b59cf92-ba0a-4fcd-8ef3-865d6a13e5a1", "value": "3072:YgXmuRkoZYpjOWoSd7X5UKyI6Hk/7uMBcuiBbZmYgNGE21xmhqF:Z2NoZYpKWBUKyrG7hBMeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694472019, "uuid": "9279e42e-8025-4102-b689-0875a8f4083b", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694472019, "uuid": "5e869bbc-ccf9-4b59-9572-3a3dc9ff252d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472019, "uuid": "a3fa4a38-f030-4252-8130-647987df9eb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52831d4d-503c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694393050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393050, "uuid": "d9c557ea-187e-4c21-a509-08778a961ffb", "comment": "Malware payload", "value": "d5d7a26c2873753cd0d51750442a5a3b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393050, "uuid": "8fd5bc1d-9f8c-465a-8fe1-d6475924a7ab", "comment": "Malware payload", "value": "0dd3fe16573ca998ec7296f3da50a8edac6e2239122224ebe2b3ce252c2f4916", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393050, "uuid": "cdb1782a-eb3d-4e6b-b7a4-6ec67c0f7e4e", "comment": "Malware payload", "value": "ad5d96085b30f9fc8d2c3785fe109b9df8e664c6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393050, "uuid": "43be8d52-58ce-4ca5-9ce3-3cde993e1e1e", "comment": "Malware payload", "value": "f0808e7c9cad0e6320aae7a4e1d8a513bef87f0048ff1393a8fe1b4992f3b40dd06b618343fe20e6b6c5de67a3905503", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393050, "uuid": "b42ad42c-fa39-44bc-9b1a-1cc3ebfd4ac2", "value": "T13BC4124992480B8FF56D7C7B0428193F27973847F969D51CFFD3C026483DE4AB12A9A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393050, "uuid": "33ed8699-084d-472b-be32-9567b94ee75a", "value": "12288:d4ZZ0jWMFvPHMvFUOS/pRIBiLB83fGVQwecw3Fp/ZA6hawM5QV+QrpMdTWuz+:ds09vPOFUNRIJ3fAMFpWqazQV+QrCdTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694393050, "uuid": "0add1006-808e-4bde-b655-83469fc1d5fc", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694393050, "uuid": "cd3dc914-e48e-43a4-bfb0-c97ee9e55815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393050, "uuid": "b78be567-383e-49b4-be67-47186716bce7", "value": "d5d7a26c2873753cd0d51750442a5a3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae73740-5093-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694430538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430538, "uuid": "ad046671-e965-487f-92f4-56b9b81f0932", "comment": "Malware payload", "value": "c90459986070e38fd8260d4430e23dfd", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinese APT", "colour": "#CD7953", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430538, "uuid": "e3e3bb05-a7de-4b6b-8e42-ab42c405bad8", "comment": "Malware payload", "value": "109c04127c3168a386744027413d11a84c6b5c91738b05f5c5e40c45e07b72f9", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinese APT", "colour": "#CD7953", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430538, "uuid": "40ab5ec4-8e42-4115-824e-420687750418", "comment": "Malware payload", "value": "ce3e01c3fce1f4563335cda87df7406c8ad2b6b7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinese APT", "colour": "#CD7953", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430538, "uuid": "15bc3619-6914-4b28-b996-8dfcc1dbb836", "comment": "Malware payload", "value": "d9aebf7734588ceecf7c82d4d924df213f06e1b3c8858ef201c87d5f73789d1931f6e33336f64c15828763c28538f113", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinese APT", "colour": "#CD7953", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430538, "uuid": "9f846d73-4e09-4d3c-abe9-0d143bcb2bf4", "value": "T1C34332E5BACA9DE7EA1452BCCCAAD676203CF4E087134F5396744C325B62E927CD4213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430538, "uuid": "a442c646-a031-47e8-8dcd-487357cd05cc", "value": "9284347e8448a2e126e2a8d612a42f54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430538, "uuid": "bf0fcdf1-798f-4a37-aec6-4b87a4919fc3", "value": "768:UU9M7HdpLfr1wD+lFn7uqXXlfHbE2mmuL6JZs0L7Yp8O6bpbec2V:UN7m4jlf7XmRsZv/9X2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694430538, "uuid": "0f5d38ca-f7ee-4eda-a0d4-b36b1d7d18c7", "value": 58888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694430538, "uuid": "d787b7cd-1efb-4c1d-8f7f-420a96a85482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430538, "uuid": "4baa66e7-05ac-4ea7-afed-538c4f979869", "value": "nc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2d52a9-50b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694443880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443880, "uuid": "a08447c8-3eab-4eb4-8888-8d058559b216", "comment": "Malware payload (AgentTesla)", "value": "31202523d6bb0e3e17314ef804c62418", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443880, "uuid": "dc3fa3df-7df5-4615-8ad9-4e350bfcb576", "comment": "Malware payload (AgentTesla)", "value": "1112ec6727dea65c2655da87dd6da19f82852ef082ca39ed230e7d27e5045c26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443880, "uuid": "94393241-8c5f-46e0-bc4b-0c812b3839e9", "comment": "Malware payload (AgentTesla)", "value": "e8eecf65fb83bb4b2713d4452ed79c2c58ca6d1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443880, "uuid": "5d24893a-95d2-4642-9389-8452558d2f2d", "comment": "Malware payload (AgentTesla)", "value": "6a2e508d959cfad630db80397616cf66357c23da902652f7ef53d2380c2c8a6bf273bfc39f85d0604ea5d6d01230047e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443880, "uuid": "b6e0480a-9149-4b00-8cac-074f2fe846ed", "value": "T1CFD3F735535A5DEFFB6E493498611248A336CA60B03BE78D39BC10F55BDF3E81046AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443880, "uuid": "e3c4f1bf-48af-442d-b809-b49f724b77de", "value": "1536:iSZSvrTa9HrdFylkHBoZsNTHN7Yp2RmD+A+m6wMAAikBTU7AarZF4x35JDi6P78E:9ErTa9ZFylkhoZuyX4x35JDiG7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694443880, "uuid": "d45fddb8-77d6-4881-8462-717c8f37ade2", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694443880, "uuid": "c431c083-b711-4f44-9057-34313fdcf01c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443880, "uuid": "409e8837-a4e1-4164-9aaa-275772088fd7", "value": "INVOICE 23DF-48609.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad64ed9-5074-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694417143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417143, "uuid": "f7f41fa1-cdff-4b85-9aa9-fadf28aa7178", "comment": "Malware payload (AgentTesla)", "value": "9ece32c0fc8b0ae708e78a44e8fd3e87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417143, "uuid": "ece516c1-195d-4b2d-b36a-f6e7d463af4c", "comment": "Malware payload (AgentTesla)", "value": "118ff430ed49bfce3309f6cd178c9b588929459f66614b4ce4f9b63d33b5a49e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417143, "uuid": "5e830306-fbe9-48fb-9280-fc7443bd58b6", "comment": "Malware payload (AgentTesla)", "value": "5fcac0b74fc2ccf4b3c82cc577e1bc401b000773", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417143, "uuid": "19e1d68e-23a5-4bcb-8a34-86e793963cc5", "comment": "Malware payload (AgentTesla)", "value": "64ede8d181430f6a2b8dd7d374ab8a5be9f15bb5e2bd8508ea9afc449b6058ef96367c83079251ece9a1afd5e3361b0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417143, "uuid": "024c7baf-266d-4dfd-8675-247776f18fe0", "value": "T1ADE4125AF7BC4F47D23A6BF148911080137B6E15E172FA194DD320EB25B2B610B92FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417143, "uuid": "246a451a-4a87-4f22-818a-ef5a10134f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417143, "uuid": "4bbf41e7-7dd5-459b-8c54-743124553e8d", "value": "12288:03u2iNHkDwMD8UaYUj84U1WYnSfVvy+EogoaWWZl/BS4KFtFLKKXQI8REcvncuAu:03u1RkDV8nrTUAYn8yo0lpiFXVIcuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417143, "uuid": "4e83f146-876d-42c6-9435-32215f5dcbef", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417143, "uuid": "98015f34-9793-4f22-80bf-1cd6d82014df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417143, "uuid": "6b0b6a37-7335-47c1-968c-49a37b66850a", "value": "Transfer Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1f494a-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450594, "uuid": "49223efd-6579-4f03-84d3-f1c13869de24", "comment": "Malware payload (Mirai)", "value": "cc4503425903100b54c2f27ae4f224c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450594, "uuid": "a5b5320c-9b9e-4082-84fc-158ee510de69", "comment": "Malware payload (Mirai)", "value": "125934299ea5ea0ee6ab345eaba8e36eca96d9c8a08675ac83adc1c89115b7df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450594, "uuid": "70a9d8b7-62e2-4218-9f4b-2a1f20c8f522", "comment": "Malware payload (Mirai)", "value": "a511e84c45e968abc2aef6e7aff01d3e3c75b8e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450594, "uuid": "ebb65316-ccd7-441c-b314-4a7430de2884", "comment": "Malware payload (Mirai)", "value": "5e3efc8c71f12833c3b699bcdf225183f35342f6fe140371fdd2e7c82184afd4ee51301a57efc7e538ea873a2be81255", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450594, "uuid": "90f54383-7721-4c02-aad7-15786e1e8789", "value": "T1D8335AC4AA97EDF4EC1506753073EB338777F03B611ADACBC3999523A881A41D50B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450594, "uuid": "d447c3c0-7d94-445d-be67-4640594b22dd", "value": "1536:Z8MgMbNgZpAu+h9afOs+ORXZhg62NvC4ObwkZw6PB7:azMbKZpADh9U+ORJhg5xC4sfJZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450594, "uuid": "1cbc4471-13ba-4f7b-9b50-148dc9ced7dd", "value": 54288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450594, "uuid": "65ebe2bb-8337-419d-be59-4e7eace03500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450594, "uuid": "251a3f6b-5a7b-4934-9d83-51e8d9ab1421", "value": "cc4503425903100b54c2f27ae4f224c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c232044-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450538, "uuid": "1c25c41b-004f-4354-ab41-c63036e32b79", "comment": "Malware payload (Mirai)", "value": "aa180246d9dcde33dbc5fd24f7aeeef8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450538, "uuid": "497c7a58-1226-463a-9009-7d7a85f34556", "comment": "Malware payload (Mirai)", "value": "13058a187a230b374609d8c3e9e9d0eec8b5726d3fed86028fde3763e46a3d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450538, "uuid": "8ef4e025-976c-4564-802f-8c28cd6498da", "comment": "Malware payload (Mirai)", "value": "bc3d9226b3edca39d2e0a9ca8dc13c4cebd318b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450538, "uuid": "94a5ae83-0854-4492-ab8b-8ee0e29e3a54", "comment": "Malware payload (Mirai)", "value": "6a54b93f7595b1c23099fe2ead5a86f3ceba0d895c63fb49ede00b456b165f7bac17ce3b2cc074ee0077ea9a3e1f7918", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450538, "uuid": "01454e5b-5299-47c7-b180-a10d6e7373d3", "value": "T1A743F79178D15A2AC5E423BAF67E508E3321B3E8D1DF3257CC201B147AD952F0DA7B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450538, "uuid": "562318ce-9ad3-44e5-8894-5a70c671495e", "value": "1536:018ZuVJTQfcnfgyr25Io8wwtxky5eWhKlz12l1d4:q8ZkqRx835thSRW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450538, "uuid": "390f8292-22a6-4698-9f83-d7900cc34699", "value": 55584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450538, "uuid": "8d15c18a-823f-4358-bcc3-44318d1d62ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450538, "uuid": "804456b8-d445-493a-bb85-392b5cba6bcf", "value": "aa180246d9dcde33dbc5fd24f7aeeef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a02e53-50aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694440163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440163, "uuid": "4e08600f-1fcc-4c6a-9f2c-4fd468cb5a12", "comment": "Malware payload", "value": "d77d049f515248bc60a944e65ba586e6", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440163, "uuid": "66730b53-40f1-4c23-b858-3ddba2526aee", "comment": "Malware payload", "value": "13d74bb79a72d3eb5e82c0e8c8c24cac50a8df67b85c38f98dbf72cda4d2b3ac", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440163, "uuid": "e37ff671-2ba5-423b-af4f-3b5fe74e5d30", "comment": "Malware payload", "value": "f2440a4e28460d4355d05307eb0762846fa43c70", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440163, "uuid": "0d98f9e2-dece-458c-b7d2-0f5497096d79", "comment": "Malware payload", "value": "d86c2386032976d434e0646b2507bc5c3e7d5f498b977a0ae136042cdab4aeb28bdbeb2fdf826cb5d0b06ef0a51c7202", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440163, "uuid": "ab75505f-6bd0-4f60-8990-155de2804c07", "value": "T193E312D77159ED6AFFF03678D963FB7761A8FB02A30B52862148E110C68062A07DDE53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440163, "uuid": "4765cfae-9904-4281-84c6-391b838670f6", "value": "3072:terkqDDgQjOTUNZdZBvd6c/Up6MugyWYpgle8hkzePIoZV:teg0DOUrdUc26WX3qePN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694440163, "uuid": "94d31a0c-5a3a-450c-86d8-552e9dc2b41c", "value": 146340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694440163, "uuid": "4887c50e-e134-4a1b-91a0-04b43b7b0a3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440163, "uuid": "b8eb1530-d184-4d7a-ba3c-0f1849ced0a4", "value": "Letter Of Intent (for payment).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add87ac8-50d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694459346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694459346, "uuid": "d885b437-ab00-4d0d-b4f2-f061889265ab", "comment": "Malware payload (NetSupport)", "value": "55ac40cf8c4d7222f9239f28209d4453", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694459346, "uuid": "b0468dbf-bfaf-4ac5-861c-a06c0e8a56e2", "comment": "Malware payload (NetSupport)", "value": "1489e2ac0c15033dbe5f61b6f48484744551ab42b62fdb659d49d1b502598a12", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694459346, "uuid": "29d7fb11-1a37-4ae7-b145-7279816efac7", "comment": "Malware payload (NetSupport)", "value": "89266c0addd82c7a2acdf2399d71e75d3599d9e6", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694459346, "uuid": "9e084989-eb30-4aee-9828-e4465bcffe09", "comment": "Malware payload (NetSupport)", "value": "37f54f7a87d6666cf5fdd12790ac1a0a4f338252bad57cbbc8a83ce5779d82816f91073a3e3ad007be4d4bcb3714036d", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694459346, "uuid": "9b36826e-e36c-4e3f-82cd-cedd2b5b8b54", "value": "T1CAC533138671AD96E522223FA8D6BD30667DD23E7D626DBCC25A85C731CDD86CE6CC00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694459346, "uuid": "9a053db8-cf07-4659-91d8-4a7529282e33", "value": "49152:RcqtEwZjZgN989SQ5PWZMB1qEzda5D/GatWTjvE/OOKnzUjznXQ:RVtEw3e989SqPdiERqpWvMOOpPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694459346, "uuid": "eabbb509-8cd7-4814-8ba0-792385ecc4bf", "value": 2681422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694459346, "uuid": "c3941973-4df9-49c2-8b3e-558d5a7fd709", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694459346, "uuid": "bfbd89e4-3753-4056-887c-6617cf3c161b", "value": "DancingParty.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275cbc14-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694445376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445376, "uuid": "7b1990f2-893d-4b78-beee-7ac8eafe8699", "comment": "Malware payload", "value": "9fd3a5b1277977f44b798739075c4959", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445376, "uuid": "bdb0c561-f648-4d54-a42f-5510b2ddfb96", "comment": "Malware payload", "value": "153d9bd77c2f43f9092654c7f61b914f204889a6a78a628f44a5cbd65af3e4a2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445376, "uuid": "b70dc713-5fbf-4c2b-889c-91d3f6c1637d", "comment": "Malware payload", "value": "7441e3cb1ca6a191ae55182dc5f74d2596f3b75c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445376, "uuid": "9c218a4f-9571-4f6b-ae5a-9a0bdd06a379", "comment": "Malware payload", "value": "3c1db5076b2636b54dc443034954133f7297b4f8712ec47479bd44319ee6ec40e32e3e1827f7276542cba9fd4d2e410c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445376, "uuid": "d96bce2d-bac2-4c2d-aa62-f8885fea749d", "value": "T147236B6CC74F41A9CF525237AB261A1542FCBB7EB34152A1346C837933EEC2DA12627D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445376, "uuid": "c30ead06-f11c-46f1-bb05-d2980c3b31a4", "value": "768:8wAbZSibMX9gRWjkSPcdTExYkUBRr0O6taKT43:8wAlRdqcdJkeAO6kKE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445376, "uuid": "b13697c5-c344-47f2-a0aa-739c8c3aa6cd", "value": 49069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445376, "uuid": "fc5e42b3-193f-4daf-a191-0d4d6c2a1b33", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445376, "uuid": "de50fcfb-a880-4d75-bf55-3f948cd6c742", "value": "PO-0736449574.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b4720c-50c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694453720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453720, "uuid": "5d644250-b6aa-42be-848e-5dfe5002fbaf", "comment": "Malware payload", "value": "02c02920de30db7f8852973ec8bdfedd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453720, "uuid": "1b4e00ca-3970-4a71-8dc5-33982882a434", "comment": "Malware payload", "value": "1545479f31f7b015e2a4865266361821f6ab1870f0a9e067644d19038e2f95fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453720, "uuid": "bbf2dce1-0cbe-48b7-a128-745b3c361bea", "comment": "Malware payload", "value": "e4eebf1a7db4f7066a8748dc5a06159f62e3502d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453720, "uuid": "a54a18d2-7fb8-4a6c-82c9-23800debaae5", "comment": "Malware payload", "value": "7f7a62529fa84b958de28d69ed3853f0415aa1e89df8af2ce5cde6164741877dea6265da4ba07cc4a3c26eb540191473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453720, "uuid": "19aefb3d-08b3-48c2-ab53-83090b34d640", "value": "T13E663322871EDA5BF25E3A30C49DD6B396628C5119C2C55F82D53CBB7BBC16BB8341E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453720, "uuid": "b0040ba8-18fa-4b79-9250-a5329703ca0d", "value": "98304:mDzZVbr78YSL4MXWqb4Bp+fzv5YrHDKewNm95Q6ICj6S67haR:mHZVobip+fzv5oCcQ6ri+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694453720, "uuid": "79628daa-3377-4bd3-b7ca-c7055578a553", "value": 6658048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694453720, "uuid": "4d6007f4-150c-4769-a28e-bc07cf800174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453720, "uuid": "dfef64ef-7d32-4d13-95da-5dcb4b856124", "value": "SecuriteInfo.com.Win64.MalwareX-gen.7005.26153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a13ff6-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401161, "uuid": "ecb79b70-2d99-4d1f-94b9-54c94d65f826", "comment": "Malware payload (Mirai)", "value": "97c8751bbee05bb6fffce17abafca380", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401161, "uuid": "bebecebc-c843-4b70-9b79-81ca1412078e", "comment": "Malware payload (Mirai)", "value": "15552975cccbd8ce214ca984bb8034d2ddafc4c5afb1e47cb89f1e23a34afd37", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401161, "uuid": "3e351fc3-7f1e-4f2f-b3b1-4c9fd99d3952", "comment": "Malware payload (Mirai)", "value": "47f78c2a8589bdff889f4726bfe0ed76e5e4ea42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401161, "uuid": "7c081ffa-031c-4a77-8941-700836234a21", "comment": "Malware payload (Mirai)", "value": "2698c2ac17451f13f8fc21967a251a204cda1c50ec676974978990dfc2ab0e342dce9d8508fe0634e48080ba849c4c59", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401161, "uuid": "ccff6812-2e7e-46c0-bbb9-8592932ab2c2", "value": "T134330907F681C0FDC49AC174476BBA3AD93771ED0238F2A67BE4EA223D96E611D19C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401161, "uuid": "e06bafdd-9a67-4609-b840-18ffa9787e87", "value": "1536:Ru31CxXVpHlCrxsNnVfvj5F+HT2r4DaEXzd0OCUjCYe:Y1sXV5lCKNVfvj5oz0GaEDOVUjCYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401161, "uuid": "ed3255ac-de73-4d8d-a410-f35d33748fab", "value": 55104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401161, "uuid": "2b82fa65-ba3d-4bb6-bc82-7510a037aedb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401161, "uuid": "0e27c020-8de7-4165-8211-d588bbc23be1", "value": "x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78b2416-50b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694443874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443874, "uuid": "6c2fa0d2-536a-4d8a-a9df-60b338802a20", "comment": "Malware payload (AgentTesla)", "value": "480c6315fffe26064422b2d852169de4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443874, "uuid": "5b031dd3-cf86-44a0-a6e8-4432621f4f15", "comment": "Malware payload (AgentTesla)", "value": "167711eaa9d79dcaae543cfc0e8469811866808f81904dba79d2324be2a5f163", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443874, "uuid": "994dbf85-f361-452c-87c9-3c0071bbaf75", "comment": "Malware payload (AgentTesla)", "value": "a162c2082b6527c8be4c473ee9a6bccbe2a43ef4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443874, "uuid": "e199c23a-29fb-46b6-b1ec-2f687279e347", "comment": "Malware payload (AgentTesla)", "value": "fd7478f7810e86ccbf68fce6773adc9485761b0800252f9ccb299f74987e86711776d05f94472ab7f04219f04739ac6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443874, "uuid": "a04e8991-60b8-4497-9aa6-ddbeece374b0", "value": "T19803F1E9F324D184EAC0CDFC3947FFDF82794E45E1811E7FB42D2996B6A06E2850A191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443874, "uuid": "8bab54fc-a4c8-41f2-ab7c-2a8fdb6c3b2d", "value": "768:CnPtco7KCGLFeeuxiN/uWaZB2KXXqYSPBHEfAGGXr5GnhSZkMhs:CnPtn+CGxN2WaZB2KKYMNMMkM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694443874, "uuid": "48ed6e5c-dc36-444e-8099-26309a65b389", "value": 39287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694443874, "uuid": "1bd6c86c-1bc2-4c23-85c6-8601eb2cccc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443874, "uuid": "f2603fcb-a0f4-41b8-a468-6606afc6dd27", "value": "INVOICE 23DF-48609.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05167743-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395497, "uuid": "d87ed232-5094-4656-afed-57f798da51c5", "comment": "Malware payload (Mirai)", "value": "f324f671a7e5eee0e74906b735970491", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395497, "uuid": "32978b4e-da02-4a92-a7a5-48de973bb143", "comment": "Malware payload (Mirai)", "value": "16d4817fd5ab0c4435f9e61be53e07ae44e83f5637aaf21c554c7a7013e4db98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395497, "uuid": "ce6ab324-1857-4647-bb07-2f4c02cd253e", "comment": "Malware payload (Mirai)", "value": "930f5fd33ffd0b50d2baee32facefdaef4b197e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395497, "uuid": "46a6765f-e125-469a-b0db-2d48d2c554d4", "comment": "Malware payload (Mirai)", "value": "3d76283bdff07fc711fd50abf801f12a836c206d6daa4d8ffebfec0af01b4f5eb5f94ea61bf7180cb85e293b1f34ce08", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395497, "uuid": "89b0e610-e688-41be-a3e1-0017436c120f", "value": "T1DDF3C70AAF510EBBDCBFDD3702E9060139CCA55722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395497, "uuid": "d85dd04d-4338-4a60-9c73-431ccb26e31d", "value": "3072:wt80JR0Aq4zDeLZDWnu7rpv/eLMnO723:wzRVzDeAnWr1G4nB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395497, "uuid": "0243e76e-c18e-4ca6-a834-d01254c1bf8a", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395497, "uuid": "7cbe484d-9e6d-472a-b27c-02258287f050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395497, "uuid": "08d7b854-b1f2-45ea-b927-23e879a957cb", "value": "cundi.mpsl-20230911-0124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae80dde-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395507, "uuid": "ce4c61fd-1165-49cf-a68d-7e5ee7e0368c", "comment": "Malware payload (Mirai)", "value": "b20bcc5731b3bbf83818d60d2dc7c451", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395507, "uuid": "46366ea3-165d-4d9e-ba9e-98396e679a07", "comment": "Malware payload (Mirai)", "value": "16e6142dfeb2283e085a346ccfb6888ee8dba1fe93dca82452e4aec6a67c3993", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395507, "uuid": "198c52b9-2bee-48e1-ac39-d143a47d2e50", "comment": "Malware payload (Mirai)", "value": "bfe2bc72e0275a414f97c373ef71360b5fdb141e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395507, "uuid": "7a66b857-f826-4524-b589-840c14dea42d", "comment": "Malware payload (Mirai)", "value": "70a74504db40e8018cdb8382909b24f7c22d0e97cfd3db5e62bc30b59effd8057960eff96e2d11c79ba7b210b924e1ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395507, "uuid": "300f920a-4a17-44e9-a1e0-3c17d268977c", "value": "T1C1C32945FC508B27C6C252B7FB4E428D7B2A1758D2EE72039D256F61378B86B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395507, "uuid": "67eb33a7-4d07-486e-8478-225c5ebd084e", "value": "1536:4hEOKKsda7A0F0AC7M4VeWJ/TZNw79JuV/k8XtB+lXaLwyweFnpgj8+3tYFMKbOF:4hcudF0y41llNw79Dyta9BFcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395507, "uuid": "0abcbe0c-2260-4b04-a459-c51adb9fdf0e", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395507, "uuid": "24ea52a8-1aa4-4d23-b651-859c7b6aa10e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395507, "uuid": "c7b6e504-f782-4fc8-a893-60ff56c029d6", "value": "cundi.arm-20230911-0125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d717b20f-505d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694407446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407446, "uuid": "0c72daa7-32d2-4686-8db2-41df5505bd29", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6c4b874e5d6d6142b955534ae4623f6a", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407446, "uuid": "71a496b4-9b26-4c42-a9b0-b17508e80e6c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "189af501e84dddc5af3f7a66dcdc5095d22570abad100575ade261698d199bf3", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407446, "uuid": "4ec0153f-453e-4056-bb72-97aa6255255e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f7c8ec134509a91d66e3c6ae01c39a7658c9af75", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407446, "uuid": "23d11aa6-1c6d-4f13-9c5e-5e0e932dbc1e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "653468c169758b342cec62846637f888ada8d7c9dd403d8c557490d298555137536155194cbcb88217121b9653d2475e", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407446, "uuid": "523063b9-b1e9-44bc-aefd-f40dddeb865e", "value": "T11AB533045B9DBDF3E296F1BC1F51C9CD122725E66C7C20BE225D2D929E2808D660E39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407446, "uuid": "a9cb89e1-b476-49ed-a516-224f93c175c5", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407446, "uuid": "8b892e52-b205-4e78-8321-5c6b16274541", "value": "49152:76dqnhy2VtXQS4UKVIJiacmnGnDsCaYKckJrtR1yBwmeqT00XYyVbvfnpD:edqnD+g+IJtccaBavb1AdvT00XBVb3pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694407446, "uuid": "3ae2a8da-82a2-41e1-8020-e345d56e4688", "value": 2285249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694407446, "uuid": "f9a16653-5e22-4421-94af-728aeee8d00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407446, "uuid": "4196514e-4416-4519-bfe8-b12dc1eb3d03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830938f4-509b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694433934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433934, "uuid": "220f60ad-527a-499e-8b1e-7f1c39a8f1a3", "comment": "Malware payload (Loki)", "value": "654809da50d393825e37c11eb195ca41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433934, "uuid": "2f9051d4-1a70-4706-a18c-2a3bc506283e", "comment": "Malware payload (Loki)", "value": "18dcdda94be8e6188cbb3b45a7017b13e1a46a0bdd88742e8a2c8756af7b3fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433934, "uuid": "291762e3-7aac-416b-b6ba-1395fe62ec86", "comment": "Malware payload (Loki)", "value": "04f9ebc5a9dc749b3426f8fb3f1f30fca57c8285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433934, "uuid": "2855ea1a-7826-4a5c-a2dd-e2ac12b742fe", "comment": "Malware payload (Loki)", "value": "c89adff9dd42fef9c1b15276735a9830558ad276e5bf2f8673d6106ba7d746199e322594f5b8a904c1cd757a9b902a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433934, "uuid": "978510c1-9efd-4b4a-b728-321b60ee2008", "value": "T116546CDC726076DFC867D4728EA82D68FA5078BB831F5603A027159EEE5D897CF140B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433934, "uuid": "30a035d9-97aa-4985-ac90-8a956f612d84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433934, "uuid": "465a484b-40e3-43e3-987c-4382bc08d1f8", "value": "6144:vpLIcPzLsCouYucg4Y+W8zezAx+VrtKbGHAqQLcQQI:NDsCBv4YYxERKbGHAqQLcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694433934, "uuid": "e465b513-91ce-4392-b628-211e2bcfe0b3", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694433934, "uuid": "32811516-1973-42cf-9cb6-b21c0f29e8fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433934, "uuid": "d95d1cd0-6d52-41f1-8f5b-637aa64ab642", "value": "654809da50d393825e37c11eb195ca41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976fc17a-5062-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Zyklon)", "timestamp": 1694409487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409487, "uuid": "b7ce6326-a861-4e0d-82c5-cf84be0a2b65", "comment": "Malware payload (Zyklon)", "value": "fe0293bebd19d5a9bc1ff6cc5ed51825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409487, "uuid": "c5991082-1cf2-4639-8f55-5d4e4b05dde4", "comment": "Malware payload (Zyklon)", "value": "191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409487, "uuid": "9908e055-27ea-4526-ae86-f24fc41472ee", "comment": "Malware payload (Zyklon)", "value": "3da18d116f60dd15d414d628cb172c49a695ef22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409487, "uuid": "7ff3be24-8906-455d-9446-f6b3496bd871", "comment": "Malware payload (Zyklon)", "value": "da9e4b8a791c4876ccbf0989bc97190e519269f61ac633627e66b1db96389d80139effe8ee0f1b2cd5291505d9a3aa60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409487, "uuid": "20a74dae-2bc0-4967-ada6-a5192e4183ff", "value": "T139F55B95BA814CB2CE5D12F1CD9217084ED5C4462328F2FB3AC781D9920DADB5BDF68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409487, "uuid": "d7055482-f068-4bab-9aba-c66fb1556e8c", "value": "49152:zkOVlxX1QX/aPViFGEz47ukfkyhn+4r0Sq5346HAP6BzUb:zNHxg/a0Hz4H+40fhhs6lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694409487, "uuid": "a75f1d65-640f-43eb-88a9-dcba15d589d6", "value": 3462656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694409487, "uuid": "364fd5b7-059b-40eb-bb84-4c26c2f2df18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409487, "uuid": "8c3bdacb-d327-454d-b642-ff49e33394e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791c3ac3-50b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694442937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442937, "uuid": "f9c77c25-8f7d-41c7-8131-be9ac66ef437", "comment": "Malware payload (Loki)", "value": "c7f82d4df2664e421fdfe5ca6d8a86b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442937, "uuid": "ebd229e8-95d9-411e-98ec-192946ff7c89", "comment": "Malware payload (Loki)", "value": "1b753e6642abad59ad95793c0eed776fd9997733fd65b9331826fe75fb6942aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442937, "uuid": "c52c193b-4b3c-45e8-8613-a43091c221bc", "comment": "Malware payload (Loki)", "value": "f71e0bc7c83da18aa4c3da7503e4e8deae294e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442937, "uuid": "f59c7efc-fafe-431a-ac00-cd0937f517af", "comment": "Malware payload (Loki)", "value": "9e09347fed1045d60e1997afbcd47ae4f20a61a85a304f6609e0b979603b29b9e294acbeda313f034fa6cd25c8c536ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442937, "uuid": "b601de50-bb86-40e1-9a3a-d7f6662e67ea", "value": "T1C294225DB33C5133CB5B8CFC2819561125688A578AC0EF8F89DAB4B07E7B3DB164264E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442937, "uuid": "fdbbf21c-125a-4994-8ad7-060a3a347595", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442937, "uuid": "4c51cfca-0101-43e5-acf3-67cc85462c36", "value": "6144:xqaLVHSVqV59+KQLe1DpSmUc4l4LjOfo3pm9RANiJBiMEzPcXbyd9s+q3/lR0oQJ:zz1D0mUdkjpZVE+3q3/TBW6m9TSrUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694442937, "uuid": "dbb1b8cb-1189-4acc-978b-0108771ab9d3", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694442937, "uuid": "3e55b261-58c8-4f31-96f4-df6619baedd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442937, "uuid": "e6bf692c-d5b5-4b2d-86ea-2ec5f3a1ceaa", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3c8fe4-5098-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694432473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432473, "uuid": "6d10bd5d-f369-4e0b-bf2e-07b5b4fc3cbd", "comment": "Malware payload (Loki)", "value": "82adbdb0b1ade0fc1b10d7b2381a2f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432473, "uuid": "1631527c-3e2a-43db-be71-26e25c14e4c0", "comment": "Malware payload (Loki)", "value": "1ba08e21e853f047bd0659e235dc2e5dc8306a78ff3da506fdc04b0042f5b202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432473, "uuid": "0dd40e3e-a7a0-4833-86e4-08a3d80ce5b8", "comment": "Malware payload (Loki)", "value": "7d137e30fb2b61b8e129f81c1c0879551b01a7ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432473, "uuid": "76dc40c6-35c0-4f43-92db-30c9961dc36a", "comment": "Malware payload (Loki)", "value": "73031efdda24c53c007edbbd59073a0bbc73ca526df33f2ebee0717125f19971db43b793d15ef011f1fd58b5ef6a1392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432473, "uuid": "05f59ea1-2e89-4bb1-b4f2-032d61afdcc4", "value": "T1A4A41280668C017BEA3F11B985F366891F7882917162DBCE2ECF661D26B5F8E49107D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432473, "uuid": "1f33e32e-cfc3-42e6-8f6c-0113c2d29a02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432473, "uuid": "cf3171a2-75db-41ea-ad96-248db34d1416", "value": "12288:Pka2iNHxWoDrLXDB5M2nZ4SJ06E5G/fhAtL1P1T7iSqp+5:711xjDrPB5M2Z4SOZ5G/JML/7iSX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694432473, "uuid": "d69a5ad8-62d2-48f3-b081-da29095ca4dc", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694432473, "uuid": "14d3e92f-8d7e-4622-9951-e05b1fa7c07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432473, "uuid": "a89ef964-c4bd-4b45-93fc-119928d1614e", "value": "INENQ04220 for IT Equipment and Installation (Amended).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db46db0-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424744, "uuid": "e79847cf-7559-4a51-a9aa-c767135832c9", "comment": "Malware payload (Mirai)", "value": "4e1b7fa8603487189e46db329ed35d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424744, "uuid": "7e50f9bb-9d68-4bd9-9483-da2c2fbf01a7", "comment": "Malware payload (Mirai)", "value": "1beb6198634eb471a564e3031abc5334f319eb4aee32e11237a05adbfc5c559c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424744, "uuid": "c015eeb9-5b84-40f7-a992-0e7c63197eea", "comment": "Malware payload (Mirai)", "value": "10f72e9bd0ab5ce5ea017fb171a098fa33e241ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424744, "uuid": "e5c2a53c-b998-4888-bd38-cf42230448ef", "comment": "Malware payload (Mirai)", "value": "eb55a65b39652072de17e512451fac207a2db474cb16f48da809c99342e40f12043aefda086e912f8de0727ada515070", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424744, "uuid": "a299d7d6-d637-4c49-9f6a-010c63f18824", "value": "T1E8B2C064442557F3D1411AB9FC7A868B2C1F2ABCF69D713A1F8207E4F68404EA5BE386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424744, "uuid": "99467a96-479c-48be-bdc7-d28a4c20a106", "value": "384:HvxZEcGph4dZu4EdHbbTwmcNGWyaQaX/JiODO0QIVHbKZd3LhymdGUop5h77:P1BB2bjkGWiOSeVHbKZd3Ls3Uoz97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424744, "uuid": "18c41734-7305-4acf-9aca-87dbde00eb03", "value": 24784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424744, "uuid": "9e35e54c-8fa7-48b2-91c2-d82132705606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424744, "uuid": "f4fc5f42-96b3-4e63-bd3d-05a8653ca8a3", "value": "4e1b7fa8603487189e46db329ed35d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44af7969-5066-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694411066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411066, "uuid": "bd0baac0-377e-4909-b823-53c3f355e527", "comment": "Malware payload (RedLineStealer)", "value": "ad9d82cbfa9e339495a1e9f1dd50e6e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411066, "uuid": "8ed6495b-92ff-4ecc-9556-0476b9c3132b", "comment": "Malware payload (RedLineStealer)", "value": "1c49a348b2ab8770354c67daba8eff1b411005fb6626df6bb33e3a9a32ebac8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411066, "uuid": "992ccf50-cf46-4858-8bd5-40be0fc886ff", "comment": "Malware payload (RedLineStealer)", "value": "dcccf2553ecf6ff1ddddda559b2d9e0e8818d7fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411066, "uuid": "0bcd9763-93f2-4c53-a7be-9f3c8c7e07e8", "comment": "Malware payload (RedLineStealer)", "value": "2fb7bc7d16feee2a50d883893f24fa78502c3353a211e14f4d3cebdbcedf675f37d42f8ab413db96b54f4f716f50defd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411066, "uuid": "f379e8a8-b4e7-4f97-9a99-e8990a2b7d19", "value": "T16AA4C0D253D0B8B1E6234631CE2AE6F42B1DB8604F257AEBF7546A2F09BC1E1D572311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411066, "uuid": "13c359ff-bdac-40ff-aa06-0602693c0740", "value": "c0ea63f985a38ccc61e41516c5fe1f2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411066, "uuid": "f46d95c3-6878-437e-bea9-9a0dc3bfff3b", "value": "6144:tCizwhx4xsmFCMWGUsS6TO7+5HvJ9BYcwEK1N5HPuQZ7RhsYErT6i7QeWdLl:xzwnwFCMDhT5HvHBhw18QZ7/sjreMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694411066, "uuid": "5c3cf977-9943-4ae9-a0fc-635379b7ffbd", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694411066, "uuid": "7471cbe4-b305-49d1-9504-f98c7d4656aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411066, "uuid": "ee379756-4fec-4d0f-8dee-0250fea51a14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c7cbf8-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450206, "uuid": "726bbfa7-3b53-4523-afe4-36bca062da9f", "comment": "Malware payload (Mirai)", "value": "927a49a6f2ff8ae05919ad39851ff2de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450206, "uuid": "e7e59189-1489-46e0-8c73-a71009daa2e0", "comment": "Malware payload (Mirai)", "value": "1c8173bb013c6438895063c87a136b18888486ac9e67fc3ab9f40edd3ac13a5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450206, "uuid": "4b768a68-0329-4b90-b0da-cd1407dfc6b7", "comment": "Malware payload (Mirai)", "value": "996a0cab301e98c02672effc9f840c35c9b0ed5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450206, "uuid": "17a4c246-f053-4669-af7f-28efd2975e65", "comment": "Malware payload (Mirai)", "value": "44ec7ea11878efb2077c8cd0f0e2f8ad31ae9553c10571e465ddf265f57a413d6c5918c28376580d8740935b3dbc312a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450206, "uuid": "14ac7a90-90e8-4711-8229-d5e1933b39e3", "value": "T136B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450206, "uuid": "da29fc0c-653f-4c84-88f0-cd6c398d4fdd", "value": "3072:MDVLSItJP+Xsp4JlN3HLjmH1cuEgvniuN/:MDV+ItJH2l3HLjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450206, "uuid": "a87a40e6-c2f3-4311-8fa2-a36da2960c80", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450206, "uuid": "de8f381a-63b8-455e-80cd-f8ab32448575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450206, "uuid": "f9e0987c-19c3-460f-97d8-40b5883f3e18", "value": "927a49a6f2ff8ae05919ad39851ff2de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9df8ce-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694445412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445412, "uuid": "f88a79b7-5e00-48dd-a398-e6fde91ad011", "comment": "Malware payload (AgentTesla)", "value": "5855f0c245e89af431c51165c2b7349e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445412, "uuid": "70a2677d-48fc-48dd-b76c-11c43df363c8", "comment": "Malware payload (AgentTesla)", "value": "1c8632003f3d64de26561b71788eced802de71cf7bce1b86ec603364efae1359", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445412, "uuid": "6485b847-5f75-4cd0-bcea-2ce3dbf65382", "comment": "Malware payload (AgentTesla)", "value": "89a94a1515da2221e504309179acdf13e47b920c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445412, "uuid": "d331b596-492a-4a33-9cb0-e9bf059f2725", "comment": "Malware payload (AgentTesla)", "value": "1010c6fe798192f4e506d7db7ffdc66382b6f7375344ac6f11e5c1d2d9ff272f69bcbf7d0efe76e75817338e6e74b2d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445412, "uuid": "8d4680f2-bc5d-4ce7-9ccf-8fb7a1681a8a", "value": "T1D1236CB1EF9416294D4F3B9ADD018841C97C81299927516ABDED03CEA20BC9DD3BEF1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445412, "uuid": "33676b33-98a6-4b7c-8841-345197e64618", "value": "768:qj5mMdmi+YFhdbYLFT30ASDOrSu6ym+puMppQl05D/sx0AXBeRgRXGJgqY5WMZvs:qFmMeYliV0+SuiDMpGc0n0Rg9Q2dCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445412, "uuid": "fc0c393f-c065-4d6c-bf50-aa6599a3654c", "value": 47670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445412, "uuid": "93e43278-d8d3-4b3d-bcd9-fd385a221084", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445412, "uuid": "dad18382-e9c2-4400-aa1a-e4aa617e8b70", "value": "8001117684.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae12191e-5074-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694417256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417256, "uuid": "7e209afd-93ae-44eb-993a-fd3c1f866fe7", "comment": "Malware payload", "value": "f916f5b4e6826a858b65f625d6967143", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417256, "uuid": "b88c67b0-5239-4d43-8ff4-ba5623e423d7", "comment": "Malware payload", "value": "1cce5d89ef45107eeb750bc3fef9a5eba555c8216e6394338f4b06770e9a09d5", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417256, "uuid": "baa4af6f-72b5-457a-bc14-2f1aa6a1eef3", "comment": "Malware payload", "value": "0308953d833e68f541184e78d7915a867fcde609", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417256, "uuid": "b95fe61d-c319-481b-9b12-8c0224f7dc4e", "comment": "Malware payload", "value": "b0a757edcdadbe6b64e9a2b53eb4a5b6aa46673735e084d3bee8fc8bf32d51908b4cfc3d45c3589d438fbf4f3b6ef747", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417256, "uuid": "aea799c6-91cf-4e04-a13a-44c8e8d6b6f1", "value": "T174B54C11F286C426DD1D03B6983DEE2A107EBE77073140EF76E9356A49B35C2623AE17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417256, "uuid": "5b5f6d3e-a857-4041-b52f-1fb12d52e913", "value": "49152:5NJicAk+q4E5q8g73kQLWj1s9w4Uf5rXf63h0ero:V/+XyQyj1s9wPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417256, "uuid": "49cf9594-452c-4be3-8d33-d8e0b725ba42", "value": 2415616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417256, "uuid": "06dc73b3-f30d-4ec4-9861-2eee342b5994", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417256, "uuid": "e62f6e44-78b3-4701-8ab4-b360630d7e22", "value": "Document.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490196a7-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694416227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416227, "uuid": "8d3c0d7e-5fce-446f-bdcf-beb66855e1da", "comment": "Malware payload (AgentTesla)", "value": "91d45a397968ca339c42dc867df5a037", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416227, "uuid": "1aef7515-67d8-439c-bf97-314c63302029", "comment": "Malware payload (AgentTesla)", "value": "1d4c6f25dac8629f39df7b850f9167733c88c4003b406635d2d3f5081a538091", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416227, "uuid": "599032ee-4d83-4a31-b42e-e1737c7297cf", "comment": "Malware payload (AgentTesla)", "value": "5da92090a5921b8eb74b21ea708e8f585686441a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416227, "uuid": "5d9fe565-ec7d-4094-9b39-c0c6b60835d2", "comment": "Malware payload (AgentTesla)", "value": "a2a8070780077c9375b5a3ae47547a4f21a7609f8a74b7ab13c1a57a0716bf9bd0047b84a81499d1fff25a2917a6fa16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416227, "uuid": "981b8766-b03d-4eee-8f13-e75e0f64a363", "value": "T158B423FB08F47166A9A8E0C3243F17C71B825D6E9DE58BE49C4605189F4FB13A9CB271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416227, "uuid": "c01c3ba9-25fd-49a5-b799-4cccf42e71cd", "value": "12288:6g6m0YNPA2noAgJ+gffoljsy9zJZWce0WK66Fa+5DqiFDnJCsvQ5ZqdhwEFkO:bQM3k+xmyRjWceh/sDn7Ct0dh1FkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416227, "uuid": "ca28dfae-4b41-4b17-a637-8052ed82b27b", "value": 494808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416227, "uuid": "d9bdf71e-db59-41f8-a6be-95b3324f9a05", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416227, "uuid": "76bf2667-6a6f-435e-8497-c40040412689", "value": "Swift copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6258ed-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424766, "uuid": "297e84cd-8fab-4a96-bddd-5284d71cb3a1", "comment": "Malware payload (Mirai)", "value": "0cc49ac3879e12ac37746bb355fad504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424766, "uuid": "08cf3135-c21d-4129-9d9f-5d1c315da8f4", "comment": "Malware payload (Mirai)", "value": "1d8a76adb50f05555cd6349d497419578731cab7bc13344752daec96b37e2bb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424766, "uuid": "dbe9a70d-6b9a-4b23-8c2c-7f6bad2a0d1a", "comment": "Malware payload (Mirai)", "value": "0d53a7c77a2399f28d2d9e3c4bef3a6f21bbbe4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424766, "uuid": "c89c4889-dab6-4475-a435-059aaa1e940f", "comment": "Malware payload (Mirai)", "value": "bd55ffadc290e02a3a9375aad1fc43267f20d104d5d367d32c39f8068b058b9bf864ea83d95efb6f1f04ba8501e19676", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424766, "uuid": "a14d04c3-1d1c-482c-8f34-a1853a376b8c", "value": "T15D634BE5B8029F7CF44BDAB685260909B522A2454B930F2BE373FCD76EF21948957C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424766, "uuid": "b5d8e9e3-cccc-4e41-b6ae-868f3f03ce47", "value": "1536:bsH5IE4vIS2O0s29SDxiZv+WLLNKeJY0jIbUHMI864ho:bO20cxioALMc8Usk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424766, "uuid": "fee132c2-fc77-45cf-9285-47e48fc98bb1", "value": 72388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424766, "uuid": "354fb3f9-d5b5-4489-af31-c6ca4c92fe21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424766, "uuid": "889db318-64b5-4478-a09b-6ade7b05d65f", "value": "0cc49ac3879e12ac37746bb355fad504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3459f0c-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427143, "uuid": "fd8c67c7-2abb-4b34-8eaa-85ce2a9e39e8", "comment": "Malware payload (AgentTesla)", "value": "ff7a122f8609da0195f8faf5846582fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427143, "uuid": "81674088-b0ef-4acb-a597-5098d87a8c68", "comment": "Malware payload (AgentTesla)", "value": "1dd655c81c9df47334842272e37b501d38788f0cdedb3aa1a10ce0fd3b68ddbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427143, "uuid": "c80765ae-1eff-4755-8c3e-6463b1e35ac0", "comment": "Malware payload (AgentTesla)", "value": "9ad5c91d9e19e12b92f2d94ef2d486d000cad672", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427143, "uuid": "057f7a8a-9dfa-4bd6-9fdd-ae6fd82668a0", "comment": "Malware payload (AgentTesla)", "value": "655275701145eb762ddf24e96bb4118109897e5bfd541fb6d97c37c84cbfd0573f993d46eb5f6df7e1288179c46d4fe8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427143, "uuid": "2e2b66e3-31dd-4f2a-85d7-cc6c82c7d20a", "value": "T12AF4E05261A94B96E82D43F2A4370DED07B21D2FD6A0E91E1C9EF4E257333472216D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427143, "uuid": "5341692d-aa61-4057-b61b-9cc04b728c62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427143, "uuid": "b0da6f9d-d2f9-4a3a-bdad-cf006c28d24e", "value": "12288:d1DqPpVTFNS50aDUeoQwiHkiEdvpjMBOEGL9p2W7E:HDq/T/taDBnei0MGLXpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427143, "uuid": "cf2c619a-fe07-4a97-8497-fdfe5ee873be", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427143, "uuid": "98f331cf-6d2b-4b8d-b533-ed86d843fe18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427143, "uuid": "5fc8b8dc-a9a9-4c85-9121-38f395375a70", "value": "PO-001120230627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c679d1ba-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694438771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438771, "uuid": "363bb9e6-f5fc-4383-9fd5-6a2dea577433", "comment": "Malware payload (SnakeKeylogger)", "value": "c03afb999b499ac679313f7fb4ebd703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438771, "uuid": "f365e969-439b-45fa-93b9-370279c7951f", "comment": "Malware payload (SnakeKeylogger)", "value": "1e70c09201e53b1e0c264b6f6a68ca7bd0b0ce9cbb4ac9c4fd4ea5104914c181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438771, "uuid": "69a7a898-ca88-405f-b0d4-ddcb706a352a", "comment": "Malware payload (SnakeKeylogger)", "value": "9b75058bd982d3738c0df906d105b52bb35a1668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438771, "uuid": "6aa78bb1-1b1d-49b7-8e37-99cc8b1f9d4f", "comment": "Malware payload (SnakeKeylogger)", "value": "d31f140d910e2c2f463276d033358b8c50b7cd5541797880b7381c11361a2277f5bc2e1f90d6fde0ed5bda4f543d496c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438771, "uuid": "26cf8c84-d7e4-4949-a0b0-bcbfcc21c1b4", "value": "T105B41218A85B4B71C9F467F3012824C16BF8A5687059E32C1EDAE6C5EBB3B5943C3367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438771, "uuid": "37b2c23b-275b-41c1-9bb5-7be6de292bb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438771, "uuid": "3068b828-7dfc-4bc5-9791-56da575ab731", "value": "12288:h0yc3K1teptF7k6z5MqiUc3xr0o2ImNK5axGS005fVsbRYD:Gy0oep77f5MnUc3xrvCGS00tOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438771, "uuid": "67951ced-801a-4066-8169-222579a1a189", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438771, "uuid": "581d8f94-db41-4cd6-972e-15d830aaa9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438771, "uuid": "19e44cdc-a325-4699-8191-590a45d8fa8e", "value": "RFQ# 8008188942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4effb4-5097-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694432362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432362, "uuid": "45105e01-f95c-4f98-b16f-9dbb8e8e1475", "comment": "Malware payload (AgentTesla)", "value": "c060361bf3d491fc4d707eafb020da75", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432362, "uuid": "06362ce5-b066-429b-a20c-40bb02311c92", "comment": "Malware payload (AgentTesla)", "value": "1e91245d573561727e2369652c570bec301b4280122daa4acc614be1bd630afc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432362, "uuid": "c067b1ea-8124-4ed3-8471-989cd11981bc", "comment": "Malware payload (AgentTesla)", "value": "d4641dd6a47441f7aa72a419333918c5e2e4351c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432362, "uuid": "80058ed6-9504-41bc-b789-1c6fbaf3c3b3", "comment": "Malware payload (AgentTesla)", "value": "d672f6c035a88398692303c1b85c09b075b6afe5ce07830257bdeb851ec39866e8562b05f96f12be9a5da03f879a27f2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432362, "uuid": "08d7f006-bbe7-45c1-8ea1-aa97ad10a451", "value": "T11DE4331D2B9905EE3B22B750794AB74323216E8D3F6D288DC33E2B2217F746075935B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432362, "uuid": "6e95a5e5-169b-42b2-9be6-7e07a936d712", "value": "12288:9IqJlrcwXcpJcrak58Msw/pslSpZpbqUguys3CkUqPWGV5TmTNrF7FxWvGCDi:+qJtc77R8/psleFqUgjeCkFOGV58NnxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694432362, "uuid": "48bbb21d-6f36-47b1-afcc-072e60f8df81", "value": 701094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694432362, "uuid": "557833c0-a5fc-405a-91e1-17631549e482", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432362, "uuid": "dc632969-5a02-4e88-be69-0b2281596b4a", "value": "PO-02603_FINAL.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a98c16-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424197, "uuid": "22167866-511d-48e1-a20a-51b9c8b3e8cc", "comment": "Malware payload (AgentTesla)", "value": "7533006057d2e2ef1b36a0acea87b4b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424197, "uuid": "6abf8943-584d-4040-ada9-cfcdb742c6d9", "comment": "Malware payload (AgentTesla)", "value": "1e9777b2c04baf8fbcbd1fe98dca2b251bef9c779b53380b6caeb8f8e958e3ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424197, "uuid": "248f641a-162f-48b0-b8cb-e4ea39f59122", "comment": "Malware payload (AgentTesla)", "value": "4bda9dbab6aea1345fef32404fcc40080156f11c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424197, "uuid": "64b18ac4-fef2-4711-972b-85c58c71d505", "comment": "Malware payload (AgentTesla)", "value": "7bb4b431b68bcc98d673d59898d9af2afdb956954c60485aa646122c5cd42c1bee1fe518b7c79ad6ef9d11aae104f62c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424197, "uuid": "14530f30-b4c6-4aa0-84bd-c9e386238f9c", "value": "T1A9D42205327E8B32DA4D8BFDE553552807F8150F6101EB9E0ECBF8F9A6A3B450290E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424197, "uuid": "497cd76b-22a9-4d14-a386-bf3586c90129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424197, "uuid": "63ff9e20-6fda-4a7c-af29-1b6dd0148e72", "value": "6144:DAeBLe1Dp9MurAQLMBqYotCpSHFzhVtUIXSWDhzMzU2WhGtEFYXmc3RP5xX1vdhs:A1DXMuJMxoEYdtU49QDmcB5JzJSbUzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424197, "uuid": "ce14fa5f-66ae-425b-af0b-0670be344bd8", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424197, "uuid": "6569a62a-983b-4134-b41b-12482894beb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424197, "uuid": "d38b76d1-c151-4f4c-b989-4eb6b4e0768d", "value": "Ziraat Bankasi Swift Mesaji.r12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a2590e-5090-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694429125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429125, "uuid": "2f9cc4e3-a09b-4658-a682-19c6475040e6", "comment": "Malware payload (RedLineStealer)", "value": "3cff0e2e3c9fab904940bf29b87af501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429125, "uuid": "6080f079-705e-452f-9beb-6427d0d88eaa", "comment": "Malware payload (RedLineStealer)", "value": "1f9e8883d98f19ff0574f72c03b9f250fbb555c9d87749fc2ac7ad031b259816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429125, "uuid": "a4103a71-c50f-44e2-b4c4-61236b587400", "comment": "Malware payload (RedLineStealer)", "value": "6f51566e4d2b90215f277553f92a49faad223cfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429125, "uuid": "5a9fac6b-42bb-4fc5-b3e0-1c4022123ff4", "comment": "Malware payload (RedLineStealer)", "value": "af95eb4dbd8ab1899190b88da3facbecf4cc49ca89302d83bb141b8f86f9b88d8fdf611afb5bc26c1d783c96b76f4a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429125, "uuid": "e35f2bc6-c629-4f1a-9808-93cd908a3601", "value": "T1E165125178E28073D833197539944777AA3BBC608F559DFBC3690F2E0D60381AE76A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429125, "uuid": "d037a2e1-7f71-441c-9e59-59111d2c7c9f", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429125, "uuid": "3995f7e1-44d9-4542-ae5e-0027bc99ff18", "value": "24576:7WUCJCsJGLA6ELqR4i79f6O5H1N6Ldec2bugQnxw0Ys7qzx2CYEKu1Hg:yUCJCi0ARGF16ib6kcswSIqwCYEr1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429125, "uuid": "a7502667-3006-4117-8241-7814b265f656", "value": 1471352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429125, "uuid": "088c5152-c1fd-4cff-89eb-7f6b1d732520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429125, "uuid": "3e55a8fa-05de-4598-a3ab-6b8af7be0f95", "value": "3cff0e2e3c9fab904940bf29b87af501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3db4562-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694424191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424191, "uuid": "8eb38755-6fdd-4fc7-bdaf-3672624a9139", "comment": "Malware payload (GuLoader)", "value": "aab2100f43d0abe6926062607286f796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424191, "uuid": "a52c1def-4492-4ca5-8f2e-71541592c08d", "comment": "Malware payload (GuLoader)", "value": "200451c7cd61830d68c86f7c4ec87af94578ffbe2bea94123764a85cc2a426ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424191, "uuid": "df08a952-8fca-425c-b4c6-832a9bed76f7", "comment": "Malware payload (GuLoader)", "value": "0bb668fc1bf65d6b0cd743039ede02631610c67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424191, "uuid": "037d2705-dd8d-48df-9c31-845fc92794b8", "comment": "Malware payload (GuLoader)", "value": "7b9a975f4966db609cde8824b45a3f6c8bf5f9cb77b41489b01c282131cd5c1994ea9c4d41032ff94d7fb9bc1a415f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424191, "uuid": "c1a91e2c-dd02-4589-b69b-e0c381659833", "value": "T1B4D48D92B764CCB7F4A715B66E4FD02030B22D5D81E9960D62AEB71991F331250FBB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424191, "uuid": "852fcabd-6b9f-4dd3-84b7-5cb2282ca9ad", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424191, "uuid": "e879f6f4-54f8-4719-87be-db0fb93451d8", "value": "6144:SgORa6xKTuuuqjL7IMLeSDYZ5fT4ZkFty9Zah+dXFWIdfuB861y08N3UzYuY72vU:Sgm/S8n46U/dfc861yjNkUIHK2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424191, "uuid": "f64a2e81-02bc-40ca-bea2-b642784ffb69", "value": 614891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424191, "uuid": "c8d26e0f-c636-473a-98bc-607cac20feca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424191, "uuid": "2a9245d6-203e-459c-a17f-341b85c492b5", "value": "Halkbank_Ekstre_20230908_170025_496915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6de5e0-5073-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694416770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416770, "uuid": "9ec3b3bf-86c9-42ed-8b22-a486983a35c0", "comment": "Malware payload", "value": "bc957c19388e05e3e3f8cbb2ddc2702e", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416770, "uuid": "204bacd4-a5d6-47b0-9c6c-6bbfb9ced325", "comment": "Malware payload", "value": "20b2c3c49b34d0363b69e5c442f67dfb8cfce20783995aacfbf40e24e3f56487", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416770, "uuid": "8b5cf6f3-c166-4f0b-8ded-d86656cd78b4", "comment": "Malware payload", "value": "93e47346535eaa500fb0790c226273164229ff37", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416770, "uuid": "bce5c2ce-1a59-4f38-9ed7-b4ca10240ece", "comment": "Malware payload", "value": "e77f36fdf039fe656935dd33cf69dbd93eb3eeed90bae248af2d7a227eb04ae6c4262e5ed091d247e502dae5883b1887", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416770, "uuid": "afda564e-ea34-4545-b164-b7a13b2237ce", "value": "T162565B21B246C42BDD6B03B1593DDE9A102ABE760B7154DF72DC3A2E1BB35C21236E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416770, "uuid": "8d2b0c81-a15b-48ad-a459-e138d64ed139", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416770, "uuid": "81933e4f-bf56-4a0d-9bab-78d53c2d48ad", "value": "98304:Ktfl0kYax0dMiNsqWGXwtyyTRu/+XyQyj1s9wPBH:0fl0kYa0Sq5SwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416770, "uuid": "8a048180-1c47-4b3e-af30-aa4e750804b5", "value": 6170205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416770, "uuid": "7c41d347-8f11-43dc-bac0-6f3b312fa6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416770, "uuid": "a8828e10-f404-4d9d-b97b-ce21158bd80a", "value": "20b2c3c49b34d0363b69e5c442f67dfb8cfce20783995aacfbf40e24e3f56487.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8441a64-5062-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694409622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409622, "uuid": "e33afeda-c8c1-4612-9be2-36eade50c74a", "comment": "Malware payload (Amadey)", "value": "79cf3f81fe3baac5ed70f31b576f1262", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409622, "uuid": "053c45e9-5fbf-4b95-a19e-b19f0b989ed7", "comment": "Malware payload (Amadey)", "value": "20b7a8940c1f7bbde1b495a888df9c30ed088a11ec3b4ebcca6754d20fd3dd74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409622, "uuid": "c7262eef-8419-4551-94cb-1739274b9b33", "comment": "Malware payload (Amadey)", "value": "97b2aab83ad9794ccf6269a66fb62f6312d48216", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409622, "uuid": "6e6e90e1-65f4-492e-94cb-64989005340d", "comment": "Malware payload (Amadey)", "value": "96ff4a97123f7fbbeb3e6f0850a8e8e9c0103f747849bddc3b54dabc46ca1747ee99c2d2ee4a508a600997a6aeda7854", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409622, "uuid": "a2558c74-3979-4e38-afa3-febadebe13b3", "value": "T11B651210F9D3A073C473653500F0E7B45D3DBDA20F625DE763A82A6A8B282D16A73677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409622, "uuid": "815d889c-2f0b-4e32-96b8-fe04e59a3010", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409622, "uuid": "67d584f6-c9a3-4a13-8665-c5151f7abc16", "value": "24576:PU7CJdlhJoQHGhi2vZsvqagdxWD+u+AFXsGFQtghliDFWDzSO13OmVAI26yfRmj7:M7CJdlfoq2yQWDx+AeGFvliDkSViyfRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694409622, "uuid": "ea65530f-442f-47e7-ad15-27ed2eccd7f7", "value": 1472376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694409622, "uuid": "c4fad10a-146b-4ff7-b3c0-9628274fcf2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409622, "uuid": "453613ff-5920-489c-8381-a486e92aa6f6", "value": "79cf3f81fe3baac5ed70f31b576f1262.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fc6072-5081-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694422656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422656, "uuid": "2f67c946-c078-484d-9df7-526a24094c7b", "comment": "Malware payload (AgentTesla)", "value": "99f7750488408e42a66e58348dd58d50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422656, "uuid": "a2080e5e-ddda-466f-a61c-7f557e026a5d", "comment": "Malware payload (AgentTesla)", "value": "2115ae88242ba9e6cd5deb10992e292b48d01a5868d4aafbf8a04b3e5cfa78ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422656, "uuid": "1e6962d2-f6a2-4549-af15-9d54eeda0773", "comment": "Malware payload (AgentTesla)", "value": "e5d52461b98f9596fc34ebf4bbc3987b3c5c7b23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422656, "uuid": "2be5b133-09b3-432f-b3f0-dc290464714e", "comment": "Malware payload (AgentTesla)", "value": "39f934ca770f9a79bd01cb13f09a769cc41bba5c45d3951ee35a1f2b88e7bf10e7ffc98d5c125734f1ad9d0684a16ee2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422656, "uuid": "944fbe5e-2bf9-4a2b-a165-c105219b6648", "value": "T12CC4232F292214AEC346CE8C6426D8AB253A3B035056BEC9477F05B035D1E4DDDD8F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422656, "uuid": "7ee9f988-4127-4a97-9bbe-ed980950231e", "value": "12288:RBNmCbnhfejCcLprVJYxxhLqa829tvF5p+IQd77pMa7vkcqYDhML1jmalS1r:nNmynAWyjYtvqd77pMa7vkcqFZjdlS1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694422656, "uuid": "ca53abb6-20ce-4b9c-8c2b-0befc2e7ce1d", "value": 572405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694422656, "uuid": "9a7dce39-2dd5-403e-a8ba-6ab9ccfb9082", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422656, "uuid": "1f8db15c-d3db-49e2-bb85-8aa845073b12", "value": "Doc 132023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76754034-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450234, "uuid": "bdbe4cd0-f79a-4157-b3c4-aa5d87339825", "comment": "Malware payload (Mirai)", "value": "d3e185b9cb07285bf136d3d777c394cf", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450234, "uuid": "843f07bd-c837-4ae3-a891-86cd75a3b00d", "comment": "Malware payload (Mirai)", "value": "225ab894a461ecdb0dfbf5a77d5f258ff368c3c7789e3c8b87705013aaa0489f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450234, "uuid": "c4c486f5-59f1-4364-83ea-00e08428fe3f", "comment": "Malware payload (Mirai)", "value": "f2029840e7ec69a144cd7c5d95ebd50b126576c5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450234, "uuid": "81658dbd-08dd-495b-818e-ff6fbe156457", "comment": "Malware payload (Mirai)", "value": "f5f35d9d3f689782711ff3239d52e525ec7ce871b7fd19e262c8987192fbd389c8070bfc88c3dc0d7bd815c44c6413c8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450234, "uuid": "6fc2cfee-2e28-45b0-bc1c-ed54c332d731", "value": "T123B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450234, "uuid": "cb77e289-ee3b-4b6f-92e7-e72d605c6324", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAz+TRCm7FnVqfJXFWbNb:T9a2aLqkrMSsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450234, "uuid": "f9d70d63-6b8b-4edc-96b0-7e178d701a87", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450234, "uuid": "902e7469-b497-41db-a72a-4edac354bb05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450234, "uuid": "a4b035a8-9b13-40a8-b164-fa4bf29ef0a7", "value": "d3e185b9cb07285bf136d3d777c394cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb20776-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694438758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438758, "uuid": "371c8ca6-16a5-4edf-be31-13c11d697e17", "comment": "Malware payload (RemcosRAT)", "value": "22113f94702d6f1fc53594df5953679a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438758, "uuid": "623ae313-0d85-4ec7-b871-a2cfed857585", "comment": "Malware payload (RemcosRAT)", "value": "22cd4eccdbe852a42364176351e9050dad11856ee27fd3b675a11806660e7d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438758, "uuid": "cdc8c68f-eb21-4380-9462-e054f400c456", "comment": "Malware payload (RemcosRAT)", "value": "cc8cc9c2a0a51548a7d09ff1bfe8aba8f5ebf77c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438758, "uuid": "545ae64f-8e03-4b67-9977-4ea299b1bbd6", "comment": "Malware payload (RemcosRAT)", "value": "f252e72886e5a2e94d5bd4e71e7c48ce7219189172119b2ff679b65d449a3d35b80e14e9bc512d751145d3e9d288c8b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438758, "uuid": "2606bd8c-2cba-4344-acb4-ad7e02831ef8", "value": "T1E484F1217B14EC07E35312B5A560EBB88724AEE019869B57E3F83CB73519BC3F919391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438758, "uuid": "c3657a81-9e44-45ea-b027-288d2252af09", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438758, "uuid": "6d1c962b-a85a-4cc1-82e0-69c477cf0e35", "value": "12288:35Lvh59AtxPv2C0SLe9BbWxvAdBDDxmQVnKt:NvhLA3P+CZLGBi4DDDMQVnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438758, "uuid": "e99ef09d-9f91-469f-887f-7818da0955b3", "value": 405024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438758, "uuid": "15519a0c-53ec-4c79-bcce-af2afc9beb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438758, "uuid": "e012d9e4-0caa-4841-8631-9ef00cda8eeb", "value": "FACTURE A23.4618 NOUVELLE MATURITE.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fec5e08-508f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694428614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428614, "uuid": "67d0af4e-ff62-4a21-9aa3-56a1c225a2e1", "comment": "Malware payload (Loki)", "value": "8b813884758571e1157fb163ff5353ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428614, "uuid": "7829e7ea-a413-45ac-9d8b-d2a6ee7be2e5", "comment": "Malware payload (Loki)", "value": "23e415caa22bde69d3bf3d435c0746e2f8fe1cb91505dc0af6fe6021973450de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428614, "uuid": "3d72dfca-0fb4-4a71-b5f2-182362cf8af8", "comment": "Malware payload (Loki)", "value": "10404801c397f30c017474f79d61118d4740eb2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428614, "uuid": "ac35dc7d-47f9-483d-975e-bb498ef4b5bc", "comment": "Malware payload (Loki)", "value": "32408b438905bc671ba268a28cafaff195ddd3568422b49429ac602942e631c1ba23ec1d45c568106e58dabb3aaf9fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428614, "uuid": "499ebcbe-525a-47f4-818e-b76088a4f594", "value": "T11A547BDC722076EFC857E5728EA82D64EB5078BB931B5113A01705EEEA4D99BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428614, "uuid": "7b68271e-cf9a-45a5-85f1-d2cb8365fef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428614, "uuid": "664710ae-172f-45b1-b096-f8463c3a9bcf", "value": "6144:ZS1eN1UyR0RR7FgvbpfoYphPUeTYcymF3FvjYePUDaJ4ogkI:zypKBoYphsiYcymF3FvjYePUDaJ4ogR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694428614, "uuid": "731afcbc-f2a4-4b13-b9fc-c40c0b379774", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694428614, "uuid": "7f7e942d-695e-44e0-9ea2-42aa18b77c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428614, "uuid": "b22954d3-ac00-4104-9a56-4a52128f446a", "value": "SecuriteInfo.com.MSIL.GenMalicious-R.25145.15906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5c3055-5091-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694429651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429651, "uuid": "913b90a9-50a9-4bad-966d-f5a054636d5b", "comment": "Malware payload (njrat)", "value": "41c1991b97b3fa475232b7e1a1b6464e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429651, "uuid": "66270e9f-55f9-40fb-a7be-8e81c94214b5", "comment": "Malware payload (njrat)", "value": "24c4f9e8e2112c6712dbab5667bfd687fd737949b11d385d0e91d219e32159af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429651, "uuid": "7ca1bd47-c62b-4a66-a565-394b17a28eaf", "comment": "Malware payload (njrat)", "value": "0f3872a063d1e70b6aa1e1d5af2fd2adbecfd849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429651, "uuid": "fe2539da-58b4-4809-988d-ce9bede19e9b", "comment": "Malware payload (njrat)", "value": "a8fdd4afbf4e05e35a12be48dbe72faa3d2de5493d1d56a7b68c71cee239d3c8eac4c31d48bddcd5ee0eb6fa51bec816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429651, "uuid": "58c0a471-5d6e-4193-9bfc-05ffce32b5bc", "value": "T16EC229593FA08176C2EF6BB406B2DB2102B2E2074A27DB5F4CD844FA5B777C14D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429651, "uuid": "a1a4c19e-0d10-4f2c-bd04-c0781107d707", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429651, "uuid": "a09a2857-47c9-426c-8f70-2e1476228959", "value": "384:iLd6haZIVi/dMkt1cpDkjetHzCYe/FBY2OzRLTm3yilqr63fbSJvGf:8w0IVi/dMc1uT5e/PsEsvGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429651, "uuid": "c6a5f58b-a155-4374-8ad7-d2825bd57112", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429651, "uuid": "397af11b-f210-4c2a-aa0f-8a723ff54e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429651, "uuid": "e7205a44-d4f3-4180-b7f6-18eadf5d86d0", "value": "bPAv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441273d3-5069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694412353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412353, "uuid": "bad1ce9a-564d-41f7-93f3-2fa739a37ff6", "comment": "Malware payload (Tofsee)", "value": "f43157a1be4423712294ce150611a0b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412353, "uuid": "ebbecd60-6a27-43ae-91ff-ed52f262f437", "comment": "Malware payload (Tofsee)", "value": "26bc9bc8c96274058c92350028a8bd479392e22fc120dee1859d86948c1367f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412353, "uuid": "78a86185-7bda-496c-8f1e-6c5b2c1443d3", "comment": "Malware payload (Tofsee)", "value": "fe1242c44838a4c783c944ea4721a05c8e1756a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412353, "uuid": "73be639a-6c31-42d4-87bc-32c1f201cd24", "comment": "Malware payload (Tofsee)", "value": "c79a78eaaa986f1da5f6802b0377268a17ae27651a45f7d75dd9b26cde1c643ac25c8010c35a19f2d4a0486de0dd31df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412353, "uuid": "fd8ecc83-8f9a-4b80-b480-55f5dc6c52c7", "value": "T151647DD363D0A8B1E12746358E2BC6F42A2EB8604F1D76EBE7547A2F09BC1E1D172315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412353, "uuid": "4d46dcee-e999-4377-9972-78d04b9e494d", "value": "c0ea63f985a38ccc61e41516c5fe1f2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412353, "uuid": "7c33ac87-87c7-43f3-87bb-a546a8fc42d2", "value": "3072:g1tVMjcCieb+E4xsiZbd7jFZnuWCe1Cf070COxJWxX6hDqPjQ5aHLyhchVS:Caieb+E4xsKbVFZdRso9KZijQ5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694412353, "uuid": "944f6951-eb54-456c-83ee-455e22adc882", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694412353, "uuid": "c5dbc106-a74c-4849-bcb3-23888b759246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412353, "uuid": "d531d05e-c4a2-4b63-9fa1-8fdd1c0f7e83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa069fd6-50de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694462776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462776, "uuid": "913a0542-396b-434a-b50b-3459485e2006", "comment": "Malware payload (AgentTesla)", "value": "e23c6396d9b7461e6e6e9f0d0c4a136d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462776, "uuid": "4d21ff2e-d9a7-4f6c-802e-314dc2bbc991", "comment": "Malware payload (AgentTesla)", "value": "27350cfb61909fe70f97f9a558b515fa098257a38ead3fc6e6b89973fd6801c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462776, "uuid": "0cd6c2c0-3713-47e4-9e04-f5501b589a4d", "comment": "Malware payload (AgentTesla)", "value": "412f57409e4fa13b22fb5f9940bbd3b1812fe02c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462776, "uuid": "0366ffde-060b-4e85-9c52-431121993149", "comment": "Malware payload (AgentTesla)", "value": "a618b50043654606b9749ed3722bbf629343f2c886608dd1465db118b3213fb4cb7bf7294a7dae798c8e47193aa69c9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462776, "uuid": "c4caf39f-d75e-4ef0-9721-cf7e31e43683", "value": "T12CD4238BF78A853CD54447FA9C125F10BB7EABDA2734ED4E4F99281C8C66BC6C520721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462776, "uuid": "06a07b31-e84a-4c60-a9e0-379c37aca14a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462776, "uuid": "c1527166-7d63-4c19-ad7b-b3d2615b609e", "value": "12288:j2iNZ1Du2o8/fdO1sTNPn0PtjXKvrZhx2wbsbaz4qhw9bCkGcL0:j1pDuP8/fdVTx8tjXKvZ2h24qar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694462776, "uuid": "136e2efd-7a59-46ce-9d0f-2ddee11f745e", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694462776, "uuid": "8de4ae36-7551-457d-872d-69fe54396a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462776, "uuid": "3730c016-1d77-4e0b-8303-2d4986a27bb2", "value": "160-59153555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f8958f-5097-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694432271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432271, "uuid": "75d6f284-ea8a-41f6-a35a-75676b6fa00c", "comment": "Malware payload (AgentTesla)", "value": "b312cc74762c26ef0ccd4f686e35c9ea", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432271, "uuid": "9ab24dd9-e336-4c5f-bdc0-34d2c8649d1b", "comment": "Malware payload (AgentTesla)", "value": "27c348414b044ce33ab58fdae8d71c38e3bdc57199f4397fe38c6b96e7563589", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432271, "uuid": "4c07fcc6-83cf-4b09-935b-cf5aa369bd85", "comment": "Malware payload (AgentTesla)", "value": "e065e7d97e378ab8e530a56f305ac0abbbb5b5b2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432271, "uuid": "89dca6df-187c-46ce-89be-0d6c6910e4ef", "comment": "Malware payload (AgentTesla)", "value": "4ce095d29e7747ca6661391416a56fd5e0e5961a8d25c080b03aad4ec3b90261acf19dbeac26394ec52aba9fd6b56625", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432271, "uuid": "12a5a073-4c7d-4a74-b9df-f99a77ab4db3", "value": "T13EE4331D2B9905EE3B22B750794AB74323216E8D3F6D248DC33E2B2217F746075935B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432271, "uuid": "31b5ef25-a6b0-4a4c-ad44-af7ab8afc722", "value": "12288:jIqJlrcwXcpJcrak58Msw/pslSpZpbqUguys3CkUqPWGV5TmTNrF7FxWvGCDn:MqJtc77R8/psleFqUgjeCkFOGV58NnxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694432271, "uuid": "9c579b99-db45-4add-918d-f675266a5c4c", "value": 701078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694432271, "uuid": "65a4eb69-7e97-47aa-8fbb-9eb65fd1656b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432271, "uuid": "cdf0fa95-2a8b-44d0-a719-460f9bd93bfe", "value": "New Order.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682448b5-5091-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694429594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429594, "uuid": "2ce11846-c3fb-44e6-8e3e-847ef3dd6f92", "comment": "Malware payload (njrat)", "value": "49d85ee18c0e7393f50fbebe8e2b02b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429594, "uuid": "77c6535c-9d40-4994-9cea-17a2bd3665a2", "comment": "Malware payload (njrat)", "value": "281f001c400ebd62ac94a3968ff88ceb75ab32845742dd093db34173018fcd45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429594, "uuid": "a16bcb4a-c380-4a15-b982-59d12e68412c", "comment": "Malware payload (njrat)", "value": "0c459f05331dbc5a664ff9475f3f1506707c9885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429594, "uuid": "8c1f6aa4-48d7-4924-850a-9f581fc0dd8d", "comment": "Malware payload (njrat)", "value": "a6b492742809cd39e760b9533fb22f4ee7232931fc3e38edaed969ecb33efb9419f4fbd7513dffc41aed8ad48a5fda84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429594, "uuid": "696369f7-36e8-4098-b0b3-64689fca330e", "value": "T125C239593F908176C2EF2BB406B2DB2102B2E2074A27DB5F4CD840FA5B773C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429594, "uuid": "435afcb2-b213-462c-a333-e813c667de08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429594, "uuid": "d8d30d3a-cb16-41bc-9137-3e37a158416c", "value": "384:dLd6haZIVi/dMkt1cpDkjetHzCYe/FBY2OzRLTm3yilqr63fb8JvGf:Nw0IVi/dMc1uT5e/PsEmvGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429594, "uuid": "d1fb132d-0844-44bc-ba71-b80d4375bdfa", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429594, "uuid": "7c570c2e-dfb9-4e1c-81f9-1feb25f8e764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429594, "uuid": "d131c1cb-bca7-46cb-88c4-8b12b7230d81", "value": "bPAq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3997ef0-5059-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694405722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405722, "uuid": "652f4003-128f-42da-a0ac-fb9cc8e6faab", "comment": "Malware payload (RedLineStealer)", "value": "4a74b112989e41b13cebf9be8307d47a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405722, "uuid": "d1878d53-dab1-42aa-a51e-a56efd630278", "comment": "Malware payload (RedLineStealer)", "value": "289ccb83e11c57ef0327798928f8733cb0ae7294fed7a5b22ce63d7380f4e949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405722, "uuid": "281d2f68-4c2e-446b-a158-3d00c41827a5", "comment": "Malware payload (RedLineStealer)", "value": "b7bfdbca1707441baf93e017330ea21ad7874b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405722, "uuid": "eee0e4c1-c4e1-40b3-a950-1fc93bf0d0f9", "comment": "Malware payload (RedLineStealer)", "value": "8d2d89bc96cf04ab7c07b390b9d4055913c15fc513d9fa0a0dd136454209e25e5c622cabe19565b9f367307d59f4e6f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405722, "uuid": "2cdedd6f-cb32-4710-b79e-9a37d7e109f2", "value": "T199651221B8E1CC75E832153B55F4FBF14A3978680B52598BD3A43F2B4F1E3928D2A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405722, "uuid": "5c519b2d-680d-4edc-8186-9035b35620b1", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405722, "uuid": "d3033595-0df9-4e76-bd06-e0b3f5fe506b", "value": "24576:YMkCJL6UMIfy4dh4+ZwZMu2HX4Dd/qJ6NAhC3KfwGOMboo3xJFfFu1Hg:BkCJL3MIj4zpK4DcoNAhvfwGXbnFfo1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694405722, "uuid": "52d545ae-4646-464c-8b43-2f4c2fb55faa", "value": 1471352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694405722, "uuid": "cf890c3e-c959-4721-ac63-abcd4bc40fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405722, "uuid": "3217bcee-5e3f-405d-ba76-6e42c8b256de", "value": "4a74b112989e41b13cebf9be8307d47a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c38ca4-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694450400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450400, "uuid": "ccf187bf-9589-4a46-bc57-5529e061d74f", "comment": "Malware payload", "value": "5b32c3fdcb78f06cf79ed3497538f72b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450400, "uuid": "54c426e8-1396-441f-a310-19e482dda58b", "comment": "Malware payload", "value": "2a99cf7d73d453f3554e24bf3efa49d8109da9e8543db815a8f813559d083f8f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450400, "uuid": "b9495a31-defc-4022-91b5-ab51a3146ea3", "comment": "Malware payload", "value": "764eb6ca3752576c182fc19cff3e86c38dd51475", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450400, "uuid": "b4f281a5-f51b-4848-af23-b7bf4249c4be", "comment": "Malware payload", "value": "7803d41c59b901ee9886995c38a1032d0f032127ac85e82314c828ab8903ec0f3dddb7c91e2c1e2961e7384ea2d813ff", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450400, "uuid": "e12ef717-72fb-4ec6-a375-99d565a57872", "value": "T1E4C48C22B861C036C17252B11A78FB6541BEB9314B7545DBB3D44B3DAE201E27F32A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450400, "uuid": "c462eacb-8cd0-4a4c-8475-52bcda0f25d4", "value": "518df82ac207797c3a0a8476c7662518", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450400, "uuid": "086dd0e0-4f59-40c2-83eb-f1c2e5b16362", "value": "12288:ZgaPuSx1S+LN16qf4vFzqj9McUaLa3xKMBcZJOjSH1AbYZJ3Azq:JPsqf4vZpaL8xKMBcYSHwYZJwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450400, "uuid": "b1d24c92-d7c6-4993-bce5-091420b5679a", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450400, "uuid": "895e2663-397e-427e-9e8a-f465b6b77629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450400, "uuid": "3a1b4daa-ed1a-44c1-961a-d7a235afa9e8", "value": "sponser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15af25c8-50a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694436327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436327, "uuid": "3c598e7f-2e83-4319-8b32-8e08d68b34c3", "comment": "Malware payload (RedLineStealer)", "value": "f73124b888d7faf6886bd871869fdb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436327, "uuid": "af90e2fb-f5bf-476a-abbe-b57fd6b4b62f", "comment": "Malware payload (RedLineStealer)", "value": "2b532d20d2e0b9ea8768ac53964aa9761a534a625720a816fc5e44f62a29f265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436327, "uuid": "f2ca6fe2-33e1-42b2-88cf-da712a41f395", "comment": "Malware payload (RedLineStealer)", "value": "51cdaaa3350002d7f923b5f3f5c125e0bc3cbf4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436327, "uuid": "6bee98bb-9508-4a4e-8543-c0529fa4bb62", "comment": "Malware payload (RedLineStealer)", "value": "5338a21f0bc3023e5970d6088631e65e137dcd4db8a8e3edcedc73c68170e0c60adc75fc4b0d1ea86b24f465e03abd5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436327, "uuid": "7477d92d-d891-43ef-bff7-112a7582d758", "value": "T100548C0170D1C032D562153709A4F7F99A7EF9210B67DAEBABE41F7ECE302C19A31666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436327, "uuid": "ca66c0e1-139d-43e7-b751-63ee77146551", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436327, "uuid": "15c6c3f6-b566-45a7-9c94-0154f7df6aa0", "value": "6144:yTxa2/KMiCQy4bwSjQzL9ois436xMhAOrb7guwI:yg2SMiu4Ms436xMh5bE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694436327, "uuid": "ac825765-98e4-4d61-abf5-d1a2a7785886", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694436327, "uuid": "841e31b7-ab25-4c1e-9437-14d91af9634d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436327, "uuid": "44a72aa3-abae-4177-972c-1a54fd9c4237", "value": "f73124b888d7faf6886bd871869fdb51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95579645-50c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694453721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453721, "uuid": "fd3cda75-8f5e-4b2e-bc71-4bd1077dc3d1", "comment": "Malware payload (GuLoader)", "value": "919f4ad18943cbfbaa1d5f4555b37808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453721, "uuid": "86e20eaf-0bbc-4db2-8a6d-4cae4408f913", "comment": "Malware payload (GuLoader)", "value": "2ba4c247d71613b4016efe1c667d197f37636d0fcc22685c8fdf75eae66b460e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453721, "uuid": "c0c9a0c6-9e57-436c-aad7-a6daafd99977", "comment": "Malware payload (GuLoader)", "value": "cd103d82b7b1c719dd8165a06a730ef940afa182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453721, "uuid": "e4c4f202-3c9d-415f-9915-565b6e60ce2f", "comment": "Malware payload (GuLoader)", "value": "1966af2f614ca0666a5a281fac56dcc16611026a90355af5a56b12061d39d1a3055b1af0d9eb91e8158b45d563648034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453721, "uuid": "d9db0c24-bbda-481e-a7c8-e2b5c40151d7", "value": "T1A8D48D92B764CCBBF4A719B65E4FC06034B22D5D81E5960D62AEB71991F330250FFB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453721, "uuid": "ae094181-7f20-4a9f-9ef2-55e973bb3e17", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453721, "uuid": "b8cc94c7-a733-4ec7-ba57-a3d1b81ac8d7", "value": "6144:SgORa6xKTuuuqjL7IMLeSMGeBLe33NIjJLo0SdWl0KB8VIiUgYQ7efXg8pY:Sgm/SMGe9sWJzSdWv8VIJQcpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694453721, "uuid": "bb3adf4d-b5ef-4fb1-bc02-30a1095b2539", "value": 598841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694453721, "uuid": "0fc97825-bbe4-4344-bfa6-767e113d7bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453721, "uuid": "5544b15d-222b-49ce-9394-9109407f8621", "value": "SecuriteInfo.com.Win32.Evo-gen.24531.21214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a65b8c-5089-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694426397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426397, "uuid": "1ae5f31c-e2a8-4ded-b27e-51a4ac9075cf", "comment": "Malware payload (AgentTesla)", "value": "df02cb6e3cbf49c6241c2885f85eff9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426397, "uuid": "393ef65b-0ce7-480b-960c-1a600323b635", "comment": "Malware payload (AgentTesla)", "value": "2be843a46901cd362d311beeccbc3a18df4728a7a8cb641946baf1ca5e4509d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426397, "uuid": "302e8ed7-d140-431b-b710-3b1b60fd4b10", "comment": "Malware payload (AgentTesla)", "value": "9362262914b4b68ec5f6bc87750e81664272f93e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426397, "uuid": "ed2b3254-671c-4e27-a803-4ff931baf002", "comment": "Malware payload (AgentTesla)", "value": "2b9e152ceae71357262f3a6855c0ab06bd2263f4d838afff10b66faa813755a0a9d5655e76cef779b732ecf3f3396aa9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426397, "uuid": "0a98b61d-e3bd-4b93-acc2-687314a6c770", "value": "T122D4238AAC1FCF7620B64A757F7DE48479B251C65848AD0391A39CB970F4E0DBF1A027", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426397, "uuid": "163affc4-0677-4221-b412-f6af8718d2c5", "value": "12288:vpZ3YnmNATlqFAQp6j197utOgfRnJWpWatbJ0pQ2zc4iuJ+n+jQe:vpZNNwi3p6jCOgfRJWHt0q2Y4iu+n+jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694426397, "uuid": "eafa38ce-ad00-4d7a-9bd7-2c5aefe36fbf", "value": 637325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694426397, "uuid": "8adb5c03-ba93-48bc-a327-08518f013cc5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426397, "uuid": "e9777d9f-10f3-4852-a4fb-207e56b4b9f0", "value": "Proforma Invoice..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e58e00-503e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694394014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394014, "uuid": "00d6f971-d9ee-40f8-997c-498591f68bed", "comment": "Malware payload (RedLineStealer)", "value": "d8bb6118e4f49473fa216734bb3cbcbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394014, "uuid": "87e30777-8394-45da-a167-764281c010b2", "comment": "Malware payload (RedLineStealer)", "value": "2c74d48b26cf20b796a52f781bb4d392aedca6aced168a06023db315b6c6eb8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394014, "uuid": "a4d141c6-de48-428a-8c54-1ba4a879d600", "comment": "Malware payload (RedLineStealer)", "value": "c415c22caa3fdd258be13852755cceb220d71fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394014, "uuid": "05494185-f50c-4b63-8a48-5258cb5be349", "comment": "Malware payload (RedLineStealer)", "value": "4abcab61355b0a1c5f66f40a90a1540caa9c7c2eda6dc2554270c6e4e8f7f262336d8bbc58fbf8d0365730474b94a45f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394014, "uuid": "d95077be-3fbc-4406-93f0-f1f147eda498", "value": "T1B7349E11B4E18433D832153509F0EBB55A3DB9700F659AEFA3AC0F7E4F602C1AB75A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394014, "uuid": "b88c9c84-32a3-4f50-9244-ec2f66490868", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394014, "uuid": "ccbd1010-f1f1-40af-b03b-5167cf627b8c", "value": "6144:0VMUcz6DCGbAR/VeDC1tAO3cCu6lhJ6q8oi02urBiIg:0PczaC+Uj6p6ln6qFivurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694394014, "uuid": "f36b5948-d90e-4e86-9cf5-c37dcf4028a7", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694394014, "uuid": "7acbe54b-5282-4e70-855c-3d8ca56f6544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394014, "uuid": "b46a9edd-5bd8-4c7b-9e73-fe696f6605e9", "value": "d8bb6118e4f49473fa216734bb3cbcbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739a198-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694423821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423821, "uuid": "4b4121fe-e0e8-49b8-813b-74a79076cbe4", "comment": "Malware payload (SnakeKeylogger)", "value": "18e483e4bff442e56a5bed119ca77ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423821, "uuid": "02c22489-7f3e-4e32-b5b0-cc5d21da830c", "comment": "Malware payload (SnakeKeylogger)", "value": "2c935eafea81bf03083cd8a7cf84e5f84c92ecdc14632cf4764b6a5e1f2c8865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423821, "uuid": "57c3fc45-de85-427d-b9ec-3de47440174a", "comment": "Malware payload (SnakeKeylogger)", "value": "9451913253a04ea2f9468b0bebff6edb24d1af6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423821, "uuid": "5e681eab-11b9-425f-8a48-657ebb1b29f3", "comment": "Malware payload (SnakeKeylogger)", "value": "f2710329fb12d459c55c3ad27e8419cbd025fdc368538e1d554e6a2b6fb6636ce2f86e13be2ef9cb4249a81b726edd70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423821, "uuid": "bad49081-853a-45ba-87ce-9b3c1848d8e0", "value": "T144D41215327D4732CAADCBFDD1632A3817F664AA6901EB5A0ECEA0F66F137414340E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423821, "uuid": "141b17c7-5427-407a-8daa-7b667f7c4d85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423821, "uuid": "50243e4a-d4e4-4db5-bac3-ff47a634db8a", "value": "12288:1L1D3iHbtCiRYsN+laKU9ytL3mALUPuUB1mA7YomHq98mKFXbz3:1BD3ioimsU98ALUlnKomHPmKFrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423821, "uuid": "211f1fbc-a4d7-4dde-9648-3a9da432af16", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423821, "uuid": "c9e5e9ce-3e4a-48af-8f16-eb0cf1063fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423821, "uuid": "fb5a6b53-833d-43f5-a46e-7d6c0e2fd8b2", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745cb5a0-508d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694427896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427896, "uuid": "dfd86b6b-b430-4b95-9ebd-60a0668b74b5", "comment": "Malware payload (Loki)", "value": "e1fb3357293b8d5241667c946f03d85d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427896, "uuid": "4246a11b-fbbb-435a-aa1f-9878bb67a829", "comment": "Malware payload (Loki)", "value": "2cb6a421cdd46d808fbe4e91aa4bb47722345c4423a6eaa96f46a61402e6001f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427896, "uuid": "f1b80d73-1c86-4ebd-91e6-0007ced85676", "comment": "Malware payload (Loki)", "value": "90c63c68dfc881c2c8a71296fe635859b9a89bd1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427896, "uuid": "c63b2756-de0a-48a7-be7f-bf54d71ae564", "comment": "Malware payload (Loki)", "value": "c4ee07dea5a2d05fcdd07c3b3dbcc41b39ca27d7f60a2d1c8fd2f58ab8cbf3738bde3e575b16e5eabf99615487300d81", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427896, "uuid": "93d0b85d-2014-4832-984f-5a01b546e1c0", "value": "T10EA4234DA35F407A1D950B62397CA9E06EE49232786FA64C0C3DA12FD184DBF7E5530E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427896, "uuid": "1db9e3b0-aedf-4fc7-8ba0-440ad12ce26b", "value": "12288:DVrfsB46qSWGcIBRRHncUfSCFBwcwCYKU9OtnW7:ZrElqrGpcCF6cwCYKRtnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427896, "uuid": "0220d087-6829-40ef-a046-dfa0815cee54", "value": 465949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427896, "uuid": "fa77ec1f-d466-4db6-9e3c-b65de8badc1a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427896, "uuid": "ffc7db5b-87fc-428b-b28e-44dcb4f286a8", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6fec50-50bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694449328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449328, "uuid": "095c3479-32f6-4b65-85cc-aa19d19f57d6", "comment": "Malware payload", "value": "7e8acf74513bcaf1badc673635ffd755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449328, "uuid": "77e5311a-dadd-4054-b616-dae55ae86888", "comment": "Malware payload", "value": "2e131b9e2bc29ca55a2d39bf860793f250118c9a6cb2667a29c9848ac545cd7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449328, "uuid": "06ebc743-2cd4-4af7-a46f-99e1aacd3971", "comment": "Malware payload", "value": "12e3fc068b35c18b7cdb5455b4f12fd6163a6e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449328, "uuid": "d528b6cf-df7a-42f6-9184-ee81aa6ace73", "comment": "Malware payload", "value": "43a40bdf58ea2aec63d984cb71f6ca5b393c1b028ae27ddd537a8df699d7598575fab99fc1912715c4c6de5d951447d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449328, "uuid": "ddc43ecb-2eac-4bfa-ab5e-0ebc48cdf1e5", "value": "T14C066B03B29544A9E1A6D134DE65C231DB327C584BF5A5EF32807ADA3E73AC07B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449328, "uuid": "15e1c323-05d7-41de-a8fc-e1c97a5ed7ed", "value": "721b7a2e0911a652e4c7d1af2971046f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449328, "uuid": "95ff5798-ae18-4fdf-ba70-aa8b8d408853", "value": "49152:RX08UcrferQZbd24+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyJ:mcyrQZY0oAaldmdmnpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694449328, "uuid": "2ea1b82f-a455-4221-9935-3803a13e8e0c", "value": 3683933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694449328, "uuid": "22564b26-e2cc-44d7-a366-e717358cce19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449328, "uuid": "21db9cb1-bd37-4f5b-a6c2-9fb85d21eaec", "value": "2e131b9e2bc29ca55a2d39bf860793f250118c9a6cb2667a29c9848ac545cd7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b93dfc9-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694445357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445357, "uuid": "210509a3-1b28-4de0-ab89-7826de8f5a4b", "comment": "Malware payload (SnakeKeylogger)", "value": "f1bbf0f8b1ee21f3a799269ff78829fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445357, "uuid": "e64062b1-a8b2-4773-9086-1192c9dd0278", "comment": "Malware payload (SnakeKeylogger)", "value": "2ea95697b79458479ff70e389a34ed1c57adaa2563afec01696c8315e98ce48f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445357, "uuid": "a2da26f7-39ab-45e5-854c-f027f5c5cb71", "comment": "Malware payload (SnakeKeylogger)", "value": "8df72f2b31cb18e5be761f06bc2539b742e8f862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445357, "uuid": "714b7376-3800-4214-a834-6fb33a2d23db", "comment": "Malware payload (SnakeKeylogger)", "value": "fc7ce8d592a3998fe8be9d18d905f45cd461f5b5fa8a85cdd48652cbe623568f2b0e6d6298eedfe9ba9fc7b3630ae0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445357, "uuid": "13cc6459-d3d3-4447-93b7-d7743602d81f", "value": "T13CD44B0123F59B10E17EABF5DA74812287B92956656EF30D9CC168CA1EA1F139FC3B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445357, "uuid": "add7e4fe-8711-4d51-9fb1-612e05b4b08d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445357, "uuid": "030e1476-fdad-4b97-83c0-b08f6e5c0232", "value": "12288:LODphClGCx5AisD6tAGOZOdlYR4XfKCQt35dxC:LQCUApXrQl5dxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445357, "uuid": "42e2d565-c47d-434f-a99c-98e2b02f59a1", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445357, "uuid": "2031c572-dbed-4ed3-8295-21a66aee1150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445357, "uuid": "59fc074b-c573-47e4-be97-8242635edbb8", "value": "ikeee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea81275-504d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694400318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694400318, "uuid": "03521b48-12dd-4c66-90fa-5518366d22fc", "comment": "Malware payload (Amadey)", "value": "594a4e6f956e7e6502508918f446ed31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694400318, "uuid": "bc164d19-30f8-4ccd-9bbe-e36c20b8f35f", "comment": "Malware payload (Amadey)", "value": "2f3c7e2f5fb5e56287ea53c87a76ee2803bde654604e7817f65e300f3a6c4bcf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694400318, "uuid": "76e2747c-8fde-4bb7-8326-2812e567ecd8", "comment": "Malware payload (Amadey)", "value": "1a04a1a41b7a05d8f98770fa9c1c33b8e844e5ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694400318, "uuid": "d0cd71c8-f2c6-4c5d-87ba-7acf2d80aa6f", "comment": "Malware payload (Amadey)", "value": "0d9b40ff05c69e6b1bd482684af6bb4c4321cb9f729eff5eb9e3e18874628bf24bfed727a1ed8e26c3934acebd3e4a04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694400318, "uuid": "7e3f0118-1ac0-4814-9f17-2b50df6848ef", "value": "T1F2451215F0D1E872E973233606E6FB74197DF9A843D198BF939C8EA98F3018096B4752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694400318, "uuid": "b091438e-ca65-4f2b-84ba-b31ed84c708d", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694400318, "uuid": "6b2b0880-5c9c-4b60-aaee-025055b87027", "value": "24576:gWaCJjGtlmNbpsqM8oS5gwgQTR9Fm8f/FaGxw+m0zmf5nkhIbRAfu1Hg:7aCJjGtlmDsqMMgwgCFm8fNFBpzmJkKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694400318, "uuid": "d592ed9e-2006-4506-86bd-7b19254f79ef", "value": 1180536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694400318, "uuid": "b96108a9-5cf6-440b-b156-030c7bd23d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694400318, "uuid": "79ffa14a-6083-4086-935d-b2cf399e77aa", "value": "594a4e6f956e7e6502508918f446ed31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1f46dd-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450193, "uuid": "fe6ac0a2-468b-4ff6-ba1c-d385fdc76091", "comment": "Malware payload (Mirai)", "value": "2f1dbd037dcb6b2321d85f7fdea57bab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450193, "uuid": "17830f42-b4d3-4676-9ce9-84a07ccb4e15", "comment": "Malware payload (Mirai)", "value": "3212dd5370f286403295b9addcbfd50e637e02d8469e359546d627306973191a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450193, "uuid": "bd956e02-22ba-402c-a5bb-7e13fbb8549a", "comment": "Malware payload (Mirai)", "value": "1ebc1c15771c3372c9744437d06a267c151bdeb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450193, "uuid": "a081c209-222f-4d4b-8b3e-f69e0faad758", "comment": "Malware payload (Mirai)", "value": "f62411f8f4311786621707b999791080b51bec3771db609627cfb3d840845c0ed8ec62f13a4b2612bce802e7ec115b15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450193, "uuid": "5684c9f0-2088-4a74-babf-d10ae5acd616", "value": "T1E8E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450193, "uuid": "da4b9390-74c4-4423-b902-7507d261df5f", "value": "3072:Cv/WwsLgaq353qHiCOvhOpnqkDQHbeskmhxQwoVSUNu:KPLaq351hOpnqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450193, "uuid": "e5591f52-d87e-411f-b5b4-38525d98e45e", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450193, "uuid": "773f6dc0-6741-465a-8c86-26d748b43f15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450193, "uuid": "35669714-7564-467a-b1fd-32d802702f80", "value": "2f1dbd037dcb6b2321d85f7fdea57bab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db05591e-5091-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694429787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429787, "uuid": "01edfe03-855d-432f-9511-e32a0a677936", "comment": "Malware payload (RemcosRAT)", "value": "cf5a0c378373619ce7d777285207806f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429787, "uuid": "4886fc3a-2325-441d-8d39-f59d4cd4d56f", "comment": "Malware payload (RemcosRAT)", "value": "327946233fb8a8dba8e47aa58499a1d06b50fc635d9ec674156617a039d7e85a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429787, "uuid": "c88acf57-d993-4967-8ea9-235406a0409e", "comment": "Malware payload (RemcosRAT)", "value": "fcea6cb92a0a410e3c82df175f39593fb113cb95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429787, "uuid": "eade494a-0f0d-4c69-822c-3609b6385669", "comment": "Malware payload (RemcosRAT)", "value": "fd317a8333686790d0c2600c563807558f3bde29d91799887c24d86dc60b5f4e35ad2da88e31ca68b0df46b79e1752e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429787, "uuid": "829e8b4f-ba37-4967-bd6a-05a26bae07c7", "value": "T137B49E01BAD2C072D97514300D36F776EABCBD202825497BB3D61D9BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429787, "uuid": "c56c7d5d-bfcf-4668-a807-9466ffbf6b2b", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429787, "uuid": "aa428345-5ed0-4b5d-9196-a63990cd3e6d", "value": "6144:Qu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7Ebv:Qu7wNB5iedQ1RmPEVAWONjpcs/ZpAbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429787, "uuid": "f0b302fb-70ad-47f2-b29c-31c2465be0d0", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429787, "uuid": "447c6b14-dc29-444d-8a33-36f904124719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429787, "uuid": "0933ebfd-cc89-4429-99c0-6faa8e86ab44", "value": "xJi8wKKO06j3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac95376-508d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694427934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427934, "uuid": "2aa8c09f-e926-49a2-97ac-086344cb7924", "comment": "Malware payload (RedLineStealer)", "value": "14e48cccfa444746d047b955ee56fa94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427934, "uuid": "092762bf-85b2-4b2d-b4b4-14b803e5dcff", "comment": "Malware payload (RedLineStealer)", "value": "32e363dc6596c92aaac183ee201492db6a6b29031ac4fc2512c867e1aa3a6a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427934, "uuid": "aab52273-32c0-43e3-b8ee-111c90eaeba5", "comment": "Malware payload (RedLineStealer)", "value": "f3b25e203860a6c21b8c084b86a0c7f02c783715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427934, "uuid": "1f51a289-b7fb-4ded-a5bf-a40a0c95ab2d", "comment": "Malware payload (RedLineStealer)", "value": "50a03d317397355cbaf54e950a193af8b7170b2832d2514ab6476081d381698ce8490fbabc60258711e8323a76ee67f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427934, "uuid": "7a26e9cd-6e46-4620-aaff-897bf06ebc50", "value": "T15EA4CFD363D0ACB1E53246318E2EC2E42A6EB5614F153BEBE7855A2F09BC1F2D532705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427934, "uuid": "60706def-d72a-411e-9956-7119295bb959", "value": "6c0d1a96503717b34f08f8921d0cf906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427934, "uuid": "788c4e40-3b73-4772-b474-92dde9bd7dc9", "value": "6144:1l5JbcD60uwK0O1gHeXCKXy5okVajFPdcxJVcu8gjjzHlj1b8IEo6KOg5:9JAD60uwK9seYVajFSxJF86Pl6Ro6KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427934, "uuid": "18bb58ff-2977-484f-8756-0fe85314b3ef", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427934, "uuid": "95591de9-a0f1-4148-a0da-c2fe52fe1d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427934, "uuid": "e49aa421-7a23-4566-aa5b-29d4bd3caf4e", "value": "guncelfiyatlistesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e859f9d8-50b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694443553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443553, "uuid": "545e3df2-1003-4784-8559-b33703b4d397", "comment": "Malware payload (AveMariaRAT)", "value": "1972b41997f736eb1bfcd4521bd64713", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443553, "uuid": "aa4638d2-5737-4318-b564-ea0a5bc77dfa", "comment": "Malware payload (AveMariaRAT)", "value": "3304d2c27ca17f545b4b865fdd9539a8b27088aea0bf07ab4ff3a19c194628c2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443553, "uuid": "d9090ff9-4cd3-4e61-92c4-7b456a02266e", "comment": "Malware payload (AveMariaRAT)", "value": "7b2458c12b9083affa3c6f951ba222a89fa6b25d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443553, "uuid": "dbae58a1-d208-49b5-beb8-64adca4210a8", "comment": "Malware payload (AveMariaRAT)", "value": "5bfc8b11c451412ee5e3cb43dfd75c9354da48200c9020a5b23ef237604501ef964159438b4bc93753b91eea416a97cf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443553, "uuid": "b77abb56-da7f-4462-9f96-5b1b6f75332d", "value": "T1428423B7964159F9FBB168D424E7ECBB91C8268973CD0CD86034B4F71682CF22D50EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443553, "uuid": "12a69899-c59f-46fb-959a-aa1cdda3ea2c", "value": "6144:ynqoV23cAG2hHRIPWi3cw+8WkdOe5IuettXNu6brzavxOr7Nj5B2sRZwFB9hoAtl:ynqowcAGgxAaw+8WoIuetdravxOVjaWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694443553, "uuid": "7cf9290e-d68c-4a7b-a992-a4f516239e43", "value": 372399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694443553, "uuid": "5b2326e3-4de0-446a-a34b-0bf661451e03", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443553, "uuid": "8c14fac6-5de9-4e69-835b-3ee55097f42d", "value": "QUOTATION_SEPT9FIBA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d50d0c-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694423825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423825, "uuid": "7e87544a-e59b-4e3a-bcb9-e7d495a7e9d5", "comment": "Malware payload", "value": "dcd230ff4b3a2e12974944e01581de5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423825, "uuid": "0c670392-f360-4850-8811-53353472a320", "comment": "Malware payload", "value": "33c045ca4e23211f86fc6fd1bcd6e8651f331ac9b4b936e6dda7007e1161df42", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423825, "uuid": "bf35561b-49f4-4d24-995e-984c501b7fd2", "comment": "Malware payload", "value": "ee4ea834e8b62ee5423ee225c5f3207707ee44e8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423825, "uuid": "58558295-bfa7-4725-90d4-c10caf9bab36", "comment": "Malware payload", "value": "70d8dc9b864c4dfa07db845dff2d5711f58e8e46fd726057c97a6b353670fee976879d183eb611064306a04e81a27e74", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423825, "uuid": "580b93c9-2588-43b7-8991-4a4b14863e0d", "value": "T1F4C4120177DDCF9BE16E52398683E689A12AFC991E01DF6778E1B70D2C783353C0A5A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423825, "uuid": "9dc970ef-a5d1-4acf-8b99-e41ccd09f156", "value": "12288:LC79BbmKy2AfG3CQ7nKS9LhS8jWxZIVEs0Rk4q:LW9BbmXGj9LCxaV6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423825, "uuid": "3f80de0f-cb4b-4ab1-9754-669ef930703e", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423825, "uuid": "ce250720-7625-469d-b5f2-64061be4b830", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423825, "uuid": "60ce2c5b-cf64-4feb-ae8e-564216144632", "value": "Chemco PO 2056598.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6fc7f3-50bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694448447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448447, "uuid": "72eef0ce-ce84-43b8-a052-5f27611fd68b", "comment": "Malware payload (AsyncRAT)", "value": "1376b79b899f64b59195e5143e0aa8b2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448447, "uuid": "b8979f61-60a6-4b68-a779-8870f6bed845", "comment": "Malware payload (AsyncRAT)", "value": "3444679e8ab3dc7856d7410fa9f39ddb0bd9ed15fe4b08e0d3667356eb20310f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448447, "uuid": "c1b2715b-2e5c-45fb-b3c2-d4ebe384946c", "comment": "Malware payload (AsyncRAT)", "value": "d93dd2e0a9c5590ccd298be8e6fd28932f9ab782", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448447, "uuid": "e5e15c6d-983e-499f-a46d-ec9e1de6eab9", "comment": "Malware payload (AsyncRAT)", "value": "7308e85216d204cef5986062f6bc136b31ae40aaaec7eb91dfed2877d7ea7c6a53f21adb478efd4d1bd309ffe94fadd7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448447, "uuid": "a4738cec-7c0e-474c-a3a3-5206cd9757d2", "value": "T199236D003798C13AE6FD4BB4ACF2A2458675D62B1E03DB597CC811AA1B13FC556036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448447, "uuid": "f692d9c0-33a7-4792-9cdd-1d3028233d9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448447, "uuid": "853f9ae7-c0b3-478a-aa63-8864985a01a1", "value": "768:Eq+s3pUtDILNCCa+DiPyeLddR56LV0TqQijv8YbsgeEQ9AYvEgK/JDZVc6KN:Eq+AGtQOaovyLxPvzbjgAYnkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694448447, "uuid": "5a92e9c3-db5a-49c7-b541-47ca1dbe4389", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694448447, "uuid": "562e1a5f-b61e-4d38-b680-df4cd02eb326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448447, "uuid": "c8576107-820c-4006-8dcb-d2de3def3780", "value": "bPDf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12de730-50d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694457714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694457714, "uuid": "ff56933a-744b-487a-a368-2a29476c2ab3", "comment": "Malware payload", "value": "64a79ec8d1eb98a5e74ad5e7f2767a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694457714, "uuid": "eb963173-d2b1-4692-80f8-650a4cbcaa50", "comment": "Malware payload", "value": "348adf57fbbe1a8d51bbb49a5fbc4eb27982c71e5af5a9d94ffbe54068a7dec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694457714, "uuid": "ea7baada-e2b7-4e04-aac2-34dd9cffd0c5", "comment": "Malware payload", "value": "739cdcb919493716ec4e235d07c61aad523ff1b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694457714, "uuid": "8a4ea767-9e35-466b-a18c-f57d8f5d6e69", "comment": "Malware payload", "value": "1aa65d1ef32f9273d427dc02e105019257a3175904415abc4375cad6988b12b1b8e9bb90eaa902539818aa1cae0e07f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694457714, "uuid": "ca5c1150-bed1-4e09-b0f1-a7c5ed0ff1f0", "value": "T156C6339A3F6103ECE9C6E1338A576A5AE23D35561705E69E43B951F0FF473A80C2834B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694457714, "uuid": "9bf481de-3443-448c-9296-81fc1f92dfc4", "value": "ac0e09d0c87fe7a2b9c519b9d03a9c4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694457714, "uuid": "31ccf938-e85e-4d14-b22b-97afdb01456d", "value": "196608:8wmW6PWkNmtYw5xHObgcxWqvc2CxXAR2q4kRLCMe+XrrlFgyp/3vBpiZ8eF//4R7:0nn+YwKb+qvcbBq4kRL7rvgypPvXuJFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694457714, "uuid": "1bd3f1a1-4e01-4e61-87af-95a1fb04f7bc", "value": 11747888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694457714, "uuid": "33659cd4-2280-4ce8-9480-3a1a2e65074a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694457714, "uuid": "6abf7f89-09ff-4e65-aef4-1aa61cf8e956", "value": "348adf57fbbe1a8d51bbb49a5fbc4eb27982c71e5af5a9d94ffbe54068a7dec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8343c4-50a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694437146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437146, "uuid": "9af72b9f-574f-43c9-8876-80c3dd0e4192", "comment": "Malware payload (GuLoader)", "value": "b5028cb4b005899f420acac7ee6f14db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437146, "uuid": "b5279524-8d10-4bc6-bcca-a80863bfb715", "comment": "Malware payload (GuLoader)", "value": "34bd681d2e356498d21b51f3b9afe74e556407e24ced2dde502b600df52f6da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437146, "uuid": "6e09858e-f932-4762-9f97-53a2b886fad5", "comment": "Malware payload (GuLoader)", "value": "4c6a8d3120822c199b6548ef5e77c085fac04d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437146, "uuid": "5b9d41c6-508a-4ab4-a454-4a489f8d5129", "comment": "Malware payload (GuLoader)", "value": "90c6900ccf501461df68b2d7ca19ed5c553835c9b8cd903d78251aa0e5259d6dc1f62d2dfe7d04a71a1d13ae39f5f252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437146, "uuid": "2d34bd56-05d7-4637-b6d1-48f960b85463", "value": "T169D4CF4DF362ECE9FB660279257118163F819C5E60D9285C228DFA263D36353509BCFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437146, "uuid": "d138c5a2-01b6-4b02-9346-420f2b193782", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437146, "uuid": "e316678d-fa3b-4cf0-ab66-e5c28537cd3f", "value": "12288:3FLVbT/HmKOK5eYDJOY7MIS3kmHCj/Mfx8308:7bTvmKJeYgG/WiI+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437146, "uuid": "7f412a56-70ec-4843-8fa9-04dda678ad61", "value": 633541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437146, "uuid": "b14dcd4c-7053-4f27-a446-d9a8e58c9cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437146, "uuid": "f1e9448b-432e-4c85-a692-468f2287a781", "value": "Payment_Advice-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8826cf7-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694423823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423823, "uuid": "d39a2690-36fe-41e9-967b-877f92a81787", "comment": "Malware payload (AgentTesla)", "value": "f4cca8f92d2692a82b0fad6990176e12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423823, "uuid": "1541bf28-a95d-43a6-9451-58d6030da0fc", "comment": "Malware payload (AgentTesla)", "value": "351543fdab63fd796761654959e5ca63925454cdea19c3eef2d737addcdaea2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423823, "uuid": "66c747aa-622b-4df1-95e3-82370da5292d", "comment": "Malware payload (AgentTesla)", "value": "ad8bb8aa4a0e88ebaff167d07b9ac9dd37fd4eeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423823, "uuid": "b2a5ab5c-7d75-4850-b3fd-4d900c7066c2", "comment": "Malware payload (AgentTesla)", "value": "9bdb37764e67e09fc4e421061c76020c6bc6961edfab65cefdd02be5ac07558b0875043a55cd51f51b840e017a9534a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423823, "uuid": "77bfccda-dcb1-4c44-a2e1-ecfe2d496a5e", "value": "T158D4122233398B32C45CC7FCE15B1A2813F6A19E9A17FBA94DC5B4E26F637408654D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423823, "uuid": "22e2018b-1272-4989-85f6-409c6e3ebd9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423823, "uuid": "c8d2c7ee-f10f-4e38-b275-df99a4acbc7d", "value": "12288:DS1D3P4nKxjxcQG/bYQc6A6Q3jTg65fZ0oaXAU8hF4sSYFgD:D2D3HGDYQCQQZ0OUkFZbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423823, "uuid": "f0977c33-6219-49d4-918d-9f44819defe3", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423823, "uuid": "f03c072b-ac31-4b21-ba74-b4430d1bd603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423823, "uuid": "d417e230-80a5-4ed8-a44f-de82b16ae667", "value": "Payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c812a0-508e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694428224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428224, "uuid": "e0540a57-f3bd-44d3-a63c-dfea7d56a67b", "comment": "Malware payload (Amadey)", "value": "4bf0f9184af0da368c6f96fec5b177d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428224, "uuid": "face3e77-d503-4606-966b-844545966c72", "comment": "Malware payload (Amadey)", "value": "354bd882162fa624e80ea3c9e3e73d4f5f90fb016a28cbc0e78fe81ce5133f89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428224, "uuid": "e8b63c63-03eb-41c3-af11-4e5ddbdf858f", "comment": "Malware payload (Amadey)", "value": "9e76dad79cb6f140ea5f8e137fb7b6f4a50dafcd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428224, "uuid": "7e4fe797-2c6b-4295-a95a-0e28305148bb", "comment": "Malware payload (Amadey)", "value": "f301581271f680ccf8b5fa7c2eb7368fbdd2506d60cd1889b2e32256c92c615c5e5ad8b03e8d7e417ac55370c687daf4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428224, "uuid": "febd2883-1f9a-4d0f-9b5c-fa371d721da4", "value": "T17A349E11B4D1C433D83215360AF0EBBD5A3EB9610B615AEFA3940F7E5F202C1AB75B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428224, "uuid": "59c850c6-e4dd-4731-be4a-a36d52904174", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428224, "uuid": "fddcc823-739d-45b4-8cca-2bd35157a23a", "value": "6144:5s7UZz6DCGbAR/VeDC1tAOMcCxVa87curBiIg:5fZzaC+Uj7WVa87curBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694428224, "uuid": "e6109dbb-c0de-4c19-b7c4-598f1a0c2d1e", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694428224, "uuid": "1aa5512f-6b3e-4b2c-8cd2-f39ca84fa75f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428224, "uuid": "c2731670-9886-4ff7-878f-68ac8eedd1af", "value": "4bf0f9184af0da368c6f96fec5b177d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159d6f60-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424731, "uuid": "c76e5f76-4520-4f14-ace6-83955debbfbc", "comment": "Malware payload (Mirai)", "value": "5d6e9c53f940a748ee686d9dbdb9e044", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424731, "uuid": "ffdf0ce1-1c4d-4d23-b1cb-5225fb70bc34", "comment": "Malware payload (Mirai)", "value": "35a08245c4e4bf341f0dadce16fec7448f22c2091f9bfbb33def01c5ee9cdb2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424731, "uuid": "51b082d2-238f-4aed-83bd-ad0670ef9336", "comment": "Malware payload (Mirai)", "value": "a31b83e01edd00c5f88ba4dfe1c1b3cbde209325", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424731, "uuid": "979ffa50-a53c-4ba8-ae47-9ec8d230587a", "comment": "Malware payload (Mirai)", "value": "dadbea5567dc7f1ed0a741257f66e40fb32264c18743655dd12fecbb544ca1255df11bde2f796752598e932739759d2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424731, "uuid": "3c6b38b2-c742-4ceb-abf0-305a3d19cd6f", "value": "T18B53AFB2D8949EC0C509437870708ABD5763D9467A1B1EF09E4989AE400FEDCF25E3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424731, "uuid": "d45dba6e-cd34-41bb-9325-c6188c15488f", "value": "1536:6/i6bYdjaesqtb43p81j9/tqWgj0KV7Cox07:6aVlVtb4ApLgYKV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424731, "uuid": "9edfbfe1-0aec-46fa-9090-a6eb1c223d16", "value": 66596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424731, "uuid": "19b97f30-2fb6-4217-88d9-a794f68ae92f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424731, "uuid": "6b4a23fb-a6b2-41d0-a66e-d2be8596ca7c", "value": "5d6e9c53f940a748ee686d9dbdb9e044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52be3bcf-508d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694427840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427840, "uuid": "8cd8c116-472f-4de5-9828-b71b729fdae9", "comment": "Malware payload (Loki)", "value": "adfc0ccbce06a0a386dafa3ce5692cd0", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427840, "uuid": "fab3bf68-a86d-469b-b2f6-984c87a69cec", "comment": "Malware payload (Loki)", "value": "394a24d6dc1d28a4e041e61b77a1650e9f467503e3454050bce9bc4c5e21c5ab", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427840, "uuid": "7d3e3457-df75-484f-8be0-2b7d9f0f42a2", "comment": "Malware payload (Loki)", "value": "b5a4a4597a00dfbee9e8d4aaefd7420f4b975cc1", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427840, "uuid": "067f90ee-7d41-46d0-b83d-7827ac250a32", "comment": "Malware payload (Loki)", "value": "7fa1b8432a48662e646464ddfed3face20697dd6270c61ab3e0cfee876c926a9eafd62c77bcb7fe1e8ad6ddd1a336d57", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427840, "uuid": "1b66eb2c-1a3e-4783-b69b-a25234d562e0", "value": "T1D89423722E5F6093AC817DF33601D705698ED2B093C57C5A6F26F35B5CAC31AA822637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427840, "uuid": "3284275c-b775-4f0d-ab71-1e7309ca9631", "value": "12288:YTdgOxGsOYXGW9oZ75BzY1+9tL8Z8HGIJKZ:6pGsOIGWEzY1sEI4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427840, "uuid": "6051de5f-5321-45b7-a5e8-fdae6cfb6174", "value": 445198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427840, "uuid": "d2892be8-6eef-4138-bfd4-1ea2a9d808cb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427840, "uuid": "96993cef-775e-41e3-a5bd-4d0ea2a6398b", "value": "Proforma Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f512060-508f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694428613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428613, "uuid": "8091d5c6-f89f-43ca-a346-da57639fb104", "comment": "Malware payload (AgentTesla)", "value": "0c854aa42124ec3e25f4bb79f9b56ffb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428613, "uuid": "3dee1209-eec0-4d3f-b1d6-4090a45ec6cf", "comment": "Malware payload (AgentTesla)", "value": "3b457aca769a1101b0cb8224c02cda21f27dd7d0f72baab01ecf30b67f5733c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428613, "uuid": "b8937287-f3ce-449f-b1bd-8d7875d7ffef", "comment": "Malware payload (AgentTesla)", "value": "11404ae25fc83668330031809510a7be93f1ea12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428613, "uuid": "5517873b-cfde-4740-8468-bfcd2877fdb6", "comment": "Malware payload (AgentTesla)", "value": "882f4b46a8bae4e81d4043b0655eee1c62a5569dd83d228d73a8f68c35eb635bc60fc2673ff70fefde2b162ab1194883", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428613, "uuid": "7b57d2f9-4c6c-4c61-b693-1682154303ae", "value": "T19275AFFC76047DD6266F536BCA96ACDD13B627629ACBA4CD80647BC305A3335FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428613, "uuid": "d944a423-f5b2-4d48-9aa4-4b99abbf672b", "value": "24576:XspJLGWe7Yt4BdJZHnfvRSSZz2ax/OIdyssNo9tftgNi2GtME3DziHO4pZnyPaU+:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694428613, "uuid": "1b70da58-8ac2-4ac0-88ba-91aeff5c8387", "value": 1653054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694428613, "uuid": "ac4cfa50-2dd4-4eb4-96a2-c9c940ba69af", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428613, "uuid": "56419254-d64b-4f9a-9e99-a5fb452ea85e", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.21588.13495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62887f19-50a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694436027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436027, "uuid": "85594622-357e-409c-8c6d-3abe41a067f1", "comment": "Malware payload (AgentTesla)", "value": "ad05fb79444fca07e870b5ad0632405e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436027, "uuid": "a4c81626-631d-437a-81fa-2970274af56b", "comment": "Malware payload (AgentTesla)", "value": "3b7fc7b3e49525c1ef7a44a88d578d7287b5d6dffaccee7ce9e4137f98090318", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436027, "uuid": "bf2c9021-6178-4d21-9f8c-9b0125bc114f", "comment": "Malware payload (AgentTesla)", "value": "07e48ba9013efd009b7eb5d2df2e3e02af3eb57b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436027, "uuid": "55835d88-957d-486d-bb37-82e8f7235bbe", "comment": "Malware payload (AgentTesla)", "value": "fdfe573104d10b4ea2b09c524184cf59c513504c9e0d9dc49639a0da09da6f6cf4dc56772dd73062dc92961373a0682d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436027, "uuid": "5f528ee7-2df0-4ce0-b6f6-941dd1c2128d", "value": "T187653395547C016EFACE7A3F900CABA8C8E0F9715FDB141562B9EBF78CBC3A45A12111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436027, "uuid": "5b6a8e41-f668-42ea-90f2-c3daef249309", "value": "768cce1a3135ef56ac91aeb097edfe55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436027, "uuid": "f12e4187-e72b-400a-952c-4d448fece4d2", "value": "24576:cXG9gRLbByaDqKcf38/DByXPFIIfnCkeG6ZRmNBMOA81JEl999JP:IGALbwgqKcf3wBUFnfnHX6m1A80Hb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694436027, "uuid": "80232955-96f3-43eb-9877-4836b7c4cd62", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694436027, "uuid": "8eaf430b-e310-47db-8be7-f634961fc879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436027, "uuid": "319b6f3c-c4b3-4c07-9b0e-119d7ac6d74b", "value": "MT VICTROY_82992029774748791111073883321-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec5e08a-503c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694393044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393044, "uuid": "ff610372-a549-44c3-9933-f9408d46d510", "comment": "Malware payload", "value": "0850a7c711fb74cccfb476eeae54cb44", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393044, "uuid": "068c9507-c0e5-4661-aa68-7e951e16dc7a", "comment": "Malware payload", "value": "3cd33a8be9e3511367abc54f20656c9e31feea3c5b9b4552f3979d57bcf4c204", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393044, "uuid": "222e2be3-8d15-46cb-be9c-d8678cbd0f3e", "comment": "Malware payload", "value": "3ff9debec15280d3429862631138a95f89ab7ebc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393044, "uuid": "386100c9-5dc1-4003-9e46-3f54e3ed99e5", "comment": "Malware payload", "value": "433f4c569e9f620d2e2fe122a04cba7df7e030ccf77a769865dbc7874888eef96c5a0350d700bee2a9ade4df0553e13e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393044, "uuid": "8ad7a6ac-4b39-46a2-91ab-1609fcc521cf", "value": "T1BDC4CD4D31636392F231BF29F4324F12F8BE95514C16DA978FC892C516926CB2F2962F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393044, "uuid": "5a958126-cff7-4c7b-ae32-570560390c94", "value": "12288:bRJkWyqyzBAHHEy2YDDzLny3ivg2Nu2DRkUTcm7PHd5:MAPnEyJD3nyK5z1NYg/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694393044, "uuid": "5d30a822-df31-4a62-a37a-d58c7cf86dd9", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694393044, "uuid": "6eb45536-2ed1-496b-a311-bf1dd704a6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393044, "uuid": "e2a66ad5-2241-4ef6-8708-5364813b0c0b", "value": "0850a7c711fb74cccfb476eeae54cb44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8b4968-5047-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694397661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397661, "uuid": "2a55e6e2-d853-43d7-b2a2-4aff7115fc3f", "comment": "Malware payload (Amadey)", "value": "d1042a7af3439391d259b92a6750c86e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397661, "uuid": "402e9fb5-c00a-4944-acdd-5bd83d00591e", "comment": "Malware payload (Amadey)", "value": "3d02284a76e9eea0e642c5997bc0e333981f3f1712794772fb98fcaae8b17916", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397661, "uuid": "b5399afc-b272-4d6c-9490-07b0ae25fbc6", "comment": "Malware payload (Amadey)", "value": "a5ef86afbc6d11d77e2aa0a111755938ff31c21d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397661, "uuid": "ae6c4758-4257-4794-b57b-a0c3b99ed510", "comment": "Malware payload (Amadey)", "value": "4a574e45472d0cf71ec6d858352e92bcda2308522474549ae6de8747e7635b2cabea592c463818c868a948b6810d5731", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397661, "uuid": "f6eef198-2dfd-4e5b-9375-4875799b1132", "value": "T1CE651205F4A04832D5A7583688F19AF2D97DB4200F55AEFF53F81F3E4F6428266B12A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397661, "uuid": "84843297-3c5c-40a9-bfa9-c8c91b03ce4a", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397661, "uuid": "f1b0e7fe-710a-44f4-ae9f-e552c4a564f1", "value": "24576:vk2CJemHdYJ7NL2BKcN3HNkjO4fx8RAjo7jbs8mmtDjtBpa0u1Hg:M2CJtHiJYBKg3H+O4J9jovbvljXpaJ1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694397661, "uuid": "006811e1-7cb1-4e03-93de-6a8f5b0ccdb3", "value": 1470840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694397661, "uuid": "0ae5bfd8-6840-4d87-a017-1ae8dbfb1f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397661, "uuid": "d6f19d77-96e4-4f51-9957-d2bb8f2aaf53", "value": "d1042a7af3439391d259b92a6750c86e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50260a67-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450169, "uuid": "9574a709-0eda-4a14-82ba-c9774b604bef", "comment": "Malware payload (Mirai)", "value": "e1cd452a2fd418ac9bfe40381f06678f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450169, "uuid": "a85bab7c-0809-4996-aa9b-def1ce964ed2", "comment": "Malware payload (Mirai)", "value": "3db3d327487f5e67258ae97153fc54eefb6f8e03a43a0774509c127c5c230587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450169, "uuid": "7dd3e2bd-e841-4521-a848-66dd179f151a", "comment": "Malware payload (Mirai)", "value": "cdda4d0be12d75562e55982245e7f2918cab18d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450169, "uuid": "dfa370e3-e63d-4e06-80c4-5b9083f59852", "comment": "Malware payload (Mirai)", "value": "bb37142790ba624444ccf693515bde7b0f304bc3fd1eec6e82efd61b26d6ab5e08e773a5948a5b6de663228584f3dd29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450169, "uuid": "b3c337ce-220c-4c7e-afde-7fe2d8765065", "value": "T185E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450169, "uuid": "2bf297c4-1346-457b-babe-c1ccc42b51a1", "value": "3072:JW6dm9tS1aRGQdK76t/zCcI5mrThPaLEnvPrNb:c6IG+LChmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450169, "uuid": "f89616f9-9191-449c-a8f5-2118cafaabc2", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450169, "uuid": "35a00234-cda8-46ef-aa73-e6e702b6b8ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450169, "uuid": "197036bc-232e-4da4-9446-c354403b3e1d", "value": "e1cd452a2fd418ac9bfe40381f06678f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b315843b-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424136, "uuid": "7dd89c30-a18a-45cc-af94-d6fd6d7980f9", "comment": "Malware payload (AgentTesla)", "value": "15657c38fa2fddb4b91f77759a81d2b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424136, "uuid": "9abc5bdd-c894-4dc6-ac0d-50e12254996e", "comment": "Malware payload (AgentTesla)", "value": "3dc0ba891a9eb92c7264d339be2defe76aa995806602a23aea9f1e6c3f4da29a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424136, "uuid": "f1d7b512-2311-4ae3-a514-f10b0f2e6e08", "comment": "Malware payload (AgentTesla)", "value": "d6c00651976de0f462e1868cc3238beb4ba78048", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424136, "uuid": "25686dc8-2a59-40fa-b266-b8ac64199120", "comment": "Malware payload (AgentTesla)", "value": "992f4f3b3dc296f7f1bf674df0a84db9a4d96a2cb2eb2f4324feaf1599bda15bdfc6112a9b09ae2c7ff032522aa7362b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424136, "uuid": "f9ac99af-b18b-4bb5-95a0-c12c24de95cc", "value": "T1F2156DD1F190C8DAED6B09F2BD2BA5302497BE9C54A4410C569DBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424136, "uuid": "f459fbd6-2233-4195-912f-9b40c09879cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424136, "uuid": "95fd89e6-cfec-413e-803e-a282ebeb13fd", "value": "12288:b2iNZ1DaYE98gDHsaXmlnSK0fTcVploUULeOkQi/n4pY34rrjwuNXDVo:b1pDDE9QecflOkcK3ElD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424136, "uuid": "42da2150-f72b-465d-a15d-e4284141a353", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424136, "uuid": "b29f3a4c-9778-4f85-95eb-865f1ac61841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424136, "uuid": "7b2e91aa-81b3-4dbd-b0a9-35449fcfe558", "value": "sipari\u015f formu_831519.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2670fb-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694445410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445410, "uuid": "93905ff5-bb2c-41a8-b9ec-d5fc5eb7a37d", "comment": "Malware payload (GuLoader)", "value": "9cc1845b1e61e702f27d4d4ddff8a422", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445410, "uuid": "0dd1e45c-5bc3-4d28-a63a-0c341ce60217", "comment": "Malware payload (GuLoader)", "value": "3dc5eaae566d4ac2833ce010d739bae9cefc9072b343f9c3c6856592b842cf19", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445410, "uuid": "86a02157-9537-49de-8add-b1121b22ee59", "comment": "Malware payload (GuLoader)", "value": "0ebc829e7ae34a7ffaf002c3c44c68871fdc6212", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445410, "uuid": "41df95ae-9e91-4af6-9644-f73578db620a", "comment": "Malware payload (GuLoader)", "value": "e0ee3d5040042de977d4ec37fe020937efe53152ccec2b3a5a1c257eaa7a20d5e367e514b356f6820873bdddfa23c482", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445410, "uuid": "cbd2d8bf-e454-4885-a67f-e16dbb0b1b89", "value": "T173237CA1EF94152A0D4B3B9ADD41884185BC90295927556AFEDD03CFA20BC8DD3BEF1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445410, "uuid": "1cda8fe7-1229-4334-8f47-70bb0436fc36", "value": "768:qj5mMfXPC7rrjKqYwT3rSDOrSu6ym+puMppQl05D/sxqAXBeRgRXGXgqY5WMZvEH:qFmM/KTdVe+SuiDMpGc0N0Rg9M2dCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445410, "uuid": "af1419f6-9a60-4488-81d5-f9fc72b9928d", "value": 47464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445410, "uuid": "23f745f3-865f-4d6b-b20d-8e477e0e89ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445410, "uuid": "00dcb51a-9af9-46fe-848b-f7dfa4d5d97c", "value": "PO 79345.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfbb584-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438781, "uuid": "f89c5776-818f-44c9-931a-eeeb5875853e", "comment": "Malware payload (AgentTesla)", "value": "a8a7ea2299d2d38eb6fb45b8c2c15d79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438781, "uuid": "81451921-cd64-4b64-b2c0-ddd304915749", "comment": "Malware payload (AgentTesla)", "value": "3e1f0b3352d753cd0d4ea76ae273bdfc9a597be10756f5f660116d4f4416a311", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438781, "uuid": "803dea04-c053-4710-a9bd-3a1e8ff088d0", "comment": "Malware payload (AgentTesla)", "value": "93b43b1d6d033aa63db740b07acc46c56bca25d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438781, "uuid": "f9c430c1-ed3d-437b-8174-c19818952ba5", "comment": "Malware payload (AgentTesla)", "value": "7bde8bcd77ab9abecd1fc2cc5c4530e0f9215a9fa496a8067921d4c402d012e9b2050a10ea84766122e53c3271cef33f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438781, "uuid": "3410eecf-c407-4de8-a454-ef92ab7f331c", "value": "T197A439FB50C09FB2D8663737CE745D6822366B98C6A0EA4F7374192F9D1F2D2BA21150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438781, "uuid": "e2a68b5c-7684-40fc-bb5e-8cb78b07c30f", "value": "af4f64454f6d21ce0181cd6c7d9855d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438781, "uuid": "33b03620-2c74-4171-b4db-b6268c7161e0", "value": "6144:CT4CYFTjTwOY1JQWMFh7AOt09pdU6W1l35xY56M6I3xlHHoZLQ09O2joUCiJ1tNc:CTwTjTDv7Yv9u7t2JIQFSaApkEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438781, "uuid": "9d4a4040-7cf8-4156-96e7-a09469f12a64", "value": 470392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438781, "uuid": "e9bd94ef-66c4-4e8c-aca0-e86484662048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438781, "uuid": "33d0fbeb-6ed5-483f-926b-74b9cea25754", "value": "TS230007-CIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb45bcb-5071-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694416019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416019, "uuid": "a3a406b5-61ad-432b-9c65-edf13469a887", "comment": "Malware payload (AgentTesla)", "value": "69f8831f5c95ebfecde060b02c9fe75d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416019, "uuid": "9e7155fa-1901-41f3-a705-e81cdcc076b1", "comment": "Malware payload (AgentTesla)", "value": "3f66b57bdbee3555799d399b763e9b26e9808172d3ef384569afd134c557808b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416019, "uuid": "a101da38-59c1-4a63-a6ab-03b76883d3d8", "comment": "Malware payload (AgentTesla)", "value": "312877b5b59382e4c3352a7f4a14790ebb091664", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416019, "uuid": "0d32137b-4bf2-4341-8276-c021ef8098de", "comment": "Malware payload (AgentTesla)", "value": "246425c49e794ea9f27e0b0d9d94bf878945a18751874fb5b21d11bd7e782499cb3b91700947c3eddfbbf5e3cd117241", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416019, "uuid": "7730e79f-cc0c-45b3-a53b-46684fe6af71", "value": "T1B5D4230C82E3B921B5D7C2E22FECF66E1D2A66D527702503A3FBA15A0D3A09F0706557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416019, "uuid": "eefa7df0-319c-42a8-b593-47cfd157075e", "value": "12288:jSdmZoR3exZqzvB8mLBzp7TxttXciXVD2tsuwiGR5tXdcyfm:jS4G4mvBPBzvPVKtsuwiGR5ntfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416019, "uuid": "a670350a-c3c6-4ffb-860d-fa5908ac3a4b", "value": 615644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416019, "uuid": "bd474f8a-7c6f-449a-b02c-1020c6be2232", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416019, "uuid": "61432d5e-7cd1-4d63-8732-af4a69691b93", "value": "SWIFT copy56650XXXX_0716NSMI0015024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0387141-50a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694437526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437526, "uuid": "95511efa-882d-4b34-a0ca-12c33770bd50", "comment": "Malware payload (Amadey)", "value": "f6b485ccef600f36706edab8954f0a30", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437526, "uuid": "a562a7b2-dc6a-4a1d-af0f-fc3d32b0c208", "comment": "Malware payload (Amadey)", "value": "3fb9ffe6f9613f18c1e9984787d37a5d9ed4cdc37c628be7cba33d5c37e782aa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437526, "uuid": "8836a2df-3fd2-4750-abaf-9ef3d5d00af9", "comment": "Malware payload (Amadey)", "value": "601ffe5e0576fedaec6a90a32c0a7944da8e21ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437526, "uuid": "64772564-6a23-43d2-9b3f-ce928e8c9ee4", "comment": "Malware payload (Amadey)", "value": "ac890d95a3d2295d2950bf52abe9577041f5bf02ab876fcd7d02b08a84c100862a5864f2906df99df7ff488615156c0e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437526, "uuid": "9f99df0c-634a-4092-93d0-190852fd13f0", "value": "T19F65120170E1883AD622163309B097F9877DBB6D2B7558EF63942EFEEFB01D20679425", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437526, "uuid": "cba08476-6549-40ac-a8ca-08661cb97c59", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437526, "uuid": "98971568-cf9c-489b-b5e9-c736c43715b4", "value": "24576:6RSiHSTDB3oblEne2AAqPg4/ALRrODqAUG3sytSCi52fOPGAuSc/YUny:hiyTDEUe2AJPpX3syt65nFuSiYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437526, "uuid": "5ff3062a-ca07-4697-b271-65bce23352ad", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437526, "uuid": "6edfb378-b5c8-4e5d-9651-ff36fddf390c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437526, "uuid": "96ca32b8-3bb9-453f-8dbf-7bec00902d08", "value": "f6b485ccef600f36706edab8954f0a30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d621463-5049-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694398518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398518, "uuid": "c02f8a64-84e1-48b8-87b3-22a13affad29", "comment": "Malware payload (Amadey)", "value": "2f159603b41f5ec61d187922aaffed9b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398518, "uuid": "c9f56f15-8611-4345-942e-ab92d96b7504", "comment": "Malware payload (Amadey)", "value": "40b5bf06cc102c64baa6e227edf70a638d1f2c03035a3f0fafac5f448496a6d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398518, "uuid": "9a714921-7537-47e2-b436-527e7c8826bc", "comment": "Malware payload (Amadey)", "value": "166d78e0e86a6ce1208adc62a9664898dad5071a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398518, "uuid": "e593698b-c5b7-4e36-a3da-acecd2c2c6f7", "comment": "Malware payload (Amadey)", "value": "08ea6d2f722b60ed3c316f887fab4befc8c13d6c710e3b7e80ccd34665dc34772de5cfee890af03e0e35afccc08e920d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398518, "uuid": "53112b49-8366-4e50-b2f2-8cb437704a38", "value": "T123349E31B4E1C432D932953609F0E7B55A3EB9700BA199EF93A40F7F4F202C1AB75A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398518, "uuid": "4b8c20d5-5cdc-4998-8601-dba058d04029", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398518, "uuid": "bcf10c06-0db1-42c9-a1c7-fe8ddfdc0d14", "value": "6144:8V3UPz6DCGbAR/VeDC1tAO7cCGxVffturBiIg:8mPzaC+UjevVurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694398518, "uuid": "b15df222-75d6-432d-b92c-90e5889644bc", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694398518, "uuid": "a92c601c-efdc-4759-bbce-41aa410b4230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398518, "uuid": "14191687-05be-47d8-a0b7-14f5e5e6d6eb", "value": "2f159603b41f5ec61d187922aaffed9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c9ecaa-5075-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694417532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417532, "uuid": "f43df5ce-3ffd-4781-a7ab-3dfa12b9909b", "comment": "Malware payload (AgentTesla)", "value": "fdd92475c2d84e8bcf0f86f64a28ab8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417532, "uuid": "c6279fc1-13d6-4f67-bf0b-37b70bb1792b", "comment": "Malware payload (AgentTesla)", "value": "413cab73df1103fe3ae2482a8386ea99267fbe5ebee25126eb41e67e62b07113", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417532, "uuid": "c52ec4b5-c770-4944-b197-754efa814b52", "comment": "Malware payload (AgentTesla)", "value": "b68876b5fa01079ea49f1cff5d463211df83adba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417532, "uuid": "44b0bfe7-249e-4458-8336-825683cfccdf", "comment": "Malware payload (AgentTesla)", "value": "11e388287c877bc0a3c6f4a870dc257469794637d3d6767d4b999928bb82fe2dcfec778502dd93641dfd164d44cc8aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417532, "uuid": "d537e6d8-719d-49a6-95a6-c383fd783cdf", "value": "T182C42339A6830750AE2E59D91404FF653FF8ED73029E65710C826CB12FDA95F9132CEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417532, "uuid": "cff80048-fdcb-4cb0-8239-588e6a4cd024", "value": "12288:qWjxx/5juks59oB9crIVxdfgyjPbWlRcdCfCYhsHB7xwQvQcqBSFRHfyu:qcx55ak69Yer0bbWvcMC1xABc/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417532, "uuid": "a6271e9e-bc3e-4a6a-9430-a3c1b7d165b6", "value": 575477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417532, "uuid": "f39087ec-f1ff-4dd5-8c5e-2af2903fc15d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417532, "uuid": "65224de6-fef0-4d62-a6ac-528872582f9c", "value": "RFQ REF PG SS2024.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb22ff1b-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438752, "uuid": "8ffc6598-2380-459d-881f-4029db87f3c5", "comment": "Malware payload (AgentTesla)", "value": "2e6a7b8d51b76a73c701cfa8e2db36e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438752, "uuid": "1d443c67-b01b-47fc-94b2-e7b5cdba92cf", "comment": "Malware payload (AgentTesla)", "value": "42f64eb101fb37f637595faf2cc36cf8e251594ce3a061f52f7396ee796b932e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438752, "uuid": "e4ca92f9-d4e8-4bb9-b1ad-b8115aa23029", "comment": "Malware payload (AgentTesla)", "value": "ad3f2fb7db8d1c054adcde23b5a01271465c348e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438752, "uuid": "2086568f-4f35-4960-b611-7dcb778df3d5", "comment": "Malware payload (AgentTesla)", "value": "e388e37242b32097eb2db9fde74f54c612db8f1bc779868ab26e1cddd741159b2e42e9be60b00561ee69092179f6538d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438752, "uuid": "fcdee5dd-b84c-4cdc-a38f-8197215757e3", "value": "T1A4D4230B73DC4229D56E4FB228361E8433BCEA586945ED0C9EDC985A0D39F4586367E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438752, "uuid": "0372d80b-b64c-4645-bf20-0eab07988bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438752, "uuid": "d34ecffa-d86a-4f34-a00f-a4aab3d0568c", "value": "12288:O2iNZ1DXWxTcRxl+uaMBCJiL52Ypm+WIIFswPUjZ4Hggdx+9ZxZ9:O1pDmuxl+l4a+WxGZ4rqtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438752, "uuid": "cfc31f95-bae0-4fe8-a04a-d3b878ab2810", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438752, "uuid": "fb1087df-78cc-43ca-ba93-a0efdc0058aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438752, "uuid": "a660eb2e-af10-476a-94bb-7adec15fb3ad", "value": "Curriculum Vitae Silvia Helena.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c03385-5048-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694398215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398215, "uuid": "6d214ac8-c715-4955-a758-2d99b70a7ffe", "comment": "Malware payload (RedLineStealer)", "value": "4739c10bc467fdd9ae56b5ebedd3abaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398215, "uuid": "8755ff37-79cd-4a02-9464-dabc4025be64", "comment": "Malware payload (RedLineStealer)", "value": "430eb0d6289795bbc9edf659b47acfa6af05ffc3df47cff2400697eda1b8ab02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398215, "uuid": "41f9dd25-9cec-491e-bd97-1c73f4b04e10", "comment": "Malware payload (RedLineStealer)", "value": "62af47f7194159697008675cb79e40c88aef1876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398215, "uuid": "ccc4eda5-72b3-4f66-aec7-449fed8a8661", "comment": "Malware payload (RedLineStealer)", "value": "6414acf5acf602fbabea8437b8e3b0823cc7d42913dc50b1c9389f5ebd0298f948e78e4dc3ae7931718f57fcdd3998cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398215, "uuid": "ff609b28-5535-4b10-8afc-07bd4673aff7", "value": "T11934AE1074D9C632D8F2153609FCFBB55A3EB9600BA259EF93A40F7E4F202C19B35A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398215, "uuid": "35d63b5c-7308-4988-99c5-f47b3eef4e36", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398215, "uuid": "fe62bdcb-cfaf-4bbf-9f51-3ccd1971c2e0", "value": "6144:8KIUFz6DCGbAR/VeDC1tAOXcCik90GST5urBiIg:8YFzaC+Uji+0GST5urBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694398215, "uuid": "56f6a7d1-3b5c-4b57-bf55-ac571752ee29", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694398215, "uuid": "25301342-ee90-4b3a-9060-0d97c1ef2734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398215, "uuid": "2d890971-a594-42e1-ae81-119089f49c9f", "value": "4739c10bc467fdd9ae56b5ebedd3abaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b4b36d-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424724, "uuid": "29fdd0da-b5f0-42fc-b7ab-5059d2734bbe", "comment": "Malware payload (Mirai)", "value": "768fe2e8bd5f934ad9f92540f3b3137c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424724, "uuid": "038f0f36-6b1a-4e67-9272-86384137d034", "comment": "Malware payload (Mirai)", "value": "44a2d3727b0961dae4a535794f53d817186a6f75e8eb1c4f7a5392e8324b8716", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424724, "uuid": "d44be19e-b2be-44f2-a81d-4ecf2acee969", "comment": "Malware payload (Mirai)", "value": "21428c298fe302d68b8faab2b95645aba9f7b3be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424724, "uuid": "3e94d7ce-8439-4582-a9de-de1812e46125", "comment": "Malware payload (Mirai)", "value": "49577d3b1ec78b0635772f22dc4bfad0b146f73d43ab87b21af5f0c7e9500adb66ac9546920d2c908fe2793b7c4b2a70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424724, "uuid": "b3f1656a-4f8e-4db8-95e4-dd2057e82296", "value": "T11AD2F1C0907EC864E284527D7AFE16DE19936498EA35E358B351CCA6ABDB4253930FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424724, "uuid": "1ba75b51-652a-44be-8333-4e4014cc4777", "value": "768:JM4lFxmmZidbHZgmLvCQHEQTiukojvkML7Sq:SIFxhiZHZgmLvCVkdkojcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424724, "uuid": "122b7f63-5f82-4dd0-8caf-4b635a30d16f", "value": 28912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424724, "uuid": "c7b58c4c-3775-4467-b146-83991cb5f59b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424724, "uuid": "c5cf033c-5e34-471d-ba01-1470a715e2af", "value": "768fe2e8bd5f934ad9f92540f3b3137c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176fcd23-508d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427740, "uuid": "beef6c0b-814b-4456-94df-8429db338115", "comment": "Malware payload (AgentTesla)", "value": "b55d7e9a8aa82318ecc50c30d67cdf00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427740, "uuid": "4706f792-154e-424d-860e-1b36d17ef045", "comment": "Malware payload (AgentTesla)", "value": "4511139f5b5ec865efb3bd30e0ad24ebc9756d3203cd7e4f9ad0950971c1251e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427740, "uuid": "be505cbe-db98-4a7d-a3e1-86fba398d87e", "comment": "Malware payload (AgentTesla)", "value": "610c7f278458e89ce1833b60b7662f541bac394b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427740, "uuid": "3353ee0f-acea-44aa-b871-745d3bc22162", "comment": "Malware payload (AgentTesla)", "value": "9e536f6ce0c15371f51ac1963a77af9d8e4fcbecaa5e87d7c97e80be0267501ed76157aedc3eea1e3ecbd158ca15efd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427740, "uuid": "6f9c5191-3cc7-4a34-a744-35b1986e167c", "value": "T1F80413448B0D53DA2607461C210D2FE39152A5D189F6BF08D497DAEEB7AD338B3E369C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427740, "uuid": "ab863f9d-d86c-43b8-a695-589405ef705e", "value": "3072:+mq23iD6rivBJW/z2TgewxVUx9YsRFEAuh5VO6uRCoKZxsOg9shTWLC0Keyc:+s3SBJlTrwI9YsMAuDtOC1sOth0KXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427740, "uuid": "8eac4638-6a79-4def-ae13-cec171069899", "value": 182751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427740, "uuid": "2f8cbf3d-1ee5-4683-b3a6-022aa7703292", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427740, "uuid": "e40deb28-2d51-4737-affc-577fa9cc5daf", "value": "Invoice 70059531946.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b0e07d-508d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694427847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427847, "uuid": "fa93e889-f627-4a18-bcc9-ce27298c09ca", "comment": "Malware payload (Loki)", "value": "174cefb131ced83d0eca11b84a4de2ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427847, "uuid": "a60e931c-e91c-4283-b74a-9fadb33daf9c", "comment": "Malware payload (Loki)", "value": "45191a1dddc714811a9a194c7afc2376134a159c23e2a77318c8d7393435d73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427847, "uuid": "f097305b-b1c4-460e-845e-8008be9e8227", "comment": "Malware payload (Loki)", "value": "2b977e153013575090c7a415b065ededb794b695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427847, "uuid": "20d01f37-2f89-4e88-941e-f270dd4ce2ba", "comment": "Malware payload (Loki)", "value": "d7df169c060778dcf033ed27ce3dd3264143429308b4050dadcb8d132901884e3647bbb2a8e12b4be5ffc27bea836e4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427847, "uuid": "14696d8d-7874-40b2-bc43-006fbb9df8f5", "value": "T1C1B4CEF86469C7E2D3B443FF409B85718A27BC60A57193CD37BC76444EA6AD30912EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427847, "uuid": "c21876e6-965a-42db-8367-a4296f809dee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427847, "uuid": "eced3375-9b27-46a7-8cd9-606e96dbeed0", "value": "12288:dY5fVsbR2qiXQIEMEVcaM08jtWr2axSJngs6yG:6tO2q+QIRj4r2a4J/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427847, "uuid": "289460ae-75b9-497e-957e-0952b7429fce", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427847, "uuid": "9cf5319e-f08a-4e36-9cf9-488cc61658f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427847, "uuid": "fa30fd1a-1904-4a27-ac47-b8d327d9a4ce", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0284a9-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694445408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445408, "uuid": "f75f1016-9c03-42ed-b2fa-b885c6f15a11", "comment": "Malware payload (AgentTesla)", "value": "b8ad0843d4bf1699916443d86df322e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445408, "uuid": "b6377f57-c00f-44bc-9001-c169ce577b7e", "comment": "Malware payload (AgentTesla)", "value": "458b7da8ea5e1449f8ddd8cd108b75b3bb1942eab74fc50abfcf657153b96d9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445408, "uuid": "02d941bd-dd8c-492f-a316-fc4f4865e064", "comment": "Malware payload (AgentTesla)", "value": "f117637fb83d309cbad78bc993f4eea3071a5c36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445408, "uuid": "3966048d-07b3-4cb2-988a-eb34ec40781e", "comment": "Malware payload (AgentTesla)", "value": "a8fcb2e78cc5e07c1f3b98ebf951a2c896f36755406bd05a4eadd202fd824e5c8184123fe9138b763f47195d345ef312", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445408, "uuid": "10555fb0-2a8a-4b83-b7e2-79dc7fbaf44d", "value": "T13CD4230873A5C831E85E8A7F510783603F65A89E67D1D75E678BBDAE0E3734A4C205E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445408, "uuid": "ef40af0b-8eac-40ee-acf6-b0465b20a8d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445408, "uuid": "a4aa677a-b874-4f97-8b92-e24720b22e2f", "value": "12288:zl1DJiqBFk/7XFSVZ5uRGUrIerz5dXsRyTOgHKbcPHDyX6wKTLzvVhN:z/DceF8zoeztnagqAPHgYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445408, "uuid": "5a7647de-a95f-47d6-8dc1-963d790590dc", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445408, "uuid": "389989e0-db66-48f6-ad98-756cc09a71d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445408, "uuid": "fc60fa1d-9748-4f15-a87f-623c1e66d55c", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358761f6-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401162, "uuid": "b13d6461-ae05-4978-80bf-71bfb01a45ba", "comment": "Malware payload (Mirai)", "value": "f330a5c45a4a5338ee4d0893be1a1e49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401162, "uuid": "1e83b1b6-0729-4fe0-8c7d-e09205e5bea4", "comment": "Malware payload (Mirai)", "value": "45f899d3444ab89f4bd3cbf0395006a2e2e6bd6564482cda183d77dc3e1c22ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401162, "uuid": "6cf32c9b-3693-4be4-a8d2-ddec372cfea8", "comment": "Malware payload (Mirai)", "value": "44932a55ccfb2e348fd5b84db17e71bd63bdb60a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401162, "uuid": "3efdc6fa-5a58-44f2-ad64-2cdb5ef338b4", "comment": "Malware payload (Mirai)", "value": "4ad08e5c9bee0e27adbed02f66d810eb486461241fb4112f326c64a7120bc2064e3fe6ed4a966e5453580c952ef04c90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401162, "uuid": "a80cdfb5-6f76-4cd8-83e3-a0daaecf3399", "value": "T12E63B61A6E628FBDFB59833447B78E21AB5823D527D1D641E25CD6002F6034E681FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401162, "uuid": "d00e50d9-c6a2-4891-9981-93f92d218226", "value": "768:bPWek0n4CjdGQKKWgmg0EhFkFkeYA+QofxXyApGqFDjOZ2uyyQ5NeNTP4wn2IZ:bj/hTmmjAofJym2Uu6eBPZn2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401162, "uuid": "d07cbd04-fbc1-466f-b785-f6bb62ba2de2", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401162, "uuid": "0c392ac8-13f6-44d6-88c4-da8efcde76ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401162, "uuid": "db8b83e2-019b-4212-a2ae-a1e0c41f667e", "value": "mip.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b45ad73-50a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694438108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438108, "uuid": "273c62d0-8fcd-4428-ab58-9490be3146ed", "comment": "Malware payload (Formbook)", "value": "f67866fa8c8bf736f92a676e02c29ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438108, "uuid": "0291eeaa-823f-43cd-99d6-73b58a946a8a", "comment": "Malware payload (Formbook)", "value": "47a47dcae162c91df125b42dcb1ef3a319fcabb043033e47e2c70e68e31e3ba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438108, "uuid": "322af03d-8e80-4d35-8f98-442f2578fbb4", "comment": "Malware payload (Formbook)", "value": "a1a6b9528ab0fa9cca5dbea93d5e8de069d6a031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438108, "uuid": "91e5e7b6-f497-46d7-83e1-1f93c8dd42fc", "comment": "Malware payload (Formbook)", "value": "e25377d0fbaa99180f6954b6f0fcdf85db438e6783a81ac6168b0b268abd9dc1ef6efaed317a146656ab77eb6f45663d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438108, "uuid": "bd34b29c-eed2-43e7-b439-f4b4612c4d84", "value": "T146E4BFF83465E3DEC762C7BF85575C309A137C661236828A723F35988D9DAC78E118B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438108, "uuid": "09eeea38-fe88-4967-992f-c75b066fd5b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438108, "uuid": "bdf1b855-b436-44ba-a4a7-7a1eae83ec09", "value": "12288:CI5fVsbR2k+vTAYQNYcZ60Opy5eaNHuKboL1Z7O61ZFRNKmGnwT9vw+0rU9JjyFu:jtO2lUYQNYcZQIJNbox061rvTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438108, "uuid": "81be96a7-81e3-4b7d-b4be-528cf27b15e0", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438108, "uuid": "b0457899-ec5a-4dcb-8092-6922cdaadc9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438108, "uuid": "065c6367-f401-47d1-a1fa-97ba8e0f2684", "value": "New Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5882beae-508c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694427420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427420, "uuid": "10028657-8d5d-47a3-b6d4-8afa385d2f4d", "comment": "Malware payload (Formbook)", "value": "b444f067b6e84564db815accdf14d6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427420, "uuid": "c7e718e1-d4f8-4fd5-8244-bea469b770ca", "comment": "Malware payload (Formbook)", "value": "49c64577ddf3ce2e1f43c7832736e395b7e205132dd13c42e58be6a769a50832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427420, "uuid": "0c0705ad-c013-420b-851b-0eeb18ee04d3", "comment": "Malware payload (Formbook)", "value": "2aca317851190a6d6ed9a61e3b20db9a879ec8e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427420, "uuid": "a7c8ab2d-8bed-41c3-a5e0-3616d0e33caf", "comment": "Malware payload (Formbook)", "value": "c57cf12cdd25ac381bb9c25a1a8a485f92a7e70c605a77cdc5c176dd848ca49c22a5c0ddef3183afb8875f6276049458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427420, "uuid": "db4ca117-146e-4448-a3db-805f9b2f8199", "value": "T18BD4DFF9656AC3E2D3B193FF509B84719D23BC41607183ED37BD36884DA9A871922D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427420, "uuid": "3a2939f6-03cd-437d-93fa-5302768d1a98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427420, "uuid": "c8379250-420a-4959-90ec-d13efe1d95e4", "value": "12288:r5fVsbR2XSii82GG+qhz95kmbTdSrAC+fzLgb+LE:rtO2iiiP+qhz9OATd8ACwLgb+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427420, "uuid": "c6d2c23e-5375-4cee-b158-c491e3810162", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427420, "uuid": "febffb8a-36e3-4a3a-bf70-db2d7a921f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427420, "uuid": "ef955769-4a3d-456a-b1d5-be8252fafa7a", "value": "Purchase Samples-404995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03913c7-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694424131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424131, "uuid": "6aceca33-fd63-4f3b-87de-1eb5fc85d958", "comment": "Malware payload", "value": "d4b6b223df37a3f3bba35e7838cc01ad", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424131, "uuid": "9aaf6f72-3d55-4e7a-b869-c26ab776d125", "comment": "Malware payload", "value": "4a1097212ada24c34e6a6c373bcb8adb86613ff71e89ecbc831fca512a8a9eac", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424131, "uuid": "27976039-1868-4d8e-af66-5c962eb880cc", "comment": "Malware payload", "value": "66ae09f5557b3d00f913e0dda7e1d83ad434814e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424131, "uuid": "baaa6baf-db86-4da8-9464-c793f59e8b70", "comment": "Malware payload", "value": "51ac46f4c7a6629b2e23547826962049b13c47398bcba8b79021a865bcf47421a7e81059cfd4226b62d354ddf3dfa71a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424131, "uuid": "d37bc4bb-bf5e-4107-a118-67517fbb03ea", "value": "T1D2D4112579841333E4468B3094DFA7E19B299C6C8BB70A431666F6CC2D76BF013B6DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424131, "uuid": "6e266534-fbb9-4a28-b9f2-c62efae2f0b1", "value": "12288:cWx1x5CqHRBHOshDPUnEXGgaohtOWrCGuGhWvbYEd:cWx1xrHLushDMnEVLOyfhWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424131, "uuid": "c26b88e1-e3b3-4f21-974d-65c2259646d7", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424131, "uuid": "45cf9285-429e-4267-a93e-8d3bb990a9c4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424131, "uuid": "5f4a4fae-b665-4cbd-b9e6-d10db72762a5", "value": "GoogleAiv3.5Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aff2526-50ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694455825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455825, "uuid": "af312aad-9f03-4feb-bacb-a4043bb06427", "comment": "Malware payload", "value": "68d9da5d46cacb76d01e18475ae03ad3", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455825, "uuid": "a5022bdb-f0c1-4cd9-8be9-aef3c4981b8b", "comment": "Malware payload", "value": "4a9f42167f399abfbb42a5ee4d52922eb3f7f1ce88d23824f01d13e50609b8b9", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455825, "uuid": "9c6fb23a-e118-4190-811d-4807c52eb0af", "comment": "Malware payload", "value": "1b28a3ed9e3fc9bbf7439d43cc63cf74ccccc6da", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455825, "uuid": "fccb3080-8a04-4cec-9b26-bb9601fece25", "comment": "Malware payload", "value": "52fa66e370a5e834199c70ac7be9398230eb0f94fa7b35b557f72f09006097673ffd3f4dc591d975024d406510229ed3", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455825, "uuid": "a98ce35e-7599-492d-bdaa-4cbabf00d7f6", "value": "T1C055BA342979BC2847E7EE6335F04A550DE505AFE930393B198ED6638A362C125B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455825, "uuid": "69fe106e-75cd-4452-9f05-2a8bd2e6ea16", "value": "3072:VLk+MCO3kASvKpwV7ARnobY3PqggEj3xQBT6Km77R+sc/l9KlT9wk8mgruV:VTMCNAiswVUVoE3P/gEDxQyJZ4ZkyruV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694455825, "uuid": "851e687c-53f7-4884-95c9-321ebb8e799d", "value": 1399232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694455825, "uuid": "ac4c6517-ccbb-4432-b8b3-aff9dc204486", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455825, "uuid": "221ebfe4-7ed9-47a6-b28c-7b468b003dbc", "value": "Start Updater (silent).hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5763c76f-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694401219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401219, "uuid": "5ae9501f-1744-456d-9c98-e1ac5597ffd5", "comment": "Malware payload (RedLineStealer)", "value": "c4947b2855d55e7d4a1f90558d60d84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401219, "uuid": "b7a31c8a-9342-483a-8f50-8926bd1003ac", "comment": "Malware payload (RedLineStealer)", "value": "4b30307e7bca96ec4f15500dc7657b78cb3fa2f3caa3d6d09dc004a6cf46f31f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401219, "uuid": "08407111-5a6c-4325-bd58-4e4864297650", "comment": "Malware payload (RedLineStealer)", "value": "127fe02a8aae4795f35a78024629508b5f495ab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401219, "uuid": "ba559759-6516-45e0-9c50-983ab3a2390e", "comment": "Malware payload (RedLineStealer)", "value": "4f57811d5e2d92f51fa82c66cd4f75834d336fd40dc3bf2062b0b8cae1f1d80c2a53854d0b2390939b3bb7ca30a25aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401219, "uuid": "664cb508-4732-48ac-ab99-ed81f989bd42", "value": "T18E6523E4B8E18473C873103239E5A6B26D3D75724B241E9B4B700B7EAF353D19A27B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401219, "uuid": "a24b3659-b882-42ff-b4c4-c873f41f481e", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401219, "uuid": "1bcb67c9-641e-4e1d-a534-abe31391aef2", "value": "24576:G5fCJL22PrYt1nqSaCS5z3Tug8TlE11xnEBpau5TzEF/Nu1Hg:efCJ1PrxSfYz3qC1xnEiudzEi1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401219, "uuid": "051b2257-d450-4a0c-8a34-54317adab3bd", "value": 1471864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401219, "uuid": "fedc9920-cbf5-414e-bd8f-2b11ec2d9d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401219, "uuid": "c33839b0-e55a-472a-ac75-a47bbf535348", "value": "c4947b2855d55e7d4a1f90558d60d84d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2f366c-50a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694437843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437843, "uuid": "bfaee2b1-750e-4e3a-bb5d-32c0ad270642", "comment": "Malware payload (RemcosRAT)", "value": "eb37d6898e22d80d4259625b69e378c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437843, "uuid": "4bd1a858-beb6-4ee0-832b-b2a451124c0d", "comment": "Malware payload (RemcosRAT)", "value": "4b9f29bc2d08bc00b6485aa562f5d0f060ccc8ba85c7b008fc73213089c995c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437843, "uuid": "f13aa783-6db1-44e0-9d90-0943b447dbfa", "comment": "Malware payload (RemcosRAT)", "value": "48d052a12e7a9a76dc8b77ab01a6ae78337378d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437843, "uuid": "e48d1461-2ed2-49b5-aae6-ba7558e176cb", "comment": "Malware payload (RemcosRAT)", "value": "be5d28ae49b2bf8c6a7179313d295a1b0d676e167e2a83fb9577a6fe640a7fecf3642a4dbbcb452a335db96620e0f4a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437843, "uuid": "71d9a3c9-08b3-429e-aeea-6c172a46fbcc", "value": "T148050152B600A582CC38A7B0D9279EA71673AF786D608D5332B57F3DDE772538D1320A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437843, "uuid": "dde13cb8-bc0e-4641-842e-c2045aabf070", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437843, "uuid": "304ca86c-329b-47aa-be2a-8afbaa49f8e8", "value": "12288:h5GdGIdeORq3eur2fK9DlPuDoBnVMhfQBTPfz6bIATCAXaeLqxqwnNyBZbp:M9rg3v2f+lWDkmFQ9PfGUATCAtingjbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437843, "uuid": "bbf10be4-9fa6-4c22-a757-023fa941071e", "value": 798096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437843, "uuid": "ddf6440a-bff3-4722-94e6-624105253dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437843, "uuid": "4c096d91-146f-4e2f-8377-f1d19a7915a9", "value": "VLLC2023-0135 Procurment CJSC05.09.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ca56c9-50c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694449821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449821, "uuid": "cafa9426-9e9e-43da-98ba-53caabae8b60", "comment": "Malware payload (RecordBreaker)", "value": "19f10e2e9a53bdb517c85504cdf852cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449821, "uuid": "12ae9de4-24cc-427d-becd-d9ad860074da", "comment": "Malware payload (RecordBreaker)", "value": "4bdfd777b579da177959f5854c16f8201e1501e0cf9394f4cfef13cd999fb9d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449821, "uuid": "ec660a59-090c-46e6-8bbd-da2e1d980eb3", "comment": "Malware payload (RecordBreaker)", "value": "0572a47dd5763759318fc4fcb5ef49ef2889f6fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449821, "uuid": "ffa04694-ebc9-45f3-95da-195097ed8438", "comment": "Malware payload (RecordBreaker)", "value": "9c15506db7ba99ae91aed47b6c892d297749844bc5ef5eb857bd8ebecac6b75918aec84de7953b1d0a2ec4457e26fac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449821, "uuid": "db4852db-ab2d-458f-970b-b8db4da16a1f", "value": "T198545BD393A07CA0E5274A319E2EC6E4361EF9604F1977AEE218BA2F05BC1F1D172355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449821, "uuid": "a9f4e692-6c5e-498f-beca-faac48b80c3d", "value": "9510dea81cc5ce11a4de430720afcd42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449821, "uuid": "26f596b5-9b93-4d18-8d30-1702bc4881be", "value": "3072:tc8qG2WH8oo8gVIiGuevd5PY3AWt9TtIIDeREO0QJqyFmD/0CoVPR:3NYoo8gWik+1tjQmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694449821, "uuid": "a0062784-7d2c-4e75-99a3-7f5ae6df8195", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694449821, "uuid": "ccf921b0-c262-4269-a546-190fecbb9377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449821, "uuid": "d30d384e-f4c5-4feb-a4bc-34ea87740e31", "value": "19f10e2e9a53bdb517c85504cdf852cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebd517c-507b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694420129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420129, "uuid": "7c7685a9-8e41-4151-93ff-89826cf777a9", "comment": "Malware payload (Loki)", "value": "2695e8c8c5efeabb7578b494561b5515", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420129, "uuid": "19e84fa0-d8d1-49c1-956d-317bce8b05b8", "comment": "Malware payload (Loki)", "value": "4c04d6943bec03568369ec17963a7bf72be83f70f1301f60d2a4c7a09a54f767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420129, "uuid": "38f6c687-70a0-4d88-b784-6e4971ef07a5", "comment": "Malware payload (Loki)", "value": "fc95058f73dadc48efbc37ad3e2153e0052b99ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420129, "uuid": "979891d7-0dd7-4334-8bc1-db7c780bcbae", "comment": "Malware payload (Loki)", "value": "48d87d68bb74780100f6eb07fa4e7da1975d09ad4891d807fa3d64d10d9a12c0d339f6796060d7d0cbe95103f7c648f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420129, "uuid": "c8a871cb-d833-49e1-a27c-061a0cb53a2a", "value": "T118548D9C321077DFC857D572DEA86EA4EB5074BB431B4243A02716ADEA0D99BCF250F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420129, "uuid": "a0aee500-83c9-4e9d-8726-fc1c84e4af6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420129, "uuid": "0c205d8f-b84f-40cf-8282-7d4d2e7caf21", "value": "6144:kQ3XHcXqveLqEvZckwPu+h/otudNhkT77mBIY+/nAjzoOGdSFKX8ZdmI:kQSq8NHOu8SMpPoOGdSFKX8Zd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694420129, "uuid": "d5ea2ff8-daa8-4b07-9b21-444123b43b4f", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694420129, "uuid": "9befc390-ac79-4adb-b2fe-96e0f429958f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420129, "uuid": "691eccfb-592a-4f21-930d-61fb9407f891", "value": "2695e8c8c5efeabb7578b494561b5515.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d4409e-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395505, "uuid": "29029e61-8d91-4ba4-9f50-6e2b661248b5", "comment": "Malware payload (Mirai)", "value": "03377254f3b3fddb4b4a2b0973f88267", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395505, "uuid": "043ebc40-79ea-44ed-bcf4-5df5373a97c9", "comment": "Malware payload (Mirai)", "value": "4c63ea17c4c69262afef2470c6296654ccb5b860c1336fc875222f91c0b18e6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395505, "uuid": "6f5f04d1-9799-448b-848d-1bea98fc16ae", "comment": "Malware payload (Mirai)", "value": "3f52b377d19603220481a434826a6b6ce137bad6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395505, "uuid": "bdf9ea1f-551d-4e78-b74e-d054a7598b4b", "comment": "Malware payload (Mirai)", "value": "3a7bc1ed85cc600fe396564c2a0925b8c08b56da8225af17e90c20e19c48adbdf66a0c166ce3c7e75a9d6cd3edec03ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395505, "uuid": "0fdd0382-3831-43dc-984a-912024ad23a2", "value": "T11CB3F845FC509B17C6C222B7FB4E428D7B2A1768D3EE72039D256F65378B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395505, "uuid": "55abbed2-b2cb-47d9-8586-04c85b93a558", "value": "1536:0hEOK0LZyFi19AJVm4VemhTTrVsqUiks1b9tAL0lEfwywqFWiRi9hH73W3ODl+:0hZ4Q19l4Fh/rVsqtb96u7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395505, "uuid": "d3240c6e-14c5-4b10-ab0a-c0184a4ce8de", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395505, "uuid": "b4e2ac17-c772-4d50-aef4-2caab7df0a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395505, "uuid": "90bf5e75-a761-45ec-ab0d-9c3faafb221c", "value": "cundi.arm5-20230911-0125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1f385f-5063-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694409924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409924, "uuid": "6d6621d7-aaf2-4bb5-afe1-052428ddc7eb", "comment": "Malware payload (RedLineStealer)", "value": "2b498b3902d5116128b410a3ed895559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409924, "uuid": "3e58ada5-1f33-4f30-9222-36a6d7cb6d89", "comment": "Malware payload (RedLineStealer)", "value": "4f5949d4f29acac886fc57e87649c031edcb2e0b675fd9537b5e3fc736b93edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409924, "uuid": "04738516-41b1-4f2b-b1da-855804cdcc2b", "comment": "Malware payload (RedLineStealer)", "value": "c3eb741abfc77173d465d1eb06f1d9ef79df6efc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409924, "uuid": "1b7ea62c-5aec-4c0b-a952-1702fbeec94e", "comment": "Malware payload (RedLineStealer)", "value": "381d8814e5bc82b38a25ea5b7f4badacdf7cbc01a8b10f5827b4520a274088c24d1593fcbc346731d732c5a08363aa79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409924, "uuid": "7b8c965c-b1c4-4aa3-be2f-aaa439c45c3b", "value": "T108845B2074818825F8B64EF37DECFD32F83D27251E9D456B03510AEEAA5C3A05EEC965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409924, "uuid": "428f9aa5-6308-4cbe-b2a4-7350ffb1a07f", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409924, "uuid": "bd005075-d32f-4646-b01e-789c1eb69daa", "value": "6144:4AtRVdU5tKqCVkYdkEktqoigAOzbCB4UM6R3czV2vcD3iLHrBi:4D5tHCOPfVXUM6R3sVUCurBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694409924, "uuid": "18305f92-ca25-42f3-9dd9-ef8dcf7b3bd8", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694409924, "uuid": "07ebd120-2bc1-4223-81cc-a3b139571b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409924, "uuid": "99003315-30cb-4815-a0b4-0881dd7b2b83", "value": "2b498b3902d5116128b410a3ed895559.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd78b24-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694445359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445359, "uuid": "ce765c2c-ae8e-46e3-ac7d-32588cbb3a1e", "comment": "Malware payload", "value": "badae80404f07b411be1970919dbd258", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445359, "uuid": "a15a6ca3-7069-43b0-bf16-e0c24ac7a6f2", "comment": "Malware payload", "value": "4fd9f4f89554e9539a3727e82c11beb21f39e7eff1699107a366017cbed1bfa9", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445359, "uuid": "e603c99b-04f9-4a32-9b58-eae874d48071", "comment": "Malware payload", "value": "9115040d3a3d2b6d7c08b4b458ed7f02f1e91642", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445359, "uuid": "5af156ae-6829-4368-8ccd-f1043b189c34", "comment": "Malware payload", "value": "9ad310900b21fc17585dd3c451fb895f8301c7e1e79677354b288c41f9f1792ef6f0b60ba5928ec1353e24983cd59cca", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445359, "uuid": "9ba254e2-5b71-4dc3-be4d-a365f9d8f3ce", "value": "T109D59D05F605CA2BC39C1A32189AE7F623B93C0A9E854557720D732E3FB7E54DA5630E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445359, "uuid": "ede3a5b4-e94b-45ad-9e5d-03e09113f543", "value": "49152:LLBzx6ySyWxwqZGlTc4lLW5Z8hC/Om1WbilKIt9iVCpG:Fx7S5wKGlTc4lS5ZF/2SKIt9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445359, "uuid": "4269802f-fbba-48dd-830c-7ed047407470", "value": 2937344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445359, "uuid": "6c5b38f2-b055-4fc6-8a48-b46450307a19", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445359, "uuid": "578d74bb-1ef8-4be8-b8c1-67e261ad4f5b", "value": "11092023 IT2C_Body_Corporate_Return_XLS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ef4d54-5099-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694433110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433110, "uuid": "d76b97d6-316f-4c83-bb5e-c307034046aa", "comment": "Malware payload (AgentTesla)", "value": "2152c512f8e21fd800322dcb9cb892e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433110, "uuid": "b50dfcae-839e-4dbc-9cef-b288013c5bf7", "comment": "Malware payload (AgentTesla)", "value": "4ffdc291532f5d4d2960372a807b3215c9486d6fb643d09c64fc2ecf23cb31d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433110, "uuid": "268595ef-7c8c-4d96-afb9-4ad52405f7f4", "comment": "Malware payload (AgentTesla)", "value": "d5b26a18463e8ae6ce2898859d0cf00acef73df8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433110, "uuid": "a7041478-6a62-42bf-b923-bf50bcc194b9", "comment": "Malware payload (AgentTesla)", "value": "0db6b662923a0d023c2c28268ce4c4a853f684b59489b0ff9d3ee16baf938fcecdcfcf26f75da6662360e48ab3baec05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433110, "uuid": "44423de4-a385-4129-bc21-297c157457a0", "value": "T1CDC41218337D8B32EA5D8BFED852422007FB685F0105EF5A0EC9E8F76B63B054641A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433110, "uuid": "6ccda57a-5795-4b50-9f34-68e6353e71ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433110, "uuid": "5296ee58-439b-4b71-b5db-c2f10013b8d7", "value": "12288:sE1DPoUTST8nt++p9tv0+8bd0exwusksEOeFf2oh:sMDoEKh0exwbof2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694433110, "uuid": "26c59281-c9f8-480f-b623-db15efce0733", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694433110, "uuid": "9beea949-2d93-413d-bbcc-8d7607bbd121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433110, "uuid": "1c2844ab-a92a-46b1-bc3c-8f8131913777", "value": "rSWIFTCOPY.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a42c28c-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450186, "uuid": "3e18e91a-86ac-4197-a0f9-21e64eb399a7", "comment": "Malware payload (Mirai)", "value": "7a95d1646aa320e6fe16068ddc4dbd03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450186, "uuid": "5af9134b-69de-461b-b800-54d29d604fe2", "comment": "Malware payload (Mirai)", "value": "51678c6b8d8cbaff558b77c2866c906de9c0484bedd83e2500545c2b0f8f206b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450186, "uuid": "beec5b33-c5d5-4f0d-bd1d-0eab49327c7d", "comment": "Malware payload (Mirai)", "value": "ace16ed166436b63fe696b7ad437f8a311c09e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450186, "uuid": "1b90b05d-3bf0-4e63-990e-4305e3225532", "comment": "Malware payload (Mirai)", "value": "491f4f3b20958b7f6df2a684f88e47bd2960e379b75a92de075960f8444973711fc840a8e1a4509576fd970f1bda4918", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450186, "uuid": "4e3c1110-9549-4eb6-8d2f-b456c9065b3f", "value": "T19CB31937A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450186, "uuid": "85ca2b8d-512d-4735-bad9-30c84c143c41", "value": "3072:pC/4rdZHsXsZwwR9lNk5mm/QcuLmHniPNb:pCwrvHwsZwY9lOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450186, "uuid": "a01661ad-9f15-4c6d-acdf-fd930f6cf7c9", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450186, "uuid": "6f44fd24-51a9-4d5c-80b5-a99a63f1f2db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450186, "uuid": "5e0789e0-1cf8-4d58-af92-edba9e08f563", "value": "7a95d1646aa320e6fe16068ddc4dbd03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de083a7b-50aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694440529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440529, "uuid": "dd7d4ffa-4cfa-4ca1-97ca-6f8c14e8437e", "comment": "Malware payload (Amadey)", "value": "d2cb80fba8fd8cd73831d83a221aa5a0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440529, "uuid": "4f71469f-25cf-44f2-b5b8-2bb3409ee021", "comment": "Malware payload (Amadey)", "value": "52461ae449d3e9ec9524b957282d52c1f8427219ede7e58432c7b28587ddf213", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440529, "uuid": "7b393bcf-d7e5-4be7-b096-e78cea9ee14c", "comment": "Malware payload (Amadey)", "value": "27d045387e8fcdb3aeb58f9749a5e7cd80c6c6ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440529, "uuid": "a478456f-d984-4741-8ea3-5814dcabcde5", "comment": "Malware payload (Amadey)", "value": "465b9e7e331a13786e405ba67c0871f0893dd07ca4276a50aa589a80beb3e49656a70f6ef681aa54e3fc4bb8cbfa4a01", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440529, "uuid": "b5b4a700-8ddd-4c2b-ac32-7c6f32c16e2a", "value": "T1B5549C0170D1C032D5E3053709A4D7F95A7FB9210B658AEBA7E41B7EEF302C19A39697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440529, "uuid": "21402905-b732-41f5-9563-00743b3c2920", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440529, "uuid": "bfb82a76-b274-4669-9623-67944edf44b1", "value": "6144:S0Ia2/KMiCQy4bwSjQzL9ois436xMhAOHb7ye0D7:Sc2SMiu4Ms436xMh1bH0D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694440529, "uuid": "3ccf9d93-a8a7-4345-a6ea-c9f3bfb18b00", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694440529, "uuid": "e0d47477-65dc-46f0-a1f4-869b99120c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440529, "uuid": "823c67f0-780b-4705-a739-92271de8c5c7", "value": "d2cb80fba8fd8cd73831d83a221aa5a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00be3edd-5068-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694411811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411811, "uuid": "a14f2020-118d-4b07-a7c1-79b24d562efd", "comment": "Malware payload", "value": "ea9d9b21478be5611a92ca66809103fd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411811, "uuid": "c96abddb-4ce3-491f-a978-fd751e4dd8f8", "comment": "Malware payload", "value": "52f6125b0ffe40b189f9bf5a19452aed93ec2f6aac3143a9d7fae7bab92f62e1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411811, "uuid": "b11728f5-1db6-421e-b6fc-0a85dedce62e", "comment": "Malware payload", "value": "0e7b8b89562d9e2836e6dc96b7f14921443dd17d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411811, "uuid": "02145ead-0286-4cfa-bba7-b978e68b7290", "comment": "Malware payload", "value": "e2836bcfcf0659819a1959d3506f84fffa519e809afe3850a4f6d352fc37bd1e0ddb66f4ffe91796c6f198111c408f2c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411811, "uuid": "d4b09134-fb1b-43da-919c-6243a2a2c929", "value": "T1E022AEB2892E0122EA13493E0D5B4BAD482C9C0B410D9A2A6C0A7D600BBFB11FB735A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411811, "uuid": "0a7e9094-5e33-4bfa-a2c3-2b105b38e826", "value": "192:0Lt7+5NeSgIiUyDcBGV2F5LZTWXPT5Tio3/1/2c9n1KxGH:0LtdSgIvyDb2F5NMR39/2WUGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694411811, "uuid": "b325863f-ed5c-4b91-aa3e-b7cf488b0d29", "value": 10241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694411811, "uuid": "64fdc400-14cb-4849-a097-8f4cfb2bc3a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411811, "uuid": "27a79d83-2a7e-439f-b5b9-31978921c4f5", "value": "test_8484.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e64a6c8-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424772, "uuid": "be5177cd-dd2a-4ca1-8d77-36ca5cf94c37", "comment": "Malware payload (Mirai)", "value": "ef3005ef1b733e32494e51640634f0ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424772, "uuid": "e452dc8a-4a30-422a-a015-0f3536cbc732", "comment": "Malware payload (Mirai)", "value": "531e047288514b0a96eb4b554d1a50a8009a824e1c349084dff6b9d1589204d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424772, "uuid": "3c826e89-151b-45e6-87a5-1ad63c97a355", "comment": "Malware payload (Mirai)", "value": "ca1416675176bd7d96339acd971f85d63e31f9f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424772, "uuid": "8d066c43-d9bc-4926-81d0-5d99c2ba5f61", "comment": "Malware payload (Mirai)", "value": "db3b30ba3bd0e7f37c8703cc2e30f481f2f34edf61b7b2c7dd6c3a925d28250d044abfddad838cdfae6ec14320989389", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424772, "uuid": "b6ead6fa-edaf-4c7f-90d8-8b8d90a5ff03", "value": "T1C1E2E1724333A5A1D941DF3ED06845856568D97FA06DB6530398C2EC3AC6080BEFBDD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424772, "uuid": "ac207999-65f5-4ed1-9159-ee9262ae8af2", "value": "768:LBXtpJ/LnGwJA7QmOBPYlDRS1pJP42CrhRLLsK5zvG9q3UEL+k:LfLGOug1PP4XRLvxzLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424772, "uuid": "6c998ae0-a739-42ac-8d5a-09c328f8dc97", "value": 33588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424772, "uuid": "f2d6113b-2a10-43e5-bc5a-2489f8a62583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424772, "uuid": "12a47e25-3fed-436b-adb6-091949d87288", "value": "ef3005ef1b733e32494e51640634f0ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8b2acf-5076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694417876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417876, "uuid": "a0c68beb-3aa6-458f-bd35-643979acfaf3", "comment": "Malware payload (Loki)", "value": "c2a4bba984bd92f0b97fc59f6dd900d8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417876, "uuid": "3214bee9-415e-49a8-b35c-da3cc3be069c", "comment": "Malware payload (Loki)", "value": "536d7b872be35b97d8402d522f4d282235aefdcd2c110aa624383bc0a51af6c5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417876, "uuid": "aa6e9246-ce47-48aa-82a9-96458884704e", "comment": "Malware payload (Loki)", "value": "ffdb426e2e8946115d150266f1a8bb073ed87a96", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417876, "uuid": "7ee70935-fb26-4ce7-a36d-e7f86c634f42", "comment": "Malware payload (Loki)", "value": "ec3d129ed7fe463bf646537d598816583de51a95730e8c73acf1c27165bc151abec177c0fc3b03a5eeaac4faf9456678", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417876, "uuid": "28c11f41-e4fa-4eaf-b6c3-805fb079290e", "value": "T1CEB423CDD447C6CF890BB8E91DBE9CA1257C0588D626D04D568D43F392EEC5C2CAF258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417876, "uuid": "3979c0de-a009-4760-9ac3-890694f039d6", "value": "12288:0Tsp5J/E+wLYfmeSI9ONFQNVN2S8Mx1wtWtFxTzFVkwJZrZuW:0Tjs3S4CQNHL8Mx1wgtzrlrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417876, "uuid": "977597ce-7d6f-4416-b9d6-a4d91d0a1f4b", "value": 504950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417876, "uuid": "f6ee048e-2868-4fe6-a4a0-5c20946fd039", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417876, "uuid": "4b00d2b1-516e-43f8-aab5-2b4138a41b14", "value": "Order Confirmation 004172019Sep order_00417.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1538b357-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694445346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445346, "uuid": "1aa7173b-09bc-4f44-b841-8dea582a6c3b", "comment": "Malware payload (AgentTesla)", "value": "97d8035e565af3f757cb9a5825087218", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445346, "uuid": "e2deedd4-7ee6-411d-ba40-8f107ff59ef3", "comment": "Malware payload (AgentTesla)", "value": "538362363e52ddd9a2106a1672a9912693e206691a9c4e8b0f37cf62a19ea5c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445346, "uuid": "5b04d034-6ebc-43f0-be33-5b6d60498596", "comment": "Malware payload (AgentTesla)", "value": "7f23d4b93a4ba80d81448c51a94908cfa2de6db4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445346, "uuid": "5dcd51cc-851a-45d9-9200-b0d45ebaf822", "comment": "Malware payload (AgentTesla)", "value": "df766a6f618ae488ec223a97fbae2a567b0ea85a18b267119a06d957b810c2ca7e8708fc36c60e93174417bf0f94c2c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445346, "uuid": "92f2170c-bb10-45b2-9cd2-06e21f7c17d5", "value": "T1DCC4231A916B8732CB5FCFB128130725A3EC697E31E8AB5D5A0F7CA09D63746413D683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445346, "uuid": "6352fd15-5b6d-4c1a-b391-0f028d9eba7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445346, "uuid": "52e2179d-99a5-4193-b4af-6ba37dbd5450", "value": "12288:OS1DbGk7ZQsVpR01k92bUNJ8mA9IPtqoDQfTFpERA7svO1ox:O2DbCsnsc2ajko4FpEEs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445346, "uuid": "8e2ccf1a-0bf8-4cf0-81e4-054b6d0c9efa", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445346, "uuid": "fd0e7baf-3dec-4921-a754-488f216cebc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445346, "uuid": "8c3e33e0-b77b-4098-af8d-774138538e7c", "value": "payment invoice (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce39e4b6-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424182, "uuid": "d5a9db1e-f4c2-4302-b727-3a8180fc9786", "comment": "Malware payload (AgentTesla)", "value": "244d43fc5ee056f4e152e3d6718b0a9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424182, "uuid": "4b39adff-7b2b-47b5-bcf9-a513750dbffc", "comment": "Malware payload (AgentTesla)", "value": "547ef38e3cb8d7e87dd274ab818ebe3d52f2054dde4aaab7c51e5aa3780d0c1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424182, "uuid": "26ec2c08-7d40-49e1-91d0-cfaeb53d5611", "comment": "Malware payload (AgentTesla)", "value": "818dfcc801d5dafef58c8c473c95108b210e57a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424182, "uuid": "e717ac23-b08f-4f0a-a3c8-0c7f68879b82", "comment": "Malware payload (AgentTesla)", "value": "85c195ef41b85ec7cc630bcfbe2a720d0597b2a69fa55d60c69cea7e3f01b865a70b3fb3ee4c22053a135e6945b227bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424182, "uuid": "a54c535b-97ff-4d1c-9023-d49349c19826", "value": "T140156DD1F1508C9AED6B09F2BD2BA93024977E9C94A4410C569DBB1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424182, "uuid": "31e0ca74-9cca-4864-924e-43eda4d73ca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424182, "uuid": "63933694-7038-4bc5-8d12-20931cfaade6", "value": "12288:p2iNZ1DTS4awa/R1Sr29X6ml8903GYZs3737ko5MhVCHtXcwhLUrf8V4K:p1pDWD1fF6ml890WYZo7kehtsgwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424182, "uuid": "722c915c-6939-4fd8-ba06-aa37d6d61d18", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424182, "uuid": "e611b52f-23b3-4d9f-abeb-6ab7327f207e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424182, "uuid": "dfa83fa5-8644-4576-84cd-f41b7cfde4db", "value": "G\u00f6nderilen \u00f6demeyi onaylay\u0131n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e9b032-50ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694441272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441272, "uuid": "f0113c85-45c1-41cd-8338-0d56c54902af", "comment": "Malware payload (AgentTesla)", "value": "6f006ca3e69786dcc6f07fa442798015", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441272, "uuid": "2eca58bd-1a7f-4b51-b746-02f147ff5fac", "comment": "Malware payload (AgentTesla)", "value": "548a3e7179aac38f2eeda974832cfe5f2a7b434749b06d404d4ab0791941c652", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441272, "uuid": "ba260b03-73d3-4f5c-ac50-6f4ffb407ecd", "comment": "Malware payload (AgentTesla)", "value": "450b9959c25e46c7cdebc2b5bef1fbd287a5cf19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441272, "uuid": "1f35f71f-195a-4a88-8a0f-562bf3edf6a7", "comment": "Malware payload (AgentTesla)", "value": "9f3be5adedbedbe6e1997a6b1a37bd69ae619831c90bcea44cd91a2ca9a801898d6830b053fbcbc0f5ef9dd9d04736c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441272, "uuid": "cd972f33-05ef-49aa-bee2-bd42e1ef0a1a", "value": "T1BEB423694F359E1FB907C96352B52F4E4D0C89ED8ABFBED3E7CBD15EA0162960012704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441272, "uuid": "1a650a1c-4da0-45eb-a2d2-670b82a5a557", "value": "12288:eXl1g1Ag04GiBBqxVVNjBldxH27oxB1gXd+0Fq+:4kU8kDXHYcB8nFq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694441272, "uuid": "a9f2dda6-32b4-43f9-9f5e-5d8b03d94fe8", "value": 518961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694441272, "uuid": "0d8f2e48-4d2e-437d-b2db-1583fcec0a94", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441272, "uuid": "e8adb430-0e70-4b99-b755-5d79111e5e70", "value": "Invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48390785-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450156, "uuid": "b08701d5-6eb1-42c8-bd7e-ccac0d246781", "comment": "Malware payload (Mirai)", "value": "d952811936376971d4a0d849cef974c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450156, "uuid": "579a5acd-79ca-4640-bb2e-3edf10ec4474", "comment": "Malware payload (Mirai)", "value": "552bfed179f8a149ccd4f8312fc476997c6b0e557310589aa5d6f5c13daac2db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450156, "uuid": "01a66207-7eae-4f5c-9400-232339b2d512", "comment": "Malware payload (Mirai)", "value": "d4b47486bfd12c643cd05efff88c56e91f2fb08e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450156, "uuid": "d92084f9-4ff9-4af8-b699-00bbb08ac098", "comment": "Malware payload (Mirai)", "value": "65a3223cff76a83cbd75429695500ee405012a21e9f55959bfe74aa9314352dc0be4bda7b104f56a10fa12f3103d31eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450156, "uuid": "9138eb03-1a24-4604-bc85-d66112b13056", "value": "T1F5A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450156, "uuid": "52cb4cfa-8ae2-4d47-87bf-2ccddda75dde", "value": "3072:VK1z13U6HzHoXRtmTUhQogZEmmFVcqq0GnDZT:VK7DDeKlogZEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450156, "uuid": "613db843-83cd-4f20-bfd2-c9f4f75331f5", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450156, "uuid": "cac49b69-0935-4d1c-94ac-d99f707a8efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450156, "uuid": "9ca60660-8fba-40c4-9aed-335b583093a0", "value": "d952811936376971d4a0d849cef974c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fedabc9-50a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694436371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436371, "uuid": "570f1a9f-b2a4-4be1-949d-827b007aef28", "comment": "Malware payload (AgentTesla)", "value": "43ee896fc78fea2052fd88827d53032b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436371, "uuid": "5c05c7f8-b5e7-41a9-9ddd-579da4e96bc6", "comment": "Malware payload (AgentTesla)", "value": "55604511c1d164e099a8d68a56de209ebe785d76313ce68504496115a7d47740", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436371, "uuid": "c56e9bcd-77d3-41b2-91c1-d57a65459385", "comment": "Malware payload (AgentTesla)", "value": "a736c1a3b32c869ae610d5803837bd327594e455", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436371, "uuid": "e199aa5a-77d2-401f-9b3c-29cc6f6d795c", "comment": "Malware payload (AgentTesla)", "value": "13dd9bd25bfd8fdc0643226c0ee226c391e0043638775dd271b7d98075d8a73136a1867124849c2eab4cd7c5e58913f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436371, "uuid": "fb01e9f4-236d-4a0d-b8b4-2ec660e692e8", "value": "T12355A1B9E210E8D1E03A0D3DEDD101AC822495F5DEBF915329BF338D6CB144A6959FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436371, "uuid": "afcadb46-d9fe-4db0-b32c-ef5ac17e242e", "value": "24576:kp9Wip9WKaVilZairTZ0U+p9VPB4fJYOWG:QWaWKaVjG1gPBSJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694436371, "uuid": "2faa74b7-15ee-4732-9345-cdd53e808069", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694436371, "uuid": "8afe86bd-35d9-4964-b139-8442bde63ea2", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436371, "uuid": "76cfd490-eef8-45b6-8663-7444e99fb658", "value": "Invoice_API22104567096546.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efa47b3-5073-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694416774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416774, "uuid": "881873af-b472-4951-8821-6b471fa1e1dc", "comment": "Malware payload", "value": "ae1b8d8eee78a569a9dd8e70f9852086", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416774, "uuid": "cf5a6e9e-b952-42c9-8853-f1524a4b0ac0", "comment": "Malware payload", "value": "5642fc3dcf35643a38101d36678e09e9f706df94cafe2dafdf44a7e2965bd296", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416774, "uuid": "dda950e0-f1bc-4e54-9184-73f61473e7e0", "comment": "Malware payload", "value": "70aef9ca7d0fcee126c56a365fb356ada27f9f47", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416774, "uuid": "7ced7276-8001-4ec3-9b91-d8fd0989c05f", "comment": "Malware payload", "value": "0d2e35a067b9a97d3b882652e078b9a7c689f336b32bc2a62b639864eddb291cea41ea8a28e1249873545b71ce096213", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416774, "uuid": "812895fd-c249-44ac-9338-d4b6b3dd5352", "value": "T1EA165C21B146C82BDD6303B11A3D9A9B5429BE750BB154CFB2CC3E2E5BB75C21236E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416774, "uuid": "2c9ddb16-eb7b-4caf-882c-6a8871feabdb", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416774, "uuid": "f1201530-1ffe-4ac9-b6ae-c064147c6a9f", "value": "49152:DWtfl3xiDZjSPQaLOpU0dpBYYZFfsqWGXwuO6Bpp5+TRXYpnF4tk11zppI04zmH6:Ktfl0kYax0dMiNsqWGXwtyyTRl1+F+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416774, "uuid": "535c5f9d-3f64-4d55-8291-7898bd02d5c1", "value": 4416612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416774, "uuid": "eff27f4a-eb4f-45e1-82bb-c0edfed0eaf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416774, "uuid": "48e1b58a-3931-4806-93a2-085dedbac3f9", "value": "5642fc3dcf35643a38101d36678e09e9f706df94cafe2dafdf44a7e2965bd296.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd1f99f-5058-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694405072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405072, "uuid": "11af460b-7d73-44a4-87b6-c3f8b8c35860", "comment": "Malware payload (Mirai)", "value": "481253fbdb62b3b04d048975c572933f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405072, "uuid": "ac0d0e3d-0d32-4ca0-8609-ec38fcf239e3", "comment": "Malware payload (Mirai)", "value": "5658ec061458e0c27c44e5dee0766595c3b795d3c8e76f78bb2a91e9a72df9ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405072, "uuid": "3b08281a-cbbc-42f8-a812-fb12810f3a65", "comment": "Malware payload (Mirai)", "value": "6b7a7d57f6d40bf7536224b0de5704af0e1ca0a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405072, "uuid": "18052e82-61c5-4f84-97e8-e18074e1a8cc", "comment": "Malware payload (Mirai)", "value": "db683e655719cf1164611cd436706063dcac934d906e1a0383894c393052efe0dad12f4be4453872947234f0c8e0d0bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405072, "uuid": "705b16d2-c9ce-4f42-891f-1e8fd5a6b14a", "value": "T1D4336A77E45A5E94C086417075249F351F23B2C893932EBB16EAC2755483EACF509FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405072, "uuid": "f67fc35a-637b-4878-b73b-c7943f2a4418", "value": "1536:8aWjW/cXGET6WtZqKAlSW4UBOCVQV5nC:8pjWuGEbZtAuUBOV5nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694405072, "uuid": "225a0003-9f73-4228-9480-17a0d4279ff5", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694405072, "uuid": "7b92e6de-4ec9-4ba9-9c0e-68868fbf958d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405072, "uuid": "1a1c7039-c19a-461e-9e87-f10fdce76778", "value": "481253fbdb62b3b04d048975c572933f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f87f322-507e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694421312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421312, "uuid": "f8fe4da2-6633-4295-81d1-8b31d2d579bc", "comment": "Malware payload", "value": "c39862ff74e0ee5bf16aacdad3f891b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421312, "uuid": "bdfa468e-766b-4e90-88c6-8878601effaa", "comment": "Malware payload", "value": "56adaaf0de157fa8b026b07494393bffd8673c044cedc997e14bdc9d6412a16e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421312, "uuid": "db8516f4-2373-4d6c-9627-86c0ade00c62", "comment": "Malware payload", "value": "496502e25b7e26f9e0d296ad6a5f0ccd01c28b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421312, "uuid": "70cf9f03-ed22-4f61-b1f4-c959e022d6e0", "comment": "Malware payload", "value": "3b8ab7cf46be0d880ec995c20ffd2978a3dd02d22a51458366034a179c9e0670504176fd7e2a52bce27ca2e3024db754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421312, "uuid": "d268b566-2b70-4a28-8405-4979a4d32d35", "value": "T1177518634091B59BF20E96F29AFF871B3C5670B6A3517C014020BF946E99E70DF36A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421312, "uuid": "2aa28514-ea2d-416e-8372-0917c440985e", "value": "16f07df69098ae721b22f9b77f303c08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421312, "uuid": "8d709c65-e7cf-4ca7-a0a8-32bf366d51ba", "value": "24576:m8JMosFFyvuXjANEoAK3HUufXz/9tz7lwC6Nn:54FyvuUd3H9fj/9V7n6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694421312, "uuid": "33b1c77c-d07b-4a40-9415-27f752da5b26", "value": 1623784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694421312, "uuid": "6a4a9b0a-c763-4cc6-bdc9-5604a0d2415e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421312, "uuid": "e1292631-11a5-4b49-ab34-5b5eb42741b3", "value": "SecuriteInfo.com.Trojan.PWS.Steam.36450.17629.30473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab16e12-505e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694407774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407774, "uuid": "f99c9cd5-f381-4d72-bc4b-53d8bb921559", "comment": "Malware payload (Stealc)", "value": "78851a1c0aab614459b9cefcb02ae832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407774, "uuid": "e7f6c1b1-c559-4771-92e1-8ae19c6eb3e4", "comment": "Malware payload (Stealc)", "value": "56b20f8eebb0f9ecdd8be61665112fd3ff75d97c037e45bbe1ce74b9d382882f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407774, "uuid": "04290c01-61bd-452a-a1fd-d3ef05c88815", "comment": "Malware payload (Stealc)", "value": "7adcd4ff05a5b48ea104d8ced22087529e140311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407774, "uuid": "eac1b6a4-816b-4953-814e-737c34ee09bb", "comment": "Malware payload (Stealc)", "value": "b690378703c5741897e2e7ed3863adf9390f90f08ac2bfd5fe0a64a9c20d69f4b0809b80bb54e01782efec1bcb5d2cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407774, "uuid": "144cede1-af8f-4021-956c-2c7c7d7004d4", "value": "T19A249D1375E0BC76E69747310F2EAADC7B2FB8725E6087C632546E1A19322F1DA53312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407774, "uuid": "36b242dc-0ff5-4d89-a297-7c58545d4a08", "value": "f815858bb8146375fb6d659cf6f7de7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407774, "uuid": "957905a8-5bd0-48e3-a2c3-540580415964", "value": "3072:kisOLr6z5bz8PlWBw1/yzYs/OAJ7GG8KU4n5A3ZF7xp:rLY1WWBMgEAZGflR3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694407774, "uuid": "1ad92fde-a165-4219-b29c-7b493ade6f63", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694407774, "uuid": "93bd986f-5ab0-441c-9d9b-328c73f65bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407774, "uuid": "294b0e2c-664d-43b9-8b4e-b6e873a9158e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8115d7-5099-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694433089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433089, "uuid": "0cbad4c1-d639-4846-b30e-99db65ac2bc2", "comment": "Malware payload (AgentTesla)", "value": "2e9b8c619782cb9de34d787eda597c77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433089, "uuid": "f1b7bc5c-d7f6-4ea7-be44-ce1aa5568a6b", "comment": "Malware payload (AgentTesla)", "value": "56e7b2e2165d002ad697d45161f14c37de5b6fa70331e61b8a8e95467ed98a1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433089, "uuid": "abf2b412-303c-4be9-a1b4-190520f5f673", "comment": "Malware payload (AgentTesla)", "value": "5105c9c0fa63243668214880d466a2a6b71fc58d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433089, "uuid": "2b6854f0-9fe9-4cf3-b7b8-c8d2b30ee945", "comment": "Malware payload (AgentTesla)", "value": "4b7725cd878916c2064b3e58bffb8b7cb9cc5a5c9b856152b14c43332651a3d81107920dd045ebf2107717dfc8d6074e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433089, "uuid": "f8efc516-b771-4fdb-8979-9e9fe989e179", "value": "T12183F835535A5DEFFBAF493498611248A374CA70B03BE78E29BC10F559DF3E814468E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433089, "uuid": "13d19d14-1fd1-4985-9773-1c093fee7895", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433089, "uuid": "9f5e8d7d-4549-41db-b149-5a511330bd5d", "value": "1536:oSZSvrTa9HrdFylkHBoZsNTHN7Yp2RmD+A+m6wMAAikBTU7AarZF4x35JDi6P78E:bErTa9ZFylkhoZuyX4x35JDiG7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694433089, "uuid": "b45c1039-93ec-4100-9143-140c62bbdd87", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694433089, "uuid": "85f4e326-702f-4619-9ccf-a484528a8246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433089, "uuid": "bbadfab7-376d-4f49-a5dd-8352853c3220", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.13043.4284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df407384-5077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694418627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418627, "uuid": "4d8f9284-4efc-4673-8e5f-ec777c381f3f", "comment": "Malware payload (AveMariaRAT)", "value": "6bf3b4b57dbefe86cc3ab4a126d19ca1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418627, "uuid": "c0e77b2a-24b4-4886-80f5-7d9d35c8f19a", "comment": "Malware payload (AveMariaRAT)", "value": "57bab10af9424bb39b4261d8938d946851694f2ff4841b3cf8f82364a40814f4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418627, "uuid": "0f41f4ff-3121-409e-80b4-a8bc363a4327", "comment": "Malware payload (AveMariaRAT)", "value": "97b1ade1a57b629b4674aa50515ccb46dbe5aed8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418627, "uuid": "ac7a436a-68ec-4f16-bdb3-2ec2a04beddb", "comment": "Malware payload (AveMariaRAT)", "value": "63012cfedce75fb2fcd926e53e12f5aac7735c1ce2d1cff0c74aa4d114bdd91807e308210c0a540224637828daab7020", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418627, "uuid": "bd7924cf-1781-43e8-a9be-0d4887bbc6ec", "value": "T111B41242DFA94F62C53DCFB50C779E501EBD7BC6DA54E9CE0BA9149AC9E32807620360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418627, "uuid": "acd3833d-319c-4ae4-b8c0-62f53e7f51f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418627, "uuid": "699069ff-8c9a-4e08-aa7b-662a4295422a", "value": "6144:M72GhNQLe1Dp8T+DSC2hsyVUQOIKv9n+y9Q1XxCSUC4EEa9xIjVCbL7hJEcZuy6:42iNZ1D2RZsyy+y9Qm3za9+jEbHh1ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694418627, "uuid": "81589a17-8d57-44ee-ad2e-b71991e68e80", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694418627, "uuid": "0d8cc1aa-a609-4b52-a117-508690c7735c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418627, "uuid": "56c822a0-6037-4fa8-b94e-7b1961cc43de", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4213a05c-5080-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694422228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422228, "uuid": "5f4ac721-95b8-46d8-969c-cdcb42c178f6", "comment": "Malware payload (AZORult)", "value": "70881eefb04b95f44988ad81c3d005b6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422228, "uuid": "9dbedb91-b8aa-4c4c-af82-0b2591bbd6e2", "comment": "Malware payload (AZORult)", "value": "595d36fe8453b18b94fbcee010251c14bbe50c12a08f8e8c85110c038f5f3f70", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422228, "uuid": "0a3ee91b-f959-4f2c-bff3-1c1bedbf8f94", "comment": "Malware payload (AZORult)", "value": "4791ea155bb0d5a416d14717fb9daf1de49284cb", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422228, "uuid": "6be1e788-8d5e-4b68-a939-484262587899", "comment": "Malware payload (AZORult)", "value": "01a0df3b0d5390cca05c2634ffa1c1ea21fa14ba4c2efc62ab52d14a9a6b14397f36260b368054d8f09a62c4c9ff33ed", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422228, "uuid": "82d0d55f-6ea9-4f9f-a347-5ef0b8214170", "value": "T18CD48D93B764CCB7F4A719B66E4FC02024B22D5D81D9960D62EEB71891F231250FBB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422228, "uuid": "26126ca2-e52f-4698-9a69-0fa59dd2e237", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422228, "uuid": "1c131f27-d7cc-4600-aa9d-425cff604e81", "value": "12288:Sgm/SfWFZvkeriZDramXCaktCGCXSbPWP1MlsMP:Sg1f4Rk2iZDrpXNGCXgePC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694422228, "uuid": "de17fe55-6853-4482-8763-65243df72557", "value": 611133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694422228, "uuid": "52566541-c75e-4376-ba49-a23a012a2b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422228, "uuid": "35910ae9-1880-4a4d-98d4-339f7cf9ae84", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a148e1fe-5055-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694403920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403920, "uuid": "e417a1dd-9178-47d1-a658-660bf8539756", "comment": "Malware payload (Amadey)", "value": "4dc79fa08a2d17ce072c27d7d54516f5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403920, "uuid": "27f00975-fe4b-4e89-8b0a-fbb1bffd39cc", "comment": "Malware payload (Amadey)", "value": "59c3042b54b8bdff714f300de3564c9342a163659d8d8ec64d0662675d637ccd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403920, "uuid": "1d71b0f2-7a7f-4bbd-909e-d5417f0cd378", "comment": "Malware payload (Amadey)", "value": "f1fc698ae7c0b32fa6cd75f4ee624a9d7ad57c99", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403920, "uuid": "501113a4-3756-4512-a4af-717f8127b1a0", "comment": "Malware payload (Amadey)", "value": "8357600b60831da4c98ebddf5d273fedb2bdfab15cc2ebf7739f2cea47dee1e3492dce9a18afd00884cec75c1afc1609", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403920, "uuid": "2e34a107-6811-4343-9884-8b73b5906920", "value": "T19565230D74F380B7DD72043515E0EBB2963D682107236AEFA7651AED6F302A0BB7157A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403920, "uuid": "8ace6be3-a661-4f91-b86f-ab8c06d64395", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403920, "uuid": "fc3cfb44-eedc-4516-b686-8c5567c610e8", "value": "24576:F8GCJr67bT6201rr9j7WWStDebRFm8IgtRcBSavsuCpPfUsWw2VrCoWu1Hg:iGCJrAbTh01rRj7WWStSVFm8RcBPsuAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694403920, "uuid": "6d84feb2-67ab-4e9d-b125-f11f1e308e57", "value": 1545080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694403920, "uuid": "c042b69c-2407-44da-b964-563ac7b6b460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403920, "uuid": "fbc175bf-f759-4d73-aab6-abc421e67613", "value": "4dc79fa08a2d17ce072c27d7d54516f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b72963-5067-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694411682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411682, "uuid": "a498ab8a-cc09-44d5-a116-eb17988dbec6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c98e3ef775760ab6fc1e38b26d206006", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411682, "uuid": "9ee13ce1-7092-43d8-8544-e7cc8735ada6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5b45926c91fe46b12dadd3dae6afa2cf76f91a8fed7c3aefdad7f8c1faa03919", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411682, "uuid": "7e69aab2-b2f3-4297-9f0c-295093a35e83", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "30308ac01d6f70da128def9313085742412491fb", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411682, "uuid": "24f242ce-2590-4de1-b3ea-7b269f1afb4d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a53bdc39b9a00f2e0010c2a26744aac8712b53b256f3d8e4e5c00a8ce6ad0b973ba3e2e40e6f7465bdd53da910f318cb", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411682, "uuid": "ffc9c455-f1db-4fbb-bcc0-8206b4bfccda", "value": "T1E7B53312E192ED3FF291E574AF05562E1B177F3328B8044CD3AC49DA8B1E06A78763D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411682, "uuid": "a101743d-568e-4442-82ad-6f235e1eceb3", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411682, "uuid": "2df0e8e5-6817-435c-8b78-3faaadfe4ae5", "value": "49152:D6dFPbjL83GhVFTZDT2n6nZhJL1Kn2xZwnZsgvxLWqnVbvfnpD:2d5LQWFA6nZXZiwqnVb3pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694411682, "uuid": "51feea78-3185-4d9e-87de-461b94012433", "value": 2295257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694411682, "uuid": "c46a3f2a-1885-41c9-9f38-19586e73fc36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411682, "uuid": "1e93efd1-0202-4fe5-b3b5-c22b63fea478", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fdf980-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424144, "uuid": "9b1cd3ee-4251-4979-a050-2d0d4a463721", "comment": "Malware payload (AgentTesla)", "value": "0e3d1b7e18657c9ec262a082ebd3f203", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424144, "uuid": "63eb2cb7-1535-4013-a58b-bd4fedebbfae", "comment": "Malware payload (AgentTesla)", "value": "5d1e3eddb5c1b6fbbcb136094098945e7db58322b8cf9d2b138e566a447a75eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424144, "uuid": "0684f87c-4ad7-4c53-b21a-cbdd37cb4a32", "comment": "Malware payload (AgentTesla)", "value": "dd02257d48b442b0480932aadd62e32e073cf2c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424144, "uuid": "2c6e6144-d2ef-4f60-a587-7a5cdfa43c60", "comment": "Malware payload (AgentTesla)", "value": "8288896e95b47dc404a3d288c308e56064f7c0f3810fabcba4c9cc81bca435586074bc9d290556c0bd0eeae1f2b03922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424144, "uuid": "28bba655-a09f-47bc-8786-d8f62bb976ab", "value": "T110D41203377E8736CA9C4BF8D1131D641BFF641B4605FB1A2F89F0F66A22B094651AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424144, "uuid": "44e93d0b-4476-4aba-8b15-a87c87f01d42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424144, "uuid": "021b7430-a849-4a9a-8eba-d10720a26b2e", "value": "12288:t1DiJwpQNGWBx5B+wdhtaIIA8SEbKE+13uK3DtQsSH:3DiJwpUbL5BBdTHIbZ+XD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424144, "uuid": "94408e34-4925-4902-b78f-5a01012b1ce5", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424144, "uuid": "3ac61b99-0f0f-4b7e-a84f-bfd1c0848dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424144, "uuid": "20b41e35-29cd-4be9-9241-8e602aec7f89", "value": "e-dekont-20230911-0.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a69bc7-5076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694418013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418013, "uuid": "b049d454-6cc0-4d59-87ec-4932ad2f117a", "comment": "Malware payload (Loki)", "value": "2d3bccec4a99af8f0f30e90a02e21ffb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418013, "uuid": "527e6455-1318-45f5-b4a2-fed8695ca321", "comment": "Malware payload (Loki)", "value": "5f3d59e714f772fd486e173987064dc18f3c93d0627868feb360754b113d5cae", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418013, "uuid": "436cdec2-c077-4a94-8786-e0a46605a7cf", "comment": "Malware payload (Loki)", "value": "cd0fc11706142ec9b2513040244f3904f2313b9e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418013, "uuid": "dc1f50d2-b65e-4d10-84ad-76cbc2df1c41", "comment": "Malware payload (Loki)", "value": "6414b8e53f8c7670d1e057127734778899ffba6d66f42f8564058dd63a19627a848edb6dc7063a9ecc48a0827270a879", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418013, "uuid": "bc2ffcbd-cc81-458f-9879-bc62ddd128e0", "value": "T17CB423CDD447C6CF9A0BB8E91DBE98A1257C0588D626D04E568D43F392EEC5C2CBF258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418013, "uuid": "1f13c12d-4744-4faa-bb8a-d35870344534", "value": "12288:4Tsp5J/E+wLYfmeSI9ONFQNVN2S8Mx1wtWtFxTzFVkwJZrZuW:4Tjs3S4CQNHL8Mx1wgtzrlrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694418013, "uuid": "e355c568-3b3d-435a-8774-4d16a34e4d4d", "value": 504942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694418013, "uuid": "281fe594-873f-4f76-b3b3-643a07b56eab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418013, "uuid": "a3449f62-f639-4df2-8633-b084e1fef5cb", "value": "Purchase Order (PO) PO 00197086.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fe4d10-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427171, "uuid": "586b5279-9636-4023-902c-256ce44a8494", "comment": "Malware payload (AgentTesla)", "value": "e1afd73d6a97a2145149b91ad4d7b1bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427171, "uuid": "80390fa1-728f-4ae6-90ec-7579f5a5c45e", "comment": "Malware payload (AgentTesla)", "value": "5ff91eeb90e07d464fc992ea36fdf08dfcfc3cb222749458dde8297d14fd8acf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427171, "uuid": "73989217-2556-4ccc-90f9-d305696ef6b5", "comment": "Malware payload (AgentTesla)", "value": "e55cd23ef84e25b1f5b576d06f5ea159e0328031", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427171, "uuid": "f36af71b-c99d-4b62-929a-2c74e8cf46ca", "comment": "Malware payload (AgentTesla)", "value": "a70882f201eafed0e1843cb227d1bcdcbf2b3aed48fd7ba04290d2318382ae8bffad03ec3045ec0c9b3a493b5ca0e1eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427171, "uuid": "dce76f10-680a-4803-b6b2-6b4c537c374b", "value": "T1D8D4334F5F96F017D4C31DA9D621B225F833ABE2A92CB425AB4735EC204FEC82745C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427171, "uuid": "5f02b56a-ed55-4cb7-90ed-ecfb44952a8e", "value": "12288:uwZJyHZP9ffTjmXFnq/VE6Qxswunjbb28N0wCZ+Yrmgq4UJTSX99LloD:ucy5P9fbjmVnxenn3FCZ+YdCE99LKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427171, "uuid": "74c5bdcd-4eaa-4e0d-bbb0-bc126de16adc", "value": 618423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427171, "uuid": "b80cf310-9383-4816-8c82-76f88ad11daa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427171, "uuid": "423bfa43-97ea-4314-af7a-5546fa0def8c", "value": "Quotation.PDF.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c62032-50f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694471712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471712, "uuid": "5521562e-8336-4de6-90bd-cd1453afdc93", "comment": "Malware payload (RedLineStealer)", "value": "e6afc3d5475890a3a6c690b5cf753aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471712, "uuid": "d2f402dc-e1a7-4dd7-b0fe-14e69ead6293", "comment": "Malware payload (RedLineStealer)", "value": "60447c2bd00cc88d5e91284586fa91357ad5f4b1539949b84b1c204afd456865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471712, "uuid": "e8534c8b-b816-4752-8b9f-bbbbd1cb86ed", "comment": "Malware payload (RedLineStealer)", "value": "177c10deab229a21fb2ba654d6b8e3e6067ba1b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471712, "uuid": "57b7bf72-545e-4960-9ede-b9c12a62f70b", "comment": "Malware payload (RedLineStealer)", "value": "917c64398df0ded3a192c2c109ce459d3f3f5644f025a8ef5e33e680a29d0415f423930d19c8bbac109d5fd218205bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471712, "uuid": "f650bfd1-2504-423d-8a71-b806c04927f7", "value": "T17C357C20BF9181B2DEE213B5CDAC7B55865C9CB00BEA05C796F446DE9E102E17BFD482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471712, "uuid": "0d86196c-03eb-4845-bcd6-f2682aa47c03", "value": "33ede84b4cb0967ffb7b14e9a46c056b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471712, "uuid": "c1848988-80a0-4e2b-88e2-a1930465a234", "value": "12288:hH2tLW0hlG6conugrdGASFA8FdZx42akAi72a88PJIk33jPLkmA16BLAusBd7iL8:8lG6VugrdGAY1r41kIk3TDkkBLVOrDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694471712, "uuid": "5d11e8a6-e740-4154-892f-41a2473ec288", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694471712, "uuid": "8d03ffb6-f883-4d14-905b-8cef48be305b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471712, "uuid": "bd727f7b-6b72-4f51-a59c-ea19fe2c0a3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2cd806-508f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694428691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428691, "uuid": "1a80ed5f-8b7f-45eb-851e-f7c7593c1f15", "comment": "Malware payload (Loki)", "value": "7fbd4464165bc72a79c7de6c243e7e56", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428691, "uuid": "69d517f9-2928-435c-9dfa-aa3186cd889c", "comment": "Malware payload (Loki)", "value": "60a1b5ed1e77dad931bf57879f92b3c3034f3f6e5d19ce93d8e3d330654a7435", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428691, "uuid": "e79a337d-a70c-431d-b984-03eb4be090ac", "comment": "Malware payload (Loki)", "value": "6d95bda05002db11c76105614b0beb5b4e3f093f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428691, "uuid": "8d913144-c785-44eb-8500-e4b03a832156", "comment": "Malware payload (Loki)", "value": "3de5dcf2eac62dd34c27f8c83e78253079ecd454ddbccf238d023ca51f2e755d81a599caea309a3a2fc69429e23c1bfa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428691, "uuid": "e6dd419e-bd7d-49a2-aa6f-3018bd3700d1", "value": "T1AC9423E09F102DD593516A6FFB0D48A033D2DDD9542C2DE086A933FA90B1ADE22D9D73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428691, "uuid": "6c6b33c2-0bd0-477c-9bc8-718e3f8f559b", "value": "12288:/TIS5Ni570xFebU0XVaiFwjR8YJS1akk01:/TX5se6bhVaBnw1xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694428691, "uuid": "c41db9dc-415b-43ef-813f-14271ec8ffd6", "value": 443228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694428691, "uuid": "100945aa-56a2-47fc-9240-3da0aaedfa61", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428691, "uuid": "5eb85273-8e42-4cce-8810-73af74c81f23", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3148c32c-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450547, "uuid": "c48d645f-7092-4cbe-b25c-f65683f7212d", "comment": "Malware payload (Mirai)", "value": "b694e34b7ec6e0aed0b39253a672b809", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450547, "uuid": "d5b85071-8192-4c39-a71c-145cc2234631", "comment": "Malware payload (Mirai)", "value": "617a08a523d61dfae52d9b58ad724399f5053043df4387b60b0e45fae90999c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450547, "uuid": "2ac5c099-837e-427a-83d9-f452e10b0f8d", "comment": "Malware payload (Mirai)", "value": "8e526ad3d017e1b16beaad891ca6dddd394e83a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450547, "uuid": "58b241cd-fc17-4d49-b8f9-bc3789b823eb", "comment": "Malware payload (Mirai)", "value": "7cc294339adc68ddf0553d0cf7ae1dc13e2f59a765fdda41feaf4a65940541e7b588fdcddc6b283bf71f748b702df527", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450547, "uuid": "870b7506-504f-4610-bef5-61e1619aa5c0", "value": "T18F43AFB6C42DADA8D1084234B8258D740F53F64591B76EFA8AC582924007FBCF71C7E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450547, "uuid": "37c9a575-6131-4f64-85d5-6d118751c14e", "value": "1536:Fydz2nZCfwtNjOzCEg134eDjNCysl1d+:Fy0nZCf3U4eDjNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450547, "uuid": "e1de4bdd-59d3-4143-b156-bb3e1e304913", "value": 56344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450547, "uuid": "af6db9f5-fc6c-4670-9bd8-ef34795b0910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450547, "uuid": "ac229a21-8ae7-45a3-8594-bb0a44179829", "value": "b694e34b7ec6e0aed0b39253a672b809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4d84ea-50a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694438221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438221, "uuid": "e97c625e-89b5-4b80-9400-13e3910a02a3", "comment": "Malware payload (Formbook)", "value": "4a34644c1fb39d6da830561201415bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438221, "uuid": "5fd187ca-ba4c-4196-947d-d5e7652c797c", "comment": "Malware payload (Formbook)", "value": "61dbeb0e19a0d2d2cb57d370bfc4d56e5aac60f82943dc908458e828c9e4b208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438221, "uuid": "a06f762a-6087-4cd8-83ae-782bbec2a5b4", "comment": "Malware payload (Formbook)", "value": "af87d6c36f17dd8bad65971fee347cd582c537ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438221, "uuid": "8cf8f1f1-74cd-4aca-a96f-7b8011cf0702", "comment": "Malware payload (Formbook)", "value": "38cc4a61e450c7243a9d3561d2c0cfbf7296b35c390be7b023817e4429385ece678a8cc41cea8f58c989defa352ff6c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438221, "uuid": "a205cfce-ba6e-4984-aa07-6e8beaaa11db", "value": "T15DC4128437EC6B36D4FE4FF528A2148067B47A8A79B2EB6D1F8652CA1973F44170170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438221, "uuid": "9d99552d-b91c-4c5c-bc35-255487d226ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438221, "uuid": "3dc93210-42d3-414b-b2c5-2d60150b0308", "value": "12288:ER0FOmPF71glChj0coVTTxp/vVFg7wPuepEDAAzW/Awf:BOSF7ulClaTxpF4QXp4AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438221, "uuid": "2216d769-e3b6-4c62-acda-4f7de91377b3", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438221, "uuid": "c5e0a4fa-9817-418b-b671-ea0b73af1fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438221, "uuid": "af9d0732-f642-469d-8412-ed0eee701bb4", "value": "4500216289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cc1f59-50e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694467275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694467275, "uuid": "10dd36a2-d2f6-417f-aef1-4df76bb05601", "comment": "Malware payload (RedLineStealer)", "value": "099c1e91def32044b6cfe1bf09815ec1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694467275, "uuid": "de78664c-9acd-4985-983b-544b90592440", "comment": "Malware payload (RedLineStealer)", "value": "6230bbc1806416197b90876500a4a9e684ebd79ffbe33e6c9097776bb662f07a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694467275, "uuid": "1ecd1fd7-db53-4074-9c87-471aae1c9073", "comment": "Malware payload (RedLineStealer)", "value": "d5c209baf2d80c9eedfe1dd8f40bcd064b2f0403", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694467275, "uuid": "7a700a9c-46b9-4e77-a8fe-be29fef6dd73", "comment": "Malware payload (RedLineStealer)", "value": "3a0b11217a36ec923306583217e46ad6032054cf377f3bbcfdc95cc747af4e606e82d750a8aafd8ee78f2666344f12c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694467275, "uuid": "bc47548a-f207-42ee-9ecd-8ef90b390521", "value": "T18F356BED7A8E41FDDFD2207945FDA8308E7FA1700729D7C335A956EE8A201C16AF1186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694467275, "uuid": "fc48712c-8df4-4a06-9ea1-ccc496286256", "value": "f41494c19ae73e620f9d89fefd36075a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694467275, "uuid": "54e1ed43-59e3-4d05-9f80-66a785e40448", "value": "24576:FnoIvj2HbB4h6CqAcuF88ce2eI91mO9Bfesp:FobB4h6XJheI91mO9Bf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694467275, "uuid": "71b4f4b3-3436-448e-b47a-b077e58dedc0", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694467275, "uuid": "70e11535-5187-4caf-bd05-7feb28f7ea7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694467275, "uuid": "2b893cbd-c492-4b80-b199-2e06b3f52f69", "value": "099c1e91def32044b6cfe1bf09815ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19c57db-5091-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694429690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429690, "uuid": "a72abb64-03fc-42a3-b512-58612520ab75", "comment": "Malware payload (njrat)", "value": "ebfcc37c7362e0d882ac1f51c7101e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429690, "uuid": "ff05974f-275b-4aa8-b056-37c6d014667c", "comment": "Malware payload (njrat)", "value": "623e86ed2df4670b8d8f5f82c2e5e9e9d74dac0729f609a3a9192b214c83c301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429690, "uuid": "417467c6-f095-4196-985c-afadfc3aaa7c", "comment": "Malware payload (njrat)", "value": "f180397c5f993f8d12f2e0e8f7dd5ff6087c7f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429690, "uuid": "19a42b97-100c-41c3-850a-97832c68bdc6", "comment": "Malware payload (njrat)", "value": "c57733ad5b43581ae879fcc2f8f9208b673c25925dbd7ef8aed54c2a840683da2433536128dc40fbf86ceecfbc27eb27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429690, "uuid": "47a3acc4-3564-49ef-9aa9-3fe7bff0d19b", "value": "T138C2195D3B908162C2EF2BB006B2DB2502F2E10B5A17EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429690, "uuid": "85c01dc8-8b66-45c5-b48a-649ff8db2dd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429690, "uuid": "16825c79-43dc-4888-83b9-264f8352e85a", "value": "384:KLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bHtVvGD:Ul8AA/6T5e/gsEmVvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429690, "uuid": "b6ea66de-ab23-4980-9484-f2e15f9d50f9", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429690, "uuid": "7ddf5bbf-5c46-4ca7-b0be-f52f2641ceff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429690, "uuid": "49728980-4dbd-4de1-858d-f3262a4b62c2", "value": "bP72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559220f7-503c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694393055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393055, "uuid": "3db4a042-ba9d-4242-aa12-4bab7a078d4f", "comment": "Malware payload (Mirai)", "value": "fd0136c0e5e053dd0170df6836139365", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393055, "uuid": "f601f34c-dda5-4ff3-ab27-e97d3db02605", "comment": "Malware payload (Mirai)", "value": "624f4966636968f487627b6c0f047e25b870c69040d3fb7c5fb4b79771931830", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393055, "uuid": "827813e0-2d0c-4fc2-8313-e19f8c76c318", "comment": "Malware payload (Mirai)", "value": "bac97209ce61303ea88920af89b38e067d28770e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393055, "uuid": "4f1aed3d-23d2-456c-b25d-df3e072ad5c7", "comment": "Malware payload (Mirai)", "value": "fc2ec70c725e961ad4fbfb46ebf60ecfdaecc7d7a5dc961b02442a595a51503d673ee0f7c9002517023b0f59aa5e439f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393055, "uuid": "6cb30b69-984a-40b9-b91f-0314c2b40ace", "value": "T163E2E081727EC7A4E032E07B304BB61E4523A31E801196F2FF6C7A35ADA3B857F64156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393055, "uuid": "79470aef-8e55-429b-83a6-eb3016f3d64f", "value": "768:zMy+/N5R2afUOotY+LHZ3GkdoN/fYdyPlIPYnbcuyD7Uiyqw:hOtffUltPLHZ3GSoBfY2IPYnouy8Zqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694393055, "uuid": "f2e9286b-55e0-4cb3-be42-1ec2c37de35f", "value": 33016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694393055, "uuid": "14e92462-0cfa-4aa1-b29d-49b331d58427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393055, "uuid": "c2915afb-5181-409a-bbe0-3a29f08fce4a", "value": "fd0136c0e5e053dd0170df6836139365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a824aef3-5074-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694417246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417246, "uuid": "ebd20c6c-23d7-4594-bfeb-dfd5f50a1b88", "comment": "Malware payload", "value": "2538376f52a3995839160ada62f8d26a", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417246, "uuid": "7ae70fa1-5ab1-4392-a879-57170bd00bd2", "comment": "Malware payload", "value": "62f682f16808055c37cedc46bd38e9965a3b9d92d6238d1f0ed873b3366b5061", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417246, "uuid": "9ecac2da-ee61-47b6-99bd-bc2bd5936e4d", "comment": "Malware payload", "value": "79d38b92418b8d3df5d093ebfc809bfc595d4638", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417246, "uuid": "24693c2e-023e-42d0-b622-87742a3c5246", "comment": "Malware payload", "value": "4f8cf1ade907f64374814d9dd74426d2be48e20916ed808d44e0fe53add849a906bbecbde8c2d3b59fad4e530ccf3818", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417246, "uuid": "c61ac851-3e68-4f27-8361-b077874a0715", "value": "T168B54C11F286C426DD1D03B6983DEE2A107EBE77073140EF76E9356A49B35C2623AE17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417246, "uuid": "4d1de662-3e91-4f9e-9535-12bf6ad41ffe", "value": "49152:UqEicAk+q4E5q8g73kQLWj1s9w4Uf5rXf63h0erb:i/+XyQyj1s9wPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417246, "uuid": "cca0463d-411d-46b9-91f4-d2183f0781d3", "value": 2415616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417246, "uuid": "062c4c93-cbf6-4085-805e-91d460188792", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417246, "uuid": "f969e18a-3556-4181-89d2-cfd27ebbdccb", "value": "Document_1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45628cec-5085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424382, "uuid": "a7d34c13-c35a-4a9f-af46-8018a1e46de1", "comment": "Malware payload (AgentTesla)", "value": "8c0570bdbdf8de0a7135694d617a4b6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424382, "uuid": "0202848c-675d-4a3c-81db-924d72fa2ebd", "comment": "Malware payload (AgentTesla)", "value": "636dbb3ae4c609a5a703a870fc059927c5f035a8365ec688e8ffad6c695e8e79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424382, "uuid": "85d8dd44-d8c3-450a-bc6a-fede76cd6d43", "comment": "Malware payload (AgentTesla)", "value": "f16dbe36fdeec0ad17292c29b59c9c38f6b22d07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424382, "uuid": "d1bffc3f-e74c-4728-a877-4b7cc01a8d30", "comment": "Malware payload (AgentTesla)", "value": "b828fe65b940eb42f09eb7a8ea778f74f8c816c1f0550b56711a009f4af0a7688e2f9ad0917bcd1d8c65b3a781be521a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424382, "uuid": "8edef112-dac4-449d-b071-4e01317b1fef", "value": "T11FD4121A377E2B33C58DC7FEDA2769201BFB659BD095E3591D86B0F22783B404600A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424382, "uuid": "cf835d8e-2905-4563-8c15-9f93af69b533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424382, "uuid": "79d29e31-7467-48bb-867c-8374d31a7190", "value": "12288:t1Ds1mEx/LzOw5gwb9RnyX5n1w4W7kI9NLxtSSUedreYQ:3Ds11x/LzOegyrnyX5mZee/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424382, "uuid": "e936802e-459a-49b0-aefe-739177cb8379", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424382, "uuid": "e45fd8e1-3164-45b3-a4f5-fec7d147619f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424382, "uuid": "ec6ba0bd-b715-4d36-b60b-98fc04ca5660", "value": "DHL Express_AWB#20401299082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccfcd56-5074-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694417227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417227, "uuid": "24a34676-3d9b-4ca7-a616-5b48d0535750", "comment": "Malware payload", "value": "2d6cf0ed4c08d01ec369d2134b12bd3b", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417227, "uuid": "e5706d6b-b203-4c12-ae40-e04fe39a4aa8", "comment": "Malware payload", "value": "63f7b6a5a19711cb2e4c7d3cdc61a0d574db746c217374c2a9e8cc5b56e025c1", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417227, "uuid": "3d74fd30-7c98-4683-9d74-3b5104648cde", "comment": "Malware payload", "value": "e35173728bc09ffb688bdd220f4bdabddd5aeb60", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417227, "uuid": "75264350-4672-4f5e-849a-2de887c1839c", "comment": "Malware payload", "value": "c786a8357863e750f5d31a7335af2b83fe242e0ff061fa70f09f912a0a60fa5656e7fbb737617dbcaaeae409ee2b4ed6", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417227, "uuid": "cf129845-5300-43c4-a5af-8d297814b9f1", "value": "T11DD012316942397726AA7F85C0279014BC76188C1A42A04BF100103C8917396ABFC1C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417227, "uuid": "53308d6b-f71f-4be8-939f-2e6fba131ae8", "value": "6:hmLF2pKCS2DKC59SKCO82DKCJEivYyR82nn:QLF2plD6XSdFwy/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417227, "uuid": "4145a3af-33bb-4c21-9d77-d37b9bf9f9c4", "value": 256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417227, "uuid": "87731178-c849-4292-9cf7-7fe5c37da331", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417227, "uuid": "db9a76c2-8ae1-4889-97db-d28404b8c4f8", "value": "installer_1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4c7134-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694427131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427131, "uuid": "3d5b31c4-b32a-4e8c-a1b0-827691d289d5", "comment": "Malware payload", "value": "308f3a3d64e305766a86fae12d855af2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427131, "uuid": "902be523-1f21-4ed0-b51d-de6f705d835e", "comment": "Malware payload", "value": "6499972cbae2eb317ce335df2958aaea58578d2055c77b8c31e94cf30d60e276", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427131, "uuid": "5227a99c-cfde-4d03-800f-06fd9871b600", "comment": "Malware payload", "value": "c6f0edf58fa1b7d7491824478f3a1c2dcddf4f8b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427131, "uuid": "3d2c0da9-db38-428c-a5b4-1e3c3e697263", "comment": "Malware payload", "value": "c6b151e719bb86eb56c39de35febb22591fe292f2e0dcc02e9d2f92b74d339ae40fcabac9f7bc9f83ce1d9f2e26d1ccd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427131, "uuid": "ef33344d-eabe-4350-a8d3-b2843bd11a23", "value": "T1D90533D41019BCACFBA80FE48ED52614184C9F9D5916D6E32F4F92490ECDF1593B8CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427131, "uuid": "75ba9746-375f-45a9-be7f-362b890f5a38", "value": "12288:jTj/H/D57rWjV68D3KInZGBSq/AcWcwZQlyBvbpbOI+jxVUGKGFLfXIIHx7zbg1/:jPN2l3XZG7I+wQlSTyN+of/pg6fYhxoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427131, "uuid": "cbfa3fff-268d-46aa-b72a-26c125f0862a", "value": 821576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427131, "uuid": "6cc2cf5a-683b-48e4-b95a-e807735de220", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427131, "uuid": "b6e1cee3-120f-4e93-855b-15c8068a1004", "value": "List Invoice_10.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bde78c-505c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694406927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406927, "uuid": "2c5fa3d0-783f-40a2-bc80-9d6ae360ba5f", "comment": "Malware payload (Amadey)", "value": "a0d75b0b716b207991a910634d9fc335", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406927, "uuid": "9e1a7f36-5c0c-4aba-9f5b-a4746b32595c", "comment": "Malware payload (Amadey)", "value": "65bcc74c4c9e5eaf0b488695c318331f95bf226db721ec0f19be646875d93dae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406927, "uuid": "26b7d8d3-d86d-402b-aac1-28b3e3b1b339", "comment": "Malware payload (Amadey)", "value": "914a0975f697f6e32192c603a7f5740fd4435d6e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406927, "uuid": "f01413d5-3d4e-451c-b0ab-acb9a2278f1e", "comment": "Malware payload (Amadey)", "value": "50b29b961624600dbe973122b778836ac4aac6265453ced7d0b5c64bb6e5fb3e68d96ca50bedd72d00e04d549d0e1a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406927, "uuid": "a161125b-651f-4d89-9636-880234be86cd", "value": "T10B652248B4D1C131F923213256ECFA75463EFA750BA5499F53B83F6E1F60281DB2A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406927, "uuid": "b01e026e-5819-439b-bb54-7e7f85aae982", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406927, "uuid": "1ab69ed6-3672-4e80-a6eb-8b81c7a7502c", "value": "24576:JEHCJUi00ki72KowNVj1EapUiw9DoGp+Kh1ko6MICuF96e9EZTZ7fhMu1Hg:aHCJU82iK/9D3pXkSIJ9Nql7fhh1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694406927, "uuid": "dbc2e762-17a1-4b59-b70b-07f53dd96499", "value": 1470840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694406927, "uuid": "9b6b853c-b503-4b33-abec-513e6e47c1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406927, "uuid": "b08df5d0-46cd-4816-bd6f-94aec74060f6", "value": "a0d75b0b716b207991a910634d9fc335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e01692-5087-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MassLogger)", "timestamp": 1694425152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425152, "uuid": "7aba3267-8632-491d-b776-8c402fc9a377", "comment": "Malware payload (MassLogger)", "value": "a84dd54a3de0b77dce178cd770712ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425152, "uuid": "5691d2ee-014e-485e-ad1c-215a9a814e02", "comment": "Malware payload (MassLogger)", "value": "6706d52fef168e674ebde30f9dd77ac7afcb6645fc84ff9a92b711d3c13f47d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425152, "uuid": "9242fc52-1af4-4ae8-add2-3943722a4abd", "comment": "Malware payload (MassLogger)", "value": "70f5c8d1b199b001f43ce2c8b9ea722a6766012e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425152, "uuid": "d3824855-8187-427e-be55-569b2c1762a5", "comment": "Malware payload (MassLogger)", "value": "40f22cca513987241182633479f10bd981b566fb47c9f27decc0d57b917d9e192610e9cee9ee4adfc2b3cea764917a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425152, "uuid": "11814226-4085-4b40-af55-1ecd3f931aa0", "value": "T195448D0873B96F06EABE87F419A291448BB5766F693DE21C1DD360EF2674F409890F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425152, "uuid": "61a9f9ce-8f7d-42be-aca1-e7e8466f3d51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425152, "uuid": "1e64a24f-09cb-481a-b9ca-32ce1b6f93d8", "value": "3072:EuYNkPnKNKw4Hvrx/sX+2ecMovxGJK/ZccG53xiECFWDS/ROaLH5YASKhQO7:EfNkmIPrx/L2eZoMJOWcGSECMQjH5JS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694425152, "uuid": "4fa706a9-333d-4fe3-9c66-2f44481390c9", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694425152, "uuid": "073dd030-a298-4213-a9b6-eddee730c7d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425152, "uuid": "7bceeb6a-85db-4f8c-bf20-8404475dc592", "value": "SecuriteInfo.com.MSIL.Kryptik.DSR.tr.15996.6675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2437b37f-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694445371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445371, "uuid": "68f0871b-2c3c-41bf-b03d-6c2ab7ec71dd", "comment": "Malware payload (AgentTesla)", "value": "69b7b04c8a8276e36b8a147ec75bc9de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445371, "uuid": "3401c873-9d05-4fd8-a158-03f963ce4bf4", "comment": "Malware payload (AgentTesla)", "value": "6865522531016c434c30792d9c3f87d5fb0433951deff4edd85eb3a1f96c44d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445371, "uuid": "31c14171-2fe6-4ca5-981a-d967ec75c3c6", "comment": "Malware payload (AgentTesla)", "value": "ebd1bc25a508d6901bccf0ff14878e497efacb01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445371, "uuid": "f0b96264-3b54-4e7d-887a-7c59af86ad51", "comment": "Malware payload (AgentTesla)", "value": "4300e8761a8cec83824646bb55f443ce41d79629cab0943a830a78d29773e58c3039fdddfdf654f0b57bb297cbacaf99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445371, "uuid": "054d66ae-9604-4b1a-99c4-d1eb20913f0d", "value": "T10443366DD34F01A9CFA25377AB1A1A4442FDBB7EB24512A1306C437533EEC2D91262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445371, "uuid": "8a1c2608-6c88-41c3-ac68-6dc2501e2008", "value": "768:pwAbZSibMX9gRWjIUGtL48Gmj4knO1saGXspE+Mfu7qDSRFkWFt:pwAlRj/tdG8zYCf+MfuISYYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445371, "uuid": "42aaa968-e6a6-4d00-be14-eb070373eb28", "value": 57809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445371, "uuid": "c866a0d6-5654-44b9-805c-238eb8fd7830", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445371, "uuid": "745c03b6-234a-45a2-aba6-599ee8fd8b3a", "value": "69b7b04c8a8276e36b8a147ec75bc9de.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db4b3f6-5085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424369, "uuid": "7bda6eea-b659-49e8-9e51-1e2d3a2a1c58", "comment": "Malware payload (AgentTesla)", "value": "ebd01b057d01eb3bac77d3854bad7fad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424369, "uuid": "f21d339f-5b60-4905-a5fd-cb63ca85d2d1", "comment": "Malware payload (AgentTesla)", "value": "6a45a4b3462eebbdb77b9da74b7ea99c093f7dc61d81c992069a68ce425f83f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424369, "uuid": "b29b5868-92ba-4bba-b2f9-7167acb38156", "comment": "Malware payload (AgentTesla)", "value": "545123b1cf620c4c1f40a0dba5a5c8ef7a3f75f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424369, "uuid": "4f9174a0-7070-4297-b9ce-3ee85f96be11", "comment": "Malware payload (AgentTesla)", "value": "ce5009eb36d73d6a74ff931e0b71893148efd418dc33c4f15bb4450d1233886b7dfb6be16a0d0ded861c071eadff4850", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424369, "uuid": "5a3cabba-021a-475d-85a2-d9ed5c726f09", "value": "T10ED42317A3EF0B38CA94DEFE1DF1AA90A77C49415360DA2D9EDD15ACBB9970CC011782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424369, "uuid": "d5ac8a54-1a1e-440d-a70d-33d8cd4f4d23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424369, "uuid": "24094fad-ee89-4450-ae73-c71df82bc071", "value": "12288:y2iNZ1DaynpSqtdq8IAajw4EeTncZrqoyMp7847bSDE5xILP:y1pDaC0wdq8mjwGTncZmO7/7bSEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424369, "uuid": "8f5ffd1e-16c8-4e36-83d1-6647687ff62b", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424369, "uuid": "43b06638-02bf-49a1-b208-849a866b2c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424369, "uuid": "256e69af-7b47-4a16-9251-6698435927be", "value": "DHL_467775567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96954dd6-508c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694427524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427524, "uuid": "253cf645-f216-4e91-a412-f57a3a252a8d", "comment": "Malware payload (Loki)", "value": "e801e1ee2a4e18b70306557325126501", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427524, "uuid": "a43e112d-9598-4cbf-96d0-a4ffb5965fbd", "comment": "Malware payload (Loki)", "value": "6afcc7de4eaa355aba8ef093c43be7f1772ce72b05eaa11d06eefe8478dce51a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427524, "uuid": "f0e169fc-b122-4a5d-8240-7578c721a372", "comment": "Malware payload (Loki)", "value": "883e945afee95502f49aabe0643961f408cd038e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427524, "uuid": "410b9a9e-3323-4b28-8c64-e05841e01c21", "comment": "Malware payload (Loki)", "value": "74993833c0605e9c57a0d674fddf4c67e9249c419217407dbf1c8696d4551e06f87da37706b21f58710b361d82fa6576", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427524, "uuid": "89f328f3-8046-42ba-832c-4e4b9cda7b09", "value": "T17B547C9C325076EFC867D4729EA82CA8FB5078BB831F4613E41715ADAA4D897CF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427524, "uuid": "bbfa7321-5493-47c6-8316-b68e022933a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427524, "uuid": "706cebb3-7a8d-49e0-9210-b9cddd11e730", "value": "6144:R0Wp7RH1SbRrRwVLUnqLILh/UkpOsRG0tRHa1MFYYMPVO50ZgIfCRnaNI:rp7RVhUnmEh8knGKRHaQcPVO50ZgIfCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427524, "uuid": "9d7ff18c-1ce9-4c6c-8041-ae2ee30a494d", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427524, "uuid": "7c0d1abf-426b-4dec-b6b8-d19339b7964d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427524, "uuid": "93550f25-64a8-4937-9ac6-e82aae629f67", "value": "e801e1ee2a4e18b70306557325126501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a2dbf5-50bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694448358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448358, "uuid": "924aee24-720d-466b-af7e-a79f193d9492", "comment": "Malware payload (AgentTesla)", "value": "2ab018604644a8d5aaa10c413d71821f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448358, "uuid": "d2925564-18f5-4ea8-a8be-e4d485711ae6", "comment": "Malware payload (AgentTesla)", "value": "6c42ee7167cd0229fd37b09bbfdd37f5454786457284a4c97583832d86af01e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448358, "uuid": "33e55aba-b4d5-44e7-942f-6e8a6f1b9af9", "comment": "Malware payload (AgentTesla)", "value": "02b96604984b740d46f3a6897aa87524a83a043e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694448358, "uuid": "7c774b26-79eb-41ea-ba0c-87e61f07716f", "comment": "Malware payload (AgentTesla)", "value": "2ca002d18226d7b37fe7430ceda2fbd38617bfaa2e4ba1499128f97544e94e8ae6a7ae2eb91938c586c82be8820212d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448358, "uuid": "ad5562d8-7c5a-44fc-955d-31cdff663f59", "value": "T107B42316CB569A33D8355BFE1816473003FF9E5EC219DF5EB2AD68A6882330C2D5A7D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448358, "uuid": "90cf6126-da37-4c38-92e6-f5fdfa5228e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448358, "uuid": "b3d4f856-5078-432f-817d-9aa250447b0c", "value": "12288:aK1DBEaPkC3sylZBNaqX/dg0iVWZ/3YZ35SoHy:a+DBEe9syTBsqPm0JHIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694448358, "uuid": "af567c58-2305-4575-bc29-32a42a07c23c", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694448358, "uuid": "f3fb98af-d9d5-4524-823c-bad78f4565ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694448358, "uuid": "cd2f28ad-c7be-42ff-9f08-734aa35bbf44", "value": "Cotizacion 00426.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37479967-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401165, "uuid": "5516aa2f-8f55-4d1b-9858-e8f6bb804123", "comment": "Malware payload (Mirai)", "value": "fe7021642d6534ffbb48a4c67e49d310", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401165, "uuid": "487f244c-9ca4-435a-a6c3-2959a8e13907", "comment": "Malware payload (Mirai)", "value": "6d82d2c5f4532bcacb4875633a031cfe89d2c571baed074883e0e8df9fca5c48", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401165, "uuid": "9e72af37-3042-475c-8cb6-df767e51ae3a", "comment": "Malware payload (Mirai)", "value": "f5286f868e1711273eb75fc18d9da4ece940134b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401165, "uuid": "1447e0de-dd24-4a12-9a06-ec0a3dc711d4", "comment": "Malware payload (Mirai)", "value": "816aabbf2645a2f96771310234cb45c730f3494b579f42c4ac0a80995ae3a460942a897fa928f90ff52a669113882a80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401165, "uuid": "760fca3e-8fc6-43a0-8f38-d1a9dd24845b", "value": "T140F2E791F8854727C2E41379B6AE5A8E377073EC82CBB627D8224B207AC591F1D63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401165, "uuid": "ae31b81e-4ad0-41c7-858c-19c2568bf345", "value": "768:TjbUR4xPEXqqoG5M1ICBHGadwq3iFtKV5/a9tuF7h3RyT3pochtBYwn:TjbUmQqRG5MNxGaqRie8NBu3D5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401165, "uuid": "2939aee2-b0ae-4085-a09e-159de3b340ee", "value": 34868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401165, "uuid": "8a8e81ec-bda3-4eac-87a4-85b960ab537d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401165, "uuid": "6a0315b7-b0c7-47e2-b3c8-b1f054fa99ad", "value": "m5.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f9945c-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424139, "uuid": "79623a18-4b17-4f03-81cb-a50a330281c4", "comment": "Malware payload (AgentTesla)", "value": "b41c240c97078a13061b04f426e8dad3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424139, "uuid": "a54aa1ea-eb77-4965-8a72-b921906b042d", "comment": "Malware payload (AgentTesla)", "value": "6dac7514d424951b1e3091f61a94441b718c5e64e9dba95cfff15a51d8cde370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424139, "uuid": "2f74d285-2fca-40da-bad7-84fa99a584a2", "comment": "Malware payload (AgentTesla)", "value": "99570d0beaefe6bef6ab48f87d0a988b25fe8387", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424139, "uuid": "84abea2f-4283-46bc-9970-5fdf7361f3a1", "comment": "Malware payload (AgentTesla)", "value": "67d74a8dcb02790621933cebc9cb96d0484bbd189fab53f31c47d3a04d65a9bb2acbfa0db47eccf0a655c5877bca8c43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424139, "uuid": "f8a70ad7-af94-40be-afd6-17e6d17111de", "value": "T15BC423426BF9CF34DA7D8F7A1CE587210379A99D0581D99E2FC4A86E4C52B09D1223E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424139, "uuid": "b0acce8f-ff69-486d-a7d9-6ee762076313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424139, "uuid": "3cbca244-4475-478d-b1e0-98f17fd709dd", "value": "6144:1r2GhNQLe1DpP4/6DjkubWSQpWrWsR9Pvm0BlXoMGfr90y73T6tI72YJ/Z1EgvZC:Z2iNZ1D86Djzb7qs7BlXI9TACRH67Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424139, "uuid": "0a6901cb-e10d-4ac4-8014-7a9d0fedc686", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424139, "uuid": "7af1418a-a241-442d-97b4-4956d129e39e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424139, "uuid": "890e948a-250e-49f8-9381-d8a49b0d7ce5", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db4be8e-503f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694394331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394331, "uuid": "4b769b2f-9a49-4cb1-80ef-0ec534bb8622", "comment": "Malware payload (Amadey)", "value": "b86ce23948d7cf0ea72494c225ec1ad4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394331, "uuid": "e67a5f0f-8767-402a-8658-fe214a84c6fe", "comment": "Malware payload (Amadey)", "value": "6eae1ce81b0b764665bc827f1c546953f41fdae666a29378f81eb6c5331cb758", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394331, "uuid": "99aa6399-de15-46cd-ae2d-451e7cbf2475", "comment": "Malware payload (Amadey)", "value": "06bf2b43cb5d4882247eca7decb6d905f9a2f865", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394331, "uuid": "3e718c37-adb3-4d9d-a30b-cc3572f5e80d", "comment": "Malware payload (Amadey)", "value": "2e3c4f1ffe0105b60b1c5444d550a95228ac3c7be85be42b9c3ef7df1b6d0471699d01893956c48a120f41319ffb2ef3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394331, "uuid": "c5129e99-8981-438e-b384-c7a4d2e0224c", "value": "T17334AE1074E1C4F3D832153609F0EBB55ABDB9610B6199EFA3A40F7E4F202C1EA7D666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394331, "uuid": "3eeb823f-4336-4222-a7bc-ef9f15b0ca7e", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394331, "uuid": "68b590cc-637e-4731-bdbb-af9d0051deaf", "value": "6144:wQFU1z6DCGbAR/VeDC1tAOXcCanurBiIg:wJ1zaC+Uj2rnurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694394331, "uuid": "4874f292-aefe-4e54-acaa-d7820111a59a", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694394331, "uuid": "21a6e0ac-d643-4efd-9c7f-8f092f0339d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394331, "uuid": "f45a7928-cbf3-4ef7-8798-9756b44e6683", "value": "b86ce23948d7cf0ea72494c225ec1ad4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8900db-50b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694446598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694446598, "uuid": "dd1278ee-5491-4d64-9e6b-e7d919c4ea0c", "comment": "Malware payload (AgentTesla)", "value": "57115364d62ad88c9072f41e6a29e4fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694446598, "uuid": "f77665ee-b999-4de8-8e8d-05038fc696a4", "comment": "Malware payload (AgentTesla)", "value": "6f550b705f890d3427d275958ea6f610de816cd420cc394ed2a6470349340c31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694446598, "uuid": "944e7166-2aa2-4bb6-ae4d-466b0edb526b", "comment": "Malware payload (AgentTesla)", "value": "ec1a752eb0da7b4e8b5cc9ffe138814654a04142", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694446598, "uuid": "d35e2164-b978-4165-8ffa-12f58e1975da", "comment": "Malware payload (AgentTesla)", "value": "77e7aa9b58178d7d6ca4a107bde64de1063c5e015ecf7dfc87f6aab72e17c20a9f632f29c85dd66f1efa89cfafc34789", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694446598, "uuid": "4c5d9e81-737b-4dd2-8d65-9a667ccca2c6", "value": "T102240603B64A89A2D7885736C8DF09100375FD82A793DB1E398E73D50A733B6DD4A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694446598, "uuid": "9c48b1eb-26af-4ebb-9e83-7a7f72453bec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694446598, "uuid": "0fcc3ab8-ec56-4477-a89d-b871da6883ac", "value": "3072:HAMD66PZwYQ39/VKQg1S/q6UmnmEAHmFYAmQKK20+cbk8ur7F4L3BX:g+Pe9/r9UXEADAmQf5+Qk8yaL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694446598, "uuid": "c7547ea7-ac62-4879-bd32-eb08a716b181", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694446598, "uuid": "e8ec3ffe-627c-4287-bcf8-761a6281a30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694446598, "uuid": "db77d328-6249-4ba8-af70-9c78894c49b1", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.27690.30100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089e1b68-5060-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694408388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408388, "uuid": "3ae30ead-b002-48e1-bcd9-68cc5698fcdc", "comment": "Malware payload (MysticStealer)", "value": "0047317cca809d44c94570d1dc872d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408388, "uuid": "65c58d13-f7b6-4203-a311-0168ee779ba9", "comment": "Malware payload (MysticStealer)", "value": "6f9de685cc3db3689fda7269ffbbdd5a84cf0697a71150f7cdefa93de4b219a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408388, "uuid": "44471c44-7f16-4296-8e56-e92eeeac7572", "comment": "Malware payload (MysticStealer)", "value": "34414abe30647a37fe676a227387b7b0a35df3e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408388, "uuid": "72c0103a-73d0-4e4b-806f-96a8ff516f35", "comment": "Malware payload (MysticStealer)", "value": "06e666837f931db574526804eb1f414e6179fc7504bb7c9655bb378b549e5bfdf09a9362babb0e1b133c05844a0b2e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408388, "uuid": "9a87c022-67ce-42a1-a68e-312f73433daa", "value": "T14774C00070D091B3D833263A1AF59FB19EFDB6610E31CAEB93E4FE3E4A542D19A74516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408388, "uuid": "9e46b14c-0acf-4d9d-885d-5d2ee75cacd1", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408388, "uuid": "162bd0c8-9e07-4daf-a6ce-347b5fce2fde", "value": "6144:ZwhUvz6DCGbAR/VeDC1tAOiMCVqaNP7XJ1hz8BuLCrurBiIg:ZxvzaC+Uj9uqa59gurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694408388, "uuid": "64647c1b-d31c-4d74-8908-20ab694e4845", "value": 366456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694408388, "uuid": "613ff990-63bc-4e19-9cd4-1a39a40c0dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408388, "uuid": "5c872918-319c-4ef0-ba81-0047f43ab9ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7f38a1-5080-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694422410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422410, "uuid": "d134fa0e-808d-424c-b74a-3f80387959ba", "comment": "Malware payload (AgentTesla)", "value": "0a4c8ba54d3ad7f757b948bcced49e42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422410, "uuid": "8928150b-5878-4080-8f44-676f56ffc1d6", "comment": "Malware payload (AgentTesla)", "value": "6fd3783c5cd42c4c6a0495f17feb87d78b2a5ea565bbe40854050073fd4f6eaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422410, "uuid": "55b0a933-6ff1-4967-b82b-22c97d5dc2a0", "comment": "Malware payload (AgentTesla)", "value": "6497ef8f7061273ede16333ae2013c161b197759", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422410, "uuid": "908c3f55-672f-4b0c-9a61-74b35b7ae23a", "comment": "Malware payload (AgentTesla)", "value": "0e52ff45ad46352336571dfc6e3852e20e6cdfeb1d6fafda435ea4e3a1bf5b70401608bec4605a42b26780ec04948183", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422410, "uuid": "e405c05b-7f3d-41d7-be36-f2c441a7afc6", "value": "T16CB433817E9F991ACEDAB87A6004F41993DDAF4D478CF7C11094C11A35BAF43A243AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422410, "uuid": "51d5b84f-e93e-4ec4-ad7e-304e8053c833", "value": "12288:m/mYukkrQ5eMm0JJ1GABYSh321oeV7x2neTzllHtjkQ4:xieMTYS521oeCeTBJyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694422410, "uuid": "281a4443-7735-4978-87fb-026af1adc0bc", "value": 539600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694422410, "uuid": "5c8a3185-421f-4e6a-90f0-ea293ecc37a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422410, "uuid": "b2117077-a228-4b89-9baf-e86d6f8d30ef", "value": "PROFORMA INVOICE.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2356dfc0-5076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694417882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417882, "uuid": "9465ffe7-084e-44da-9407-03efc939de8c", "comment": "Malware payload (Loki)", "value": "838bee797200c70b0d6a2f86d206dc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417882, "uuid": "8641c688-63f8-4b95-be32-3f4f8decda1c", "comment": "Malware payload (Loki)", "value": "714019a91e02fadaeb6d80aefde39056f633a88bc6a933e809a52ec1ff56a666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417882, "uuid": "662b62f5-8537-4288-9c5f-95ca66b9d8c1", "comment": "Malware payload (Loki)", "value": "242f0f98f88621bde4b000280b38887454ce9e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417882, "uuid": "2fd9e73a-e581-4c06-b4e4-3865a61d734f", "comment": "Malware payload (Loki)", "value": "91ad78a6df387b1d894a17de43a87c9a67c33eaca96188e172a223ae0cfa5fbc9514d43b6c0f33c386bc7db32318483c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417882, "uuid": "ba2214ad-98fc-4aee-90b6-07e50ad7437e", "value": "T147C4F144B1AC395FDE784CFA0403B1514BB694363065E7CA8DD2A0D921DAFE436CAB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417882, "uuid": "f26ff34f-7802-41f8-8c9c-4b1385433204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417882, "uuid": "8fd7a717-6a68-4935-8a21-02253c7720ce", "value": "12288:BBrtqsefZi4vHgZRnvOGZZ3EvAhFSHcqAxgLt:3rUbfZWnvjZnF2Axot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417882, "uuid": "7061e65c-c8e0-4b99-8279-ce55d511e475", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417882, "uuid": "07997b1c-5f8b-40f6-a023-6b3ad51c5418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417882, "uuid": "c3500382-ead3-45d2-b9a7-825a91b23446", "value": "Order Confirmation 004172019Sep order_00417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b139402-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401171, "uuid": "3fffd7c7-ee60-4aa1-b2db-f1ad3716e75b", "comment": "Malware payload (Mirai)", "value": "fd5046a59bd769c1e4be1cad0fefd402", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401171, "uuid": "78214851-adc0-4783-9329-64a2f9ef816d", "comment": "Malware payload (Mirai)", "value": "7197ead2f7018d6b44c7166fb903abca324a47bde1fe7a2f2bdff2bd26c61e08", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401171, "uuid": "9e4966ed-9b8e-49d6-b612-148cd9d24fb8", "comment": "Malware payload (Mirai)", "value": "693dc55a5194166bf1948c80cb47973904b4a7d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401171, "uuid": "fd18f80b-a927-4329-b188-738ffeae7857", "comment": "Malware payload (Mirai)", "value": "60879a21c6d29ea7a537c4de984236ed87592e63e34ddffaa349e40f0a402bf381bace233bdf477943d8155033235634", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401171, "uuid": "46ef8847-d172-4242-ac2a-20c796d6a35c", "value": "T153D32A56E7408B13C4D61775B6EF42453323ABA4A3DB73069928AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401171, "uuid": "4353c1eb-ee7f-44f5-b0da-edc021fc540b", "value": "3072:lS6VGv+5uaDAFEsHY07NSIYwxGneR+SQkM/9iH:lS6VVuaDAFEs46NxgneR+SDM/9iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401171, "uuid": "f9a7910a-f1da-485e-b429-e851669da866", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401171, "uuid": "13531f61-50a1-437c-a473-5c1aa8df07c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401171, "uuid": "804e0f4b-adb8-4e7e-89b1-5a2262684cfd", "value": "m7.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba836fd2-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694416418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416418, "uuid": "08a79226-fb04-4758-a0c3-42d6c94ba844", "comment": "Malware payload", "value": "7547cac8452cf547c0c396b326eeae26", "object_relation": "md5", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416418, "uuid": "f2eb4e7c-260c-4b2f-925b-9b8bbad4b4f2", "comment": "Malware payload", "value": "721159bca57d1b66796bd3ddc0e68293cb290af6bbd263878d0bd09c0ee48caa", "object_relation": "sha256", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416418, "uuid": "dba289e1-83f8-4efb-ba79-b5b0f4521257", "comment": "Malware payload", "value": "3c52c961e60b75b80b51bd72b4aa3a2dfb9c0d74", "object_relation": "sha1", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416418, "uuid": "8e12a89c-46da-4e13-b9a9-0fa086bc434f", "comment": "Malware payload", "value": "dea567d8b3d9faeebcb8c571ce44ca1c670da7f1917e386d3e32c58fc278f7f3724306527025649a9531c9900c16dc4d", "object_relation": "sha3-384", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416418, "uuid": "52b49f02-a783-434b-b81b-556bf89e3022", "value": "T128132BB30613BEDF57270E41E50C2151DC59ECA762DC9DACBF8888E58BE41289DB8DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416418, "uuid": "5f4617b8-abbd-4501-9953-c328035e60ce", "value": "768:Z2hTt4KaeqDA0qjofUazoT7Rmpx2kfgnt/XpXc3ytS:Z2L4KxqDA28azoT7wpYkfgt/XK3US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416418, "uuid": "6a5c10d7-d7a5-4854-a5df-d7db59d85bc9", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416418, "uuid": "8136a6f8-13d0-4c19-9d10-029bdcfeca62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416418, "uuid": "3d166b45-9b51-4496-924e-5db57ae12776", "value": "N3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce275fe-50b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MassLogger)", "timestamp": 1694442970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442970, "uuid": "356c050d-a38c-4297-a2a2-178b13c8234c", "comment": "Malware payload (MassLogger)", "value": "fa49eda023f40f396456219a240997fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442970, "uuid": "e5adba99-681f-4b08-b855-97781535174c", "comment": "Malware payload (MassLogger)", "value": "7357f1dc4cc6b7ed24845f6a68defaf560af51e19f9cf31ffc2c008eb539dd39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442970, "uuid": "745a7f88-faa3-49eb-bbb6-61ebc84ac00f", "comment": "Malware payload (MassLogger)", "value": "25cb7adc4b0d09bbb2f4da3abcf1cb59909c5456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442970, "uuid": "499b8bf1-96bd-405a-b361-e22d6a39598a", "comment": "Malware payload (MassLogger)", "value": "08e722cf5acc85c405fd564b22c10370e793bc3ca544a806600e30d0694697fdbfe7b166c271a535a5f02c00fbc572e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442970, "uuid": "32d69106-657a-4778-bc67-e15659992559", "value": "T15883390E33D88920EAFF84B655B152210775F812495BD31E0FE0B8AE2F376D48A56F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442970, "uuid": "2b8e02dc-45fd-487c-a12e-306d0c66eb6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442970, "uuid": "61965652-fd68-414b-8649-0d2e2e2527fc", "value": "768:LJxS4BMChW5ryome3Z1cgEBwrLVyF/22lR6D0qHawyczKNjZsCgggA9bOgI4T09E:LJxSiMCHQoya2O1gA84p9DLYHx7WwkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694442970, "uuid": "7f986151-5d9c-4203-81b1-eb8a69ec8f75", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694442970, "uuid": "55b58f38-d071-4199-bc2b-ed9a5facc22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442970, "uuid": "670e02b0-b2f7-40c9-b35c-9b77605ed3fd", "value": "KrakenStub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d499b1-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694438762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438762, "uuid": "b857aa7d-c004-4a5e-a8d2-751a92d6888b", "comment": "Malware payload", "value": "786b2a4ec6062ac59bffb48668a8c04f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438762, "uuid": "dbd089b5-b5a9-4b54-b81c-6acc6d937f8b", "comment": "Malware payload", "value": "735ef7a8cc4c0fb1d6b17e15839891c5c42af415e4b91977274d9bbd836b2b81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438762, "uuid": "648d29ec-f631-42a0-bb31-25598b4b6c04", "comment": "Malware payload", "value": "185c9819354b2951a658325de6e7d22bfd41d145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438762, "uuid": "9b0d35fe-8015-4def-b48e-034a027b77eb", "comment": "Malware payload", "value": "d00a56515f9e5db685d546fb9dd95a8e7e4e6dc5be7b896ca18019a6a6f747645e0043ddcf3b9afabae07e4bdd980c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438762, "uuid": "b1e989e9-e4a0-473d-bc81-6f510c7e7218", "value": "T12174C603BA96C9B1E2C81736C696541417F6DFC277ABDF0B798E23A508037BADC89507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438762, "uuid": "c06e4b9f-5805-4ff6-81b7-f710f01f3c4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438762, "uuid": "33803991-d5d4-42bf-bf9e-0d06027bfa29", "value": "6144:JgYFIbGlUOFBiSxVhIy+BcKJvAXUPmV0mll7mU8XQpmQHsmoF1E37hdSPuwPnw5B:GEjFhUzlkgkVGVnfKCN7hiXfENmv+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438762, "uuid": "7ae3caba-af0f-48ee-a6b1-c8588e5897be", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438762, "uuid": "062acf00-79ff-4176-bde9-2eb3ee32240a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438762, "uuid": "0bb2f0a7-ed0b-49bb-afbd-4e29eeff8f6e", "value": "Letter Of Intent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5228f0-5087-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694425230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425230, "uuid": "511b7b58-31bd-4cf8-a535-a05bff0500cc", "comment": "Malware payload (Loki)", "value": "43d6aa62427fda7e63d503d069c22f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425230, "uuid": "6595206c-786b-4b65-b1aa-0e1b94147966", "comment": "Malware payload (Loki)", "value": "74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425230, "uuid": "e371a9ec-a3c1-4a1b-b6f5-fed727a37c51", "comment": "Malware payload (Loki)", "value": "2cae45a0d2723b7cb3b9a9eb89f26bfe3776c034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425230, "uuid": "43ed87fa-4e47-487c-9abe-5e66c428fc38", "comment": "Malware payload (Loki)", "value": "51b51219647f2f86ca777f71884b9357c0a248c76f8d1ae247607d6e9458147ce6da2864a606a2ae4cbc04124c09e691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425230, "uuid": "5a187264-4472-4495-b88a-6278074cda7b", "value": "T14724AD13A9E0BC61D65347355F2E99EC3B6F78726E248B1B32041D5F1E312B1EA63326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425230, "uuid": "b03a475f-8d7f-43aa-885c-58fca532b133", "value": "f815858bb8146375fb6d659cf6f7de7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425230, "uuid": "f5a16f58-9034-4d31-abb1-ca0acfc8bf50", "value": "3072:ARpsLVByCZ7CQLyCNfg6ALiF6CJnFbULE5ATYd6xZ:lLydQLyUgL0FbETYd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694425230, "uuid": "8fdc2cab-6e22-452f-81fc-1239b23e223d", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694425230, "uuid": "052d77ab-a301-448d-9989-26017bcef8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425230, "uuid": "5c9b1a8e-cf21-44fe-8f9d-5b0bbeb74814", "value": "43d6aa62427fda7e63d503d069c22f63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0994da3-5082-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694423273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423273, "uuid": "e29e83c4-f74f-4350-904b-e70bcf78b1ff", "comment": "Malware payload (LummaStealer)", "value": "8126b593d03a5c9b4f8f0bc25d37ae2e", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423273, "uuid": "1dde3ac1-f940-4149-88e1-1a60770cf2a1", "comment": "Malware payload (LummaStealer)", "value": "76e4962b8ccd2e6fd6972d9c3264ccb6738ddb16066588dfcb223222aaa88f3c", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423273, "uuid": "4d17cc0d-2693-4a7a-9675-1aecc5c1efb9", "comment": "Malware payload (LummaStealer)", "value": "e8b17d6c7811da116a46b422aa7d86ca6882d673", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423273, "uuid": "c2c6e67b-4f81-4511-ae22-5cd2bd32fc16", "comment": "Malware payload (LummaStealer)", "value": "c733d0561969a6836301f24e86bf07b1bf71ff56ab3416f846d69fa955f1f6dd42e0b30293c685b0b22d52d36a4a758f", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423273, "uuid": "cdcfda9b-1294-4106-a6fc-bc60c7aac54c", "value": "T196666C21754AC53AE66A41B15A3CDAAB513D7FB20B7244CBB3DC3D6E1BB04C21236E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423273, "uuid": "7b082976-88bd-44a1-bca6-9790f8b34623", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423273, "uuid": "d0ab24a9-4f65-4930-9374-beb51457f4fd", "value": "98304:z9iZasQra4ios7RjnRU4UApr2Y5aslkPc3NEjFzyISaS:4Za5+osNbxr5Cc3uzy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423273, "uuid": "4c570ff3-e374-4f01-94be-c333476ea09e", "value": 6812960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423273, "uuid": "44f87df5-8c0a-4f6e-8a1b-c536f8ba0a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423273, "uuid": "5f758688-8b5b-4c97-b8f3-b1b4c59223b2", "value": "\u0421hr\u043em\u0435S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458e2f2e-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450581, "uuid": "e4890162-621f-4a5e-a6e7-9fa4a58d73f8", "comment": "Malware payload (Mirai)", "value": "be6d6ac4448be412e9f77c543686bb90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450581, "uuid": "361949c0-3fe6-488e-ae68-4a80706e3eea", "comment": "Malware payload (Mirai)", "value": "78b477ae2bbaf19cf180aad168da4c84354140762ac33903bc40124be8d055da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450581, "uuid": "73310b66-4734-4735-9582-d202db082e53", "comment": "Malware payload (Mirai)", "value": "5d31e419985e7ccededbb1b3b182e5b4db568d1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450581, "uuid": "d05e615b-9e9b-4259-b0df-a4b5be93b112", "comment": "Malware payload (Mirai)", "value": "5ee165f1e676f1116b95205579e2e20a130c186568ea0e9118fa1b6787f68749d931f024e888bb32cbf353fe41131082", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450581, "uuid": "808a76d0-98e2-4668-b7eb-a99b8feadb1a", "value": "T19C435D42322C0E57D4A61AB0253F17E083BFFD6014E4BA84694F9B5A8A35E771586F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450581, "uuid": "737a1a96-6e27-4aa3-b2ef-40c4bd8140f2", "value": "768:4YbRczG0TQrVR+9BxAJ5yaPvY2VuRvRxE1QCUgka0RjT68Hco1ksG36nZ71dUr:b35rVm2BSO1QCNKgo1ksGqnl1ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450581, "uuid": "ef340fee-0c67-4666-b8aa-cc8ee9065582", "value": 59880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450581, "uuid": "20a6b72c-9f08-46da-bfff-12385875c36b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450581, "uuid": "249a368a-5b18-4ace-bf01-bd46ae271513", "value": "be6d6ac4448be412e9f77c543686bb90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89c7c8f-50af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694442641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442641, "uuid": "5c88a89f-7c9b-4203-a41d-aa1aafb3302a", "comment": "Malware payload (RecordBreaker)", "value": "2d90b722c0e5bf781efbb184143cffcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442641, "uuid": "b301b365-6575-4f63-853a-b6db9d37ad33", "comment": "Malware payload (RecordBreaker)", "value": "78bad359d0652879dec380fee12b68cc4e14e4f63f8c4e23e7b75bb5338d5924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442641, "uuid": "fd89e436-0e07-49b6-a815-8e6cfaefed7a", "comment": "Malware payload (RecordBreaker)", "value": "dd114bc7c9ce22ba97af079769fae802511cbc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442641, "uuid": "892c1042-a85f-46fe-8e45-1f249b396d6e", "comment": "Malware payload (RecordBreaker)", "value": "597d2ab412d7975d565f34244cc40a9468153c4c450e09dadc560e4db1f84b410cfd1aa78a595dd4d0c59a9c476b8e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442641, "uuid": "902e1867-fd96-47fd-bb0e-fa6b598bab1c", "value": "T165547ED39F907CA1E5268A339E2EC2E4B61DB950EF1577ABE3589A2F047C1E1D172310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442641, "uuid": "d044e5f7-fa79-4b84-a652-5c1dc8b64aa7", "value": "9510dea81cc5ce11a4de430720afcd42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442641, "uuid": "da559c69-1257-4c24-8e56-bdbdb540c5ef", "value": "3072:ZPslGacootsgK1gM7165P9XIU6As5nbkdwxL4oI+VR:2Ekotsgag994ks5nbko0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694442641, "uuid": "f1bd0582-1cd9-4b81-bf10-83ec10989c9f", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694442641, "uuid": "31c010ee-0f04-4a48-819a-d1f9927c3fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442641, "uuid": "997ff279-f14d-44c4-952a-966c840cc1f0", "value": "2d90b722c0e5bf781efbb184143cffcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d030f8-5085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424377, "uuid": "3159188e-70dc-4fa1-ae4b-b449f5aa8fc9", "comment": "Malware payload (AgentTesla)", "value": "7df1c1c3c3b0bcf12254271b06afbe77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424377, "uuid": "83fc37df-9864-4568-9251-22e45effd7cd", "comment": "Malware payload (AgentTesla)", "value": "78f2ad1cdf2dea5d464a5a0ff7fbf06cbc91e5a8ba6a6c312a9145f6ca8bf2c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424377, "uuid": "d58888f1-46fe-4c94-94ba-6640859b429e", "comment": "Malware payload (AgentTesla)", "value": "cf689036c4f6183eda432cbfb3d16fd5900106f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424377, "uuid": "41e26b6e-19cc-41c6-a90f-746da8a2c82d", "comment": "Malware payload (AgentTesla)", "value": "9962d34d3ca8cdad9e7e601d338acfb530db1d978a6d62283bc36b1c25e65b0fdb90bffabc6b383a2e40324ae79d792c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424377, "uuid": "2154195c-2a23-4f42-a304-78687a442179", "value": "T11ED41202373F8731C5ADC7FDDE6605182BBA242EA215F38D5FCAA4FA5A233448551DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424377, "uuid": "8946fd75-9115-49aa-9410-3ff09dd82797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424377, "uuid": "34497eee-8374-49c0-abe7-10985527dd6d", "value": "12288:81Drx4Hzwt6mpTyny4EvZO5PgxDioaZNjpT/wZEOe6kic3b:0Drx4K6S5RUPsD/uNjV/C/Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424377, "uuid": "ca6ef102-273a-4e42-8c4c-af5360b18c52", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424377, "uuid": "cf0125fd-7d4f-40d3-9c41-ed0d6ea4b436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424377, "uuid": "9c5da9af-8091-43f1-8e61-23361c1573dd", "value": "DHL_9223456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2514dc7-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424215, "uuid": "98d6249d-0cea-4939-9da5-99eb4788f33f", "comment": "Malware payload (AgentTesla)", "value": "51e71d96358843402e3b178baa54217a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424215, "uuid": "22f57570-2f79-4961-9232-14be54170d2b", "comment": "Malware payload (AgentTesla)", "value": "78f85782d64fdb70e1cc27d2c1564656748ed363f0b4d7fcc523cea165209a85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424215, "uuid": "86b6de5a-a558-4e76-918e-4cab16dd8071", "comment": "Malware payload (AgentTesla)", "value": "ece33694b46b6650a1855e167e9d47207040543c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424215, "uuid": "9f6fe3b5-94de-4b2a-9e7d-34edf81f5e76", "comment": "Malware payload (AgentTesla)", "value": "18433c52d6f321f96c21f11d349be59c7b6897c5c1668b0024832f9ab931e2b4010efb9ba734c7dd9bfd2cf63190aec7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424215, "uuid": "cef6407d-071b-4295-861a-d81d5088f18d", "value": "T108F43315823ED5CEF4B8107A15CE5129FA1A2E2EB50EB33E675CCC8C0C9655B3F6568C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424215, "uuid": "52efed65-ae33-4661-9e97-08a1919a451e", "value": "12288:eAnWS+qanIzXTSXoVuEDp5Iw+V/N1c2ZUEmt8saR/4WOi72AB:HYqKWeXgDp5af1/saR/4WOc2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424215, "uuid": "25ad1570-2b8a-41a2-a724-8446c34d9dfd", "value": 743761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424215, "uuid": "da2e41b0-de6c-4d79-83a1-adf641fd8042", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424215, "uuid": "f4fc0c6b-9ae3-46f0-88b8-4ed5823f4c5c", "value": "4502167997.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19960e61-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424738, "uuid": "98bb10d9-14b9-4fe4-8202-285784c168eb", "comment": "Malware payload (Mirai)", "value": "09ca76b474cab63cc5e065c1b1227b57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424738, "uuid": "c62f49e2-f507-47d9-a3f3-e27b544e50e8", "comment": "Malware payload (Mirai)", "value": "7a008661f6ae40bc104dee05e928939de45f3a709846e21884bff00296a529b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424738, "uuid": "14c1d5b9-43c2-4078-a2c6-2c9c1ea74779", "comment": "Malware payload (Mirai)", "value": "260503d2dcee46331b81827c1cb88d2e3c287a73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424738, "uuid": "de06d17c-67d6-44bf-a052-4eb32fb9a184", "comment": "Malware payload (Mirai)", "value": "2b083cb650610d03fd5b323c2f40cb55a083401d9590dab9faddf49ef297e6922041a03f6cf7938618b0a54ca9bf513f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424738, "uuid": "4fb08708-2dd7-469c-b64e-2df1f5643698", "value": "T1D2D2D03C8B47B9B0A1F4143556BCD005269B7BA9E0D27EB36A3123A8B2DC4529175FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424738, "uuid": "086f5ac1-2790-4306-ad2f-42e3d5bf3ba0", "value": "384:4UnoYkJxRqai7gQ9teuhnCfqhJIQ62zsSfz02SzNWfMa6ucZpcjRjQ152hymdGU9:UDWUwllhr629w2SRN2cZyCQs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424738, "uuid": "9799adfd-914b-4e72-9a53-6fa5e088b56c", "value": 28628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424738, "uuid": "5b01c967-5cd0-44b2-bf08-8e9a43d8e4e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424738, "uuid": "c1ddd01e-6241-4951-b8e3-5ee03b02c1e4", "value": "09ca76b474cab63cc5e065c1b1227b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042d6f13-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395496, "uuid": "c7e86a86-b393-4589-b4f1-9b55cf7e6fcb", "comment": "Malware payload (Mirai)", "value": "e0ffde5e8148ee9ea94b3a5a41a980d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395496, "uuid": "f13e7d13-91d6-4aa9-8ab5-c37a4fd50acb", "comment": "Malware payload (Mirai)", "value": "7a5e6503f92e54826442048df743e6dc7dc3134ab3f0720e5f23ccecb6dbbeae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395496, "uuid": "134f8857-e444-4f2f-b58a-243ccfaaf28b", "comment": "Malware payload (Mirai)", "value": "8bf499307c3eb1598b530f47282bb0327b022d2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395496, "uuid": "6decf193-1095-4e66-b9da-5591df160ee7", "comment": "Malware payload (Mirai)", "value": "2d12af556f79a22b98e6f038b5c8f79299b35b39eb7198e1e615dcd883ebe5c60202fde82943a343461682f1fb314c8c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395496, "uuid": "fa253b33-7fd8-4f24-a5b8-abbe9ec04f92", "value": "T151735BC8BA83D4F1EC5309B2513BA7728773E12A546AEE42C72DAD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395496, "uuid": "dd342272-fc28-4d90-a1ce-128a35064f06", "value": "1536:ui0zODnGDoKB5KA1F4oVlpdtqNEloSjot0r9Ceya:f0z2nMoKHfqoTLt6k1j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395496, "uuid": "1c270c18-5598-4ad5-8217-8b7b76820059", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395496, "uuid": "3060b5ff-ac19-479c-b9a1-2f094e29cf80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395496, "uuid": "3797db1a-3d54-42c9-9155-bc24d084c257", "value": "cundi.x86-20230911-0124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d84fab-50f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694472647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472647, "uuid": "656200b9-175e-4050-b548-cbefa57a6955", "comment": "Malware payload", "value": "b0399ed1bae59f87bae4898f0f8dc1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472647, "uuid": "a0cf3b09-9169-43be-bc64-c718291028c0", "comment": "Malware payload", "value": "7b0efba8c51a5f83078f28a6db7129d43db9d4ae71818e2f5fb755dc721880dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472647, "uuid": "4e158eac-9538-4292-948d-a02cb5659cd1", "comment": "Malware payload", "value": "53e0b5f34beecc640c72de25fad776b0fa1ca5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472647, "uuid": "7a2abc55-33bc-4397-bd70-2c645d0dca55", "comment": "Malware payload", "value": "cf75d124780c96cbc526d6b022d8012128b572036cc716a1ed49fb85e29036105a3e748644da02354fb04eff1ea5eba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472647, "uuid": "0d872ef0-312e-4996-9c81-55636b013349", "value": "T1BFB40140F391E055C18D81B5C977C5BA53667C1899249BBBF2A4BB5F2E363C3403AE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472647, "uuid": "0eef5a93-c936-4957-accf-277444335fc3", "value": "4fd11f5c9a089e7b45c77cd8b5fde1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472647, "uuid": "d40944e2-e364-4696-8f47-96dd7b8d145a", "value": "6144:3VuKq99UF5hvvfjhEKq99UF5hvvfpo32NCKlAjwjlsk5qv6sblzgaeEubfpR0cQ3:wQnDSQnhCrwjqk5Ablzg3bf7RQrOtylR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694472647, "uuid": "96b2c924-bf30-4051-86ed-c9a01c5ee9bb", "value": 516046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694472647, "uuid": "14f8a25a-d133-42b1-b8c6-eed15bfa677d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472647, "uuid": "27099ed5-84d1-4cfe-a60e-578eff1f07b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b657d7f0-50f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694471386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471386, "uuid": "9e09d249-bf1f-4815-96f5-a632006c2cff", "comment": "Malware payload (Smoke Loader)", "value": "33bffe6a54a9754954c0a98eff56a54d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471386, "uuid": "5507f195-cb25-4582-8416-e66e444eeefc", "comment": "Malware payload (Smoke Loader)", "value": "7bc01f90e9b2c6003233657e4be5c56c8bb70d4bae118998bf75f7f1ed6b7b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471386, "uuid": "0f1000a4-3dcd-45b9-b883-c6370a658150", "comment": "Malware payload (Smoke Loader)", "value": "3c21f73977e833b443678ebb39648647b148d336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471386, "uuid": "b30638c3-8286-4780-b911-38d3cb22f8a9", "comment": "Malware payload (Smoke Loader)", "value": "9bd284ac877c43272a60423617f076354290e0605131d2f3c247cbc0572b38f98dadeb43a2fd3a294372257b3a769cb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471386, "uuid": "7ef4c16e-0d94-4422-a4d7-6f07d303998b", "value": "T1EE544C039AA17C61E52E5B729E2EC6E5361DF7508F1977A722186A2F07B01F2C673F40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471386, "uuid": "00fee0db-b819-48a3-8158-eeed68095b11", "value": "fd6dfb11bfd672e911229df79ae69bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471386, "uuid": "48977898-ba95-41d7-9c12-6c416cb013d5", "value": "3072:PwhmOzJIoFrgJPAXVgBoX5s5QYqIKyP/W3KE5ScBJBLzK/y21DGuPqF:YgroFrgNAzs5Q0Wmc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694471386, "uuid": "6bfd3398-340e-4b8b-8531-c370f1717b8c", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694471386, "uuid": "0f0ae34a-f673-4a75-94cb-a2a2757354ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471386, "uuid": "93b08241-76d6-48e6-a1ab-469dea951d7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c98a0d7-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395510, "uuid": "5d97868a-030a-4b96-85cf-3c125fbf0d7c", "comment": "Malware payload (Mirai)", "value": "2b7d7994b3aa8717bb4cbf1437cb9c25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395510, "uuid": "44dee837-fd55-4e19-894c-4838960b7344", "comment": "Malware payload (Mirai)", "value": "7bd41f11ce5e9dc457ffa6949cec4d67a94b12180af722c7cf959501ad1b67f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395510, "uuid": "4a98e6aa-2510-4223-9655-1081af766189", "comment": "Malware payload (Mirai)", "value": "2718ccdb56589e673d92571f82fd62bed24a27bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395510, "uuid": "92b98e31-934d-403d-9aa3-8c4e06c7f389", "comment": "Malware payload (Mirai)", "value": "6c1439135a1d0e818d54eb6af3acb194bf13858d56e8ae7886ade63a37efa66455ff56748b665d5b999b40bd25ebb20a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395510, "uuid": "980a0f95-9914-4eb3-bd99-aa589e5357c7", "value": "T147F3A95E6F338F6EF668873147B74925975923DA22E1D684E2ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395510, "uuid": "6ad2444c-3848-48d6-ad44-72a491f15ea7", "value": "1536:9MXVed89OdSAZTZtZd9BG9rc0eNsslP1zKTfNYoDF8jkmx7y0K:9MwdhZtv9BercxssDwYo58jPx7y0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395510, "uuid": "6e432843-7819-433d-817b-79aa5c8afee5", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395510, "uuid": "6e248979-4f1b-4d18-8a60-948be50f375a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395510, "uuid": "dd31f83b-f436-4fef-84c8-0f0455ddd737", "value": "cundi.mips-20230911-0125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252793ec-504b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694399417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399417, "uuid": "437feeef-7c9b-459f-8949-02ce9f65ecf0", "comment": "Malware payload (Amadey)", "value": "5c47cceb8a93d6f764adeffaa32ffc80", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399417, "uuid": "af280729-dbd5-42e9-89bd-5cd6310ec863", "comment": "Malware payload (Amadey)", "value": "7e0094b1a8d01513026e884153221c5783e29a1db82101e0439333f2ac91544f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399417, "uuid": "fb542ded-e6a8-4623-9aca-943dd1457479", "comment": "Malware payload (Amadey)", "value": "bb13722255ffd987eafc748333f603d321fe8535", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399417, "uuid": "b3a72001-b1f6-4840-81c8-bd2818f96d76", "comment": "Malware payload (Amadey)", "value": "a2582972e08eb26362b91cba49429ccb5138df0111738723046bae9a0c9c0454c79199e0f1de5d91986c496ee76aca43", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399417, "uuid": "7d731788-d085-459f-90fc-3df1fce137b4", "value": "T1C9349D1174E1C472D832193609F0FBB65A3EB9600B6199EFA7E40F7E4F202C1AB75766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399417, "uuid": "89d3fa80-024f-47a0-b623-5243c288de5f", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399417, "uuid": "db0d2b7c-c23b-4b92-93a3-bd4b415bbfb6", "value": "6144:bIPUgz6DCGbAR/VeDC1tAOCcCNxUmLGTurBiIg:bLgzaC+UjZnTurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694399417, "uuid": "6622db46-209e-40a1-b0eb-8367180c7cc0", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694399417, "uuid": "33b7cd0b-36ca-452e-8d78-0f5c49e2d333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399417, "uuid": "132a3ebc-7fd8-4792-809b-ff3398233804", "value": "5c47cceb8a93d6f764adeffaa32ffc80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e63c4e-50a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438237, "uuid": "e1c2f73c-7f25-47f8-993b-10fc30e06c70", "comment": "Malware payload (AgentTesla)", "value": "866d2c867c74f9308fd494b03e1d436b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438237, "uuid": "f0a4016a-3a97-4cf6-adbc-d7843c23addb", "comment": "Malware payload (AgentTesla)", "value": "7e9bdb1dfa022a576d9abf98db707ac34801c01bd9c07791794d4ae3712f05da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438237, "uuid": "8324f34e-59a9-449f-b268-010929ab3a3c", "comment": "Malware payload (AgentTesla)", "value": "2ae50340d224342ab727b96157bc4eac8ac03f6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438237, "uuid": "bedcc9a3-e8b2-44c8-964e-5711fa83d0b6", "comment": "Malware payload (AgentTesla)", "value": "a9eed9370a4d31a5cba342e75f2fe67ebaa521a6cd95ffb39d728a2d9d8d0d9f54e60e2cb2d1809fa074fcb1dae44b79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438237, "uuid": "c9c5d14d-869f-43c5-a13f-dab66d3023c4", "value": "T17E058DEC725075DFC967CD76CA942C64EA6024BB830BD243A02315ED9A0DAABDF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438237, "uuid": "0cbf53cc-1905-4048-a9b1-b4e6580c2b42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438237, "uuid": "89168696-2483-4d20-bfbe-6f77ca760d49", "value": "24576:E0fAHm1RkDV8rO7CYqlhL+2qaCn+xYwNc:EoAHmwJ8rSC/9ywNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438237, "uuid": "9cda98f1-1f24-4122-9ae9-f005f06c2d2e", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438237, "uuid": "9487f563-3909-422a-8bc0-6b5a9d9ee6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438237, "uuid": "e76af798-93f3-4f18-b4ca-a0b4a9b9ed54", "value": "New Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa6fd02-5047-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694397663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397663, "uuid": "af0b0eec-48d8-4023-aac7-00242bb74587", "comment": "Malware payload (Amadey)", "value": "5a87d548598caaaa5098b42864d2ab61", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397663, "uuid": "7c6f0ae0-9585-4b0d-9ffd-306bb82d231f", "comment": "Malware payload (Amadey)", "value": "7f58a7af82d23f8e3d96d59d475f17a532f342850a4ff1b5a002c53244ed3178", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397663, "uuid": "48a37e1d-6d35-41dd-9c5f-c6c1898eb7cb", "comment": "Malware payload (Amadey)", "value": "a57e92a45d1adca2b7ed38111ef9aa9e6fe809c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694397663, "uuid": "98f35c3a-7282-4b4a-b551-c42ed93d37ca", "comment": "Malware payload (Amadey)", "value": "55215f12689a762fc58858c98cc0db6791f924ab00fc0a11e3c309658fefcfd100906ec9b29abd5804f7c432ac2d228d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397663, "uuid": "defad5f7-2ac8-4e03-a8ce-c95d499ebc6a", "value": "T11F65122479E5C4B3D83211326EE1C379DD3EB930175A48EF63A44BAF1E75241AB3126B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397663, "uuid": "33e06145-b209-43cf-87ef-539336711413", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397663, "uuid": "834d4aeb-9401-42cd-9d82-3e4ecb568344", "value": "24576:bzKCJvBrC150HwpHgE2gfpuaD2hU+jfu2BEdNcnjurXmqz0iO1u1Hg:nKCJJ+vHHX268acbfuHdNaQXmqJH1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694397663, "uuid": "b27e1ca7-66bf-46e1-abc7-d6fbf8ed7230", "value": 1471864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694397663, "uuid": "817fd20b-75ab-4e57-936d-5fd046fa768e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694397663, "uuid": "f509b890-da0c-4552-9971-acb0f41d1115", "value": "5a87d548598caaaa5098b42864d2ab61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ffc140-5074-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694417235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417235, "uuid": "5aae99c8-e4f5-4ea7-99cc-9b2493c1f9b8", "comment": "Malware payload", "value": "fef7278b081b595b13c7a975a0079073", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417235, "uuid": "3e4213bb-dd41-4320-856f-a7a3db5eb58f", "comment": "Malware payload", "value": "7f889435f764e6b7b3a5ae2716b60c390b66ebdac332c4bd198fa6e4f6720cd0", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417235, "uuid": "9dafedcd-7829-47f6-80c8-5c888dc24ce8", "comment": "Malware payload", "value": "69e837896d501bd8dc2bc9043421cdd2f75478a9", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417235, "uuid": "4d97360f-fb96-4355-b20e-db9a58b53c99", "comment": "Malware payload", "value": "5624a8acc960a454c6d095cfdbaa4ca2b544994dee9c7609f0be088814ba6f42bb165d92d54d9d638080c4016e6027a6", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417235, "uuid": "07d17c9f-25df-4034-8b38-8c2a09265e41", "value": "T121D02B4387B01C2DD717E6F90472C23C036EDA600024867713F00400DE508C59BB31D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417235, "uuid": "c33addd2-3c50-4f03-a2bb-8d831464cc44", "value": "6:wLl83X8wXLj/8wXL1t8wXLxsm6dKhw6dwC8/DvmWa0qMmKKn:w88wXP8wXZt8wXodK0Ce+D91ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417235, "uuid": "0110f075-79f7-4bd6-b09b-023a742a9869", "value": 283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417235, "uuid": "a4a84211-26cc-4206-9b28-bf6e968bb8c1", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417235, "uuid": "5b62b53a-1d42-4bcf-806c-5e15d8c13045", "value": "Document1.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c79354-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438775, "uuid": "d831dc7b-8f87-4656-8b47-dd524b1a1cbd", "comment": "Malware payload (AgentTesla)", "value": "594610d0361ae8824ac2d15198142ab9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438775, "uuid": "3aa2cfdf-6ae2-4a0a-8980-db2e9d6f2efd", "comment": "Malware payload (AgentTesla)", "value": "81db5f9c8b5cb749df9c924b012e10ad4122fae540ccd7b0778d7aef918aa128", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438775, "uuid": "4f572787-2020-4f9e-ac7f-3dd073429cd0", "comment": "Malware payload (AgentTesla)", "value": "dd50bc749e9784a73bb2081d187c7e4d7b43246e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438775, "uuid": "b214c4d3-70df-424c-9b99-5a78e716952f", "comment": "Malware payload (AgentTesla)", "value": "fdfaffde240f5a27b5e1ae213557d69b09fed9e15afd15ad1b25699d62a7bffb3484ba5c0dcb2603d71dfe5351eae1dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438775, "uuid": "a58b8afd-f834-4e6b-b475-2cd500245e6d", "value": "T1453572BCE211D8D1E13B0E2DEDD100ACD22451F9DEBF9153297F238C6CA2456A959FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438775, "uuid": "00cb5034-d6ef-41d7-8bc9-2df153c1a58a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438775, "uuid": "a19c20fa-4a99-4c4a-a198-41295f7c6ace", "value": "12288:pCXer+6p6qWip6qWD7YTVNs3EjXcAuZB6D3Cnb6LP/o4:EXE+6p9Wip9WDaVNs3ETcAuZB6qC/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438775, "uuid": "d9b6ef17-a592-494f-b1f8-195512dc3a4e", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438775, "uuid": "92983c7c-c77e-4169-bfd4-ef8500fa33bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438775, "uuid": "11cd79fd-a345-416a-b3be-8f9c918a3e21", "value": "SHARES TRANSFERED-CDC INVESTOR ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ab463c-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438747, "uuid": "15cad3df-ecaf-4856-9b6b-fecce95ef0d0", "comment": "Malware payload (AgentTesla)", "value": "f57894817da9f895b9da8c11cf244490", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438747, "uuid": "4bc807b9-f162-4a9e-8719-4c65ebb73b56", "comment": "Malware payload (AgentTesla)", "value": "82ea13e3df992fe80ce922ae1a79e5435e55c9875ebea2b1d4d643e1ac8733de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438747, "uuid": "9335ca2f-100b-430b-b8fd-3b029ddade86", "comment": "Malware payload (AgentTesla)", "value": "00b4ec837afd887ff08455a534c0acf562be4eec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438747, "uuid": "a36752ec-630d-4544-8d6b-5ce64f6c12c2", "comment": "Malware payload (AgentTesla)", "value": "55d88d00d8dd8a48ff1fe4726c523181f0663355560211793860d16b0cad6a78d0903c22fee18f7027f1dd2c322f60ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438747, "uuid": "f386eee7-2e6e-4c2a-a637-07831153b156", "value": "T177341D037E48EB15D668393BC3DF2D2413F2A1C70673960BAF49AFA625412536D6E32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438747, "uuid": "630ad470-98ce-4950-bdb3-4e6041e2694f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438747, "uuid": "0ad290df-122a-42e8-93aa-3ab795382f6e", "value": "3072:+p56p0giMUP25ihLq3GtUEKypo03VE45xgSnR538:U5wiMtohLqWtVii62xgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438747, "uuid": "f373ef6a-275c-4dfc-a4dd-1930009dabea", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438747, "uuid": "5ad1de8b-1f3e-4342-8a33-1e55f650a41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438747, "uuid": "7cada45b-c3b9-4ceb-84a3-d7be7721e3fe", "value": "82ea13e3df992fe80ce922ae1a79e5435e55c9875ebea2b1d4d643e1ac8733de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c95a79-509d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694434819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434819, "uuid": "b542f32e-92cf-4f07-a639-f54ec1fb066d", "comment": "Malware payload (AgentTesla)", "value": "d240eb0937fa00eef6977bac32111831", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434819, "uuid": "b9b30055-ced6-4c36-ba13-e25b33da5fbd", "comment": "Malware payload (AgentTesla)", "value": "840b54aed2cac2e9919f536c3e8f481daffb72b3643e482c92ab356357a1fd4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434819, "uuid": "b09b6040-4e98-4981-b4da-3c13a5357ebd", "comment": "Malware payload (AgentTesla)", "value": "fe037d0f9af4b591a83e8f7c108ddf9c24b40ded", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434819, "uuid": "516b1033-b2bc-4099-bba7-de884278c6a7", "comment": "Malware payload (AgentTesla)", "value": "03488c4ca822d700fb1e428597a0481d0efc02e96bfd8dc9fe83986ffbd96d6fe868f73d2a07c5a5b7a714c270af6e86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434819, "uuid": "e05cdf9e-1ce6-4156-a767-f60732ce6255", "value": "T1CAD423F35E60EAC84760B5481C5A8C5D0C147AE7BBE9809C71E613918BF63360BDB5BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434819, "uuid": "088f1ba9-800d-42b0-bb8d-947eadd191ef", "value": "12288:9D30dShoCkn8HPfX0i5CTJgzdVwzktwM5G0Ym:p0rnE0UkJgzAHp0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694434819, "uuid": "a180aad3-bff7-468f-9a5a-0a2ddeaa748b", "value": 616551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694434819, "uuid": "3de9b796-a7b1-43f7-bd05-4401477d0373", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434819, "uuid": "25a35253-d535-4d5c-a7be-8bca8dba22b9", "value": "debit note pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feac0dbd-5089-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694426410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426410, "uuid": "4e7fb8f8-e9fa-4a80-96d1-ea6344807c0e", "comment": "Malware payload (AgentTesla)", "value": "d6c4f230fb43bad2824d307a2f35354d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426410, "uuid": "f29bfb03-9d4a-451a-a6a4-e7dca112d008", "comment": "Malware payload (AgentTesla)", "value": "8418ebee87a14a2ecbf14dcab28b5b311efee6d4a66cf95ff6c748e35320485a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426410, "uuid": "7de08456-e0f3-42ba-abae-655133236f4b", "comment": "Malware payload (AgentTesla)", "value": "a2ac42d5dd911d3d896755698b11dbfe5745ade6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426410, "uuid": "6c03b2be-2864-42b7-ab3c-6cef32af55db", "comment": "Malware payload (AgentTesla)", "value": "b9dd4f3c400c831e7b2ab394cae8d5d5a8440e4cf00be5f7d1c0a4bdaad25a2cfada8533eb92c9caa56f9eda58a620b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426410, "uuid": "b7bb621f-f650-478d-a0d2-301aa8285417", "value": "T168E4DF9C325076EFC857CD768A981C64FA61B47B930BC243952312ED9A0DA9BCF251F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426410, "uuid": "3974c328-4d1b-4d65-9370-c96accf7b166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426410, "uuid": "c6624961-a221-47f6-af38-5470b0544553", "value": "12288:0BQgohWJb1yqu4aeasXVx6YAjtJJ7v8OBSnS2MafLM15fVsbR90SJ4CHoSFrx:0A6Zyv4aFmtWJv8hnxLatO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694426410, "uuid": "f79143ef-c313-4890-a663-4bc31ce44dbc", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694426410, "uuid": "69403cbe-d58d-4e36-b447-83504bd0ef5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426410, "uuid": "92e54778-f036-4519-aee3-8d77b2ccb99f", "value": "Proforma Invoice..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf2a09a-50aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694440527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440527, "uuid": "d0feb6a5-0e80-4f18-a446-b6c46722b507", "comment": "Malware payload (RedLineStealer)", "value": "e789bd7c43179357bdce12f1d027b239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440527, "uuid": "2334872c-d7f0-4e0d-af02-26df432a2cae", "comment": "Malware payload (RedLineStealer)", "value": "854ec17d2916a8fdde780ec93f0f025c38eee71121c5c49fdde436fc9276080c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440527, "uuid": "2b427de8-59d5-4184-8b69-fdfd8d4fd2e1", "comment": "Malware payload (RedLineStealer)", "value": "1e4fd640989fc02e1cf97caaf8588f10667c71f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440527, "uuid": "505fdc73-72fa-47b5-8200-80fee414e543", "comment": "Malware payload (RedLineStealer)", "value": "0a3a98e27aae5f0df557729fa3e324a449503cb966b708696da9491cbefe6cae65e35eec2f7f7cd987204c7ed56899cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440527, "uuid": "587b3a45-794b-436f-afa7-b0be40831f6d", "value": "T1E565121174A14036E86299374A54D7F6E9BD7C220B24EDDBD7DC1B2E8F303C15AB28B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440527, "uuid": "09a09af7-17f1-4461-b7a8-d42ca53e92cd", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440527, "uuid": "ba3d0460-0942-4945-b749-aac876872183", "value": "24576:aXSiH75lLheIWKJQmmuUOEwGbp5QZWBZ3vr2V0u9n6Nt9/o:ribbLII/JQmmuM7bnR3j2Ved", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694440527, "uuid": "6cc301b2-60c4-443d-b375-862caae142c4", "value": 1513472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694440527, "uuid": "4a63bcc8-d27e-461b-91d2-1b00840a6bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440527, "uuid": "d928f828-a2ce-4dd9-8b1a-5e36520cb133", "value": "e789bd7c43179357bdce12f1d027b239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ceb09f-50ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694441728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441728, "uuid": "847d116c-6a1a-40f7-b97c-735eb119ae24", "comment": "Malware payload (Amadey)", "value": "a210fbb8ed90088a351b08fd8c4242b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441728, "uuid": "b89d04e3-9af1-4af7-a496-779578dc2cdb", "comment": "Malware payload (Amadey)", "value": "85f62a3043a9babb8dbfe30bcb852b99f648b87d5014539c8d232f6e6411755e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441728, "uuid": "67b50e8c-b4eb-4a63-a5fe-e99ee9587156", "comment": "Malware payload (Amadey)", "value": "d694b47e724113ebe9864a66cf2cc622a6bb5e25", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441728, "uuid": "6f03197a-5a72-45d2-9eae-e29e89fc91aa", "comment": "Malware payload (Amadey)", "value": "ef818cc6768bca16ca5f0d6ad0df24e6ec06167d522bc17b3cb55770731a3462ad0627d1c57678b781a9fe2174aa237d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441728, "uuid": "9bc895ae-00c4-401e-a923-dfd3773e348d", "value": "T1FA54AD1170D1C032D562053709A4D7FA5A7EB9210B65BAEBA7E41F7ECF302C19A31EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441728, "uuid": "7565566a-72b4-4e94-b472-8877ff5cd58b", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441728, "uuid": "c653f9f1-7bc6-4611-8582-e35f8e4bc5d2", "value": "6144:jJFa2/KMiCQy4bwSjQzL9ois436xMhAOmb7lPA4:jW2SMiu4Ms436xMhobG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694441728, "uuid": "a95b8f56-9fdb-4e6c-85a8-ba1330cb543b", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694441728, "uuid": "095ac1b3-b4bd-44c9-87ce-8309a2baa3a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441728, "uuid": "fb0a3858-8416-49d2-94c9-8568b2aa7104", "value": "a210fbb8ed90088a351b08fd8c4242b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422ad86d-5058-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694405049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405049, "uuid": "769c32ec-7d18-434d-ac08-cd5ff866abb6", "comment": "Malware payload (Mirai)", "value": "b11addb43ab9afe4a9fbff2dd164d776", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405049, "uuid": "7f7e88cd-c442-4247-a1dd-5e29ccea5b1b", "comment": "Malware payload (Mirai)", "value": "86de32100989891897bbf402173d2e9c38e73f0cfc29efd17368d35805fd20b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405049, "uuid": "703b5db7-e747-47c2-8d53-c3d54e9a7d41", "comment": "Malware payload (Mirai)", "value": "0656817c0be13f740c0a4632d6d78b2b084e5577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405049, "uuid": "fd334242-3759-4374-aff6-c49fbfe31017", "comment": "Malware payload (Mirai)", "value": "e5c6ff91037935756b19abf25bbaacd2e451ff24e10804a9517f3a9bf73541af90aa08c11a874d03f597f6a558614f70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405049, "uuid": "da3c18c3-c188-43d5-8270-3ab1315f87c3", "value": "T10D533C9AF801CE7DF85BD77B4457090AB632B3D102821B3623A7B997BC731991D23E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405049, "uuid": "9b4db362-89d7-476e-9c81-11c326cbc583", "value": "1536:Nk04gnXHxmK+THgk8L6ny+xG5T7D7XMpUeayX8YC6:Nk01nBmlTHgVoxsTfIrX8YC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694405049, "uuid": "80252206-46f8-4093-baef-d26e0a9ddf13", "value": 61704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694405049, "uuid": "4f079e61-6af7-445c-a0a9-148186df6424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405049, "uuid": "6cdfdd64-dff5-452d-8737-11cfc301ce1f", "value": "b11addb43ab9afe4a9fbff2dd164d776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78abc107-5076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694418025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418025, "uuid": "81d79955-c1e0-4b71-a0ec-e8ef729c043b", "comment": "Malware payload (Loki)", "value": "5f591740c10d47a7405bdf97b235f8d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418025, "uuid": "32617cd0-997a-4ae4-9bfa-7df5ed3804d3", "comment": "Malware payload (Loki)", "value": "86e77aa78fa0c2df127d4aa9d337625be7bd44abe7ba2a139e1c5edf61968d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418025, "uuid": "1a3e81dc-3e8c-4327-8ac0-bd786132f7a9", "comment": "Malware payload (Loki)", "value": "e306007bd60bba5b3b5f79f82bf9c097142b6662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418025, "uuid": "82ac3421-b94c-4b47-832a-faf664fbe25f", "comment": "Malware payload (Loki)", "value": "91892324a6d05897e68dd5521c78944afb35d917b4dc2fc7d949fa3f5c8ba3ef9797974c72bee20c9fc6f89df4828482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418025, "uuid": "3832c576-758c-4343-8da2-cbbdf90a9283", "value": "T1D9649D9D76A076DFC4A7C9718EA42D64EB9478B7934F4207A01790EDEA2C997DF000F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418025, "uuid": "b741e631-facb-436a-8560-c3a413a39b40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418025, "uuid": "22c1515b-ef29-4219-a4d8-b125d4918ab2", "value": "6144:lpVOBAqEoZ569T3AKFDq+vLVn+BhMf+vfoBEGJI:jV2EoGHhq0MBhbvfoBEGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694418025, "uuid": "e04e50ff-b02e-4348-917c-97d8d9bf0b38", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694418025, "uuid": "958969df-d754-480a-8811-6faee6972a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418025, "uuid": "bf5f00d8-59f6-4758-8b49-cc6617e4c11c", "value": "5f591740c10d47a7405bdf97b235f8d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b5506d-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694423731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423731, "uuid": "31a1f36e-5646-4fc0-926d-2ec4a2ef904c", "comment": "Malware payload (AZORult)", "value": "633674661a6ccfe8a4507da0611a5496", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423731, "uuid": "2b55944b-79ec-4a49-9624-0b9ce9552faa", "comment": "Malware payload (AZORult)", "value": "871f56d3769e4019ebd21435d6b4ee35af7e1ad2ae8c46cc8faaed1545317c11", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423731, "uuid": "100fb61b-b6c0-47d7-a4db-7085ffdaa9c0", "comment": "Malware payload (AZORult)", "value": "cbafbd723bfbdad26d421bbe5a3811d3085049ae", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423731, "uuid": "501fc648-ba62-47f7-b82a-c11c4b931ddc", "comment": "Malware payload (AZORult)", "value": "ba502136ea55311c52c211451c9d46e00c4594b421655f9eae2c55b448eb2cdecad5ab8cf7b2740750f12195c261fc64", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423731, "uuid": "d505a78f-9d29-4eb7-930e-38778fbce5fa", "value": "T167D48D93B764CCBBF4A719B66E4FC06020B12D5D81E5960D62AEB71991F331250FFB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423731, "uuid": "5acb7274-b2cc-493e-b365-53a783df5f01", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423731, "uuid": "49edac05-6212-441b-a7f1-32a8f61f261a", "value": "6144:SgORa6xKTuuuqjL7IMLeSd4SWTaHAuiENc9NIlF1HViRTJWUi4+OJil1AhG:Sgm/SaPGNEVRT/TWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423731, "uuid": "f6819173-549d-424c-aff6-e448bec9f152", "value": 600429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423731, "uuid": "9222bec3-ffc0-4571-b42f-072665f115cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423731, "uuid": "15b562e3-c133-48e5-80bb-a1427bcfa4e4", "value": "633674661a6ccfe8a4507da0611a5496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c26cbcf-5090-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694429117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429117, "uuid": "d27b907b-5d18-4edf-8b30-50019871b865", "comment": "Malware payload (Formbook)", "value": "819ac40d5e6ef3cd5d49467f76fc6de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429117, "uuid": "aa0edb26-b9c1-487e-b2ff-7b77d42bf308", "comment": "Malware payload (Formbook)", "value": "87c61e8ad5d2df24cc951473b77ec7ef6e2be9d37164ff829116c2cb73d2d8d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429117, "uuid": "cf656326-ad6c-4304-b9f5-a51363bcae81", "comment": "Malware payload (Formbook)", "value": "1d01d39474b80975c511c27a795b715f025d89fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429117, "uuid": "15265503-e8bb-43ea-a6e8-35b7c8460776", "comment": "Malware payload (Formbook)", "value": "8a6d8cf1be16abaa25275f1a0ec4bc770390aee327b44c7d9204bd059d9df9fee8cd49f305b832f76e8068a99194104c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429117, "uuid": "7a1ab84f-64ea-4c27-b73d-16b98893b1fd", "value": "T1EF7422D877B0C5FBE9914D312A3DAAAD5EE0AD2318F9970F1369EE0A7C256404D0F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429117, "uuid": "1811e9c9-15ee-44a5-b359-fb9203aa26ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429117, "uuid": "51d77a3b-2e9a-4d31-88df-d63e2bd4eedb", "value": "6144:/Ya6CKW+ODAcZxa/vgc/KpguZJVZyFFMJsn8z3wTOv/Us94CqRUXYekdwApV2qLM:/Y0P+ODJxa/RF+T3NT3sB2XYe6trLFJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429117, "uuid": "3e43cc75-fd87-4b39-b899-39bf9a4a16b8", "value": 347753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429117, "uuid": "3019a7a7-eb5e-45f6-a35c-b31e766989c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429117, "uuid": "9b77c5f3-d3ca-406e-853a-0c92cab6403a", "value": "DETAILS AND INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc07bcf0-507e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694421628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421628, "uuid": "135f3830-81eb-497b-b6a0-988a0231ad15", "comment": "Malware payload (Loki)", "value": "713ce15e482a1be4ecddda1e91664074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421628, "uuid": "c33ade51-4574-40a1-a3c6-d572c4ca0b67", "comment": "Malware payload (Loki)", "value": "882d848d9a897a1bfea35779092a67927d0c868f792ec3c5c63b791186692664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421628, "uuid": "4a7b78da-e0a3-4ab1-bcbf-0c3c00b501f0", "comment": "Malware payload (Loki)", "value": "ccd1c38d9f54eef07c53858dae31861b16cca8a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421628, "uuid": "4c4984c2-4bb5-4a16-8875-15c40ce35c73", "comment": "Malware payload (Loki)", "value": "5b4b872e80a35f0266851c23a751c8b6066cc9d0253cf254e24428fce0472b7ea6fcf2358b2ac4efb1a65337da345caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421628, "uuid": "0420f567-cc96-43e0-be7c-132b3ef8baa1", "value": "T1F2B4DF8D7250B6EFC81BC9769A981C34FA50B4BB470FD207A05715AD9A0DADBCF241F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421628, "uuid": "d084c3f5-a22c-4421-94a2-23be217d3694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421628, "uuid": "3f05552d-6726-4301-9e34-bb82b7f4236e", "value": "12288:HK2iNZ1DV9WFJgfkccISPrXxqO6YdbYpZkEA/jVH4OQGJPOO02wAjh0K95obxHBw:HK1pDV9bkccrPtqO6Ydj/JQGh0tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694421628, "uuid": "786d3390-7a25-4e07-8391-9dbb5ad33f9d", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694421628, "uuid": "1cbd917f-2e69-4703-bb0f-8c738390dd6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421628, "uuid": "bdcebfcd-f942-4e4d-acb3-27420545e715", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162b262a-5076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694417860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417860, "uuid": "33911c98-abf7-4e2e-9258-ebd3a1e6fd49", "comment": "Malware payload (Loki)", "value": "482ab5bc32af21cb21e410b972c855e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417860, "uuid": "fdbd0ac8-62dd-48a8-90a8-e98d616d54a3", "comment": "Malware payload (Loki)", "value": "885d07cc65c7b791fd817a5347a1caae34bf294dfb3b3ca7d68ad8c4e18b43cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417860, "uuid": "36ea3d52-1f57-43f7-9646-9f8c0adeac9d", "comment": "Malware payload (Loki)", "value": "0219fe802817bd5b0dd0fd3bac1b880fb10bfe5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417860, "uuid": "7422a69e-67a4-46b6-a25f-749ec2cffce3", "comment": "Malware payload (Loki)", "value": "c777b31e78dc477a3c6c420b6c99c6bb48402f966ba052930c113f37212ab67be6beb98975006641d01a3bf3e19cffc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417860, "uuid": "eb71fef3-7d7d-49d4-84ba-3d97f723cd47", "value": "T12FC4010676EC7E1BFA7945FB244168424BF012377865F7C62CD360D220EAFD50A8DA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417860, "uuid": "93f773c9-0b1d-4fbd-9524-6c6603257acb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417860, "uuid": "fbd0da0c-ec9b-4e59-8a61-daf9e003c241", "value": "12288:zGpxuCCV9A0/dEGCkozzsg+2oSKKoOuBs760578rlTZm5td/:2xuTjA01p6zs1fTOuqhMdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417860, "uuid": "e90994b5-09c4-4acf-b0d0-57902303ae06", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417860, "uuid": "d87b2ccd-27b7-4f31-95f9-a785c9226348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417860, "uuid": "1210120d-6c89-489d-b36a-c889141d87db", "value": "Transfer Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f0994e-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694445374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445374, "uuid": "8768484e-1ee7-4b2a-b242-b42f997b8103", "comment": "Malware payload", "value": "496794e6a0e84b28a2616279ebf48f85", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445374, "uuid": "9f39858d-100e-4b7d-adfe-74177042b95c", "comment": "Malware payload", "value": "88a67c811fe45a1b016ae185becc9992cc08c8f5bf228880a63b5dc742a1913a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445374, "uuid": "62d44594-374b-4c9d-b449-fc687ec86ec3", "comment": "Malware payload", "value": "f05a60ee7b0dff6142539973394b6d4f8f24b52a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445374, "uuid": "8b48519a-a2f0-4f54-8d1d-1da1dff6f122", "comment": "Malware payload", "value": "6264222fbf7873507246dfd89aa80ff0e698ecd94aacadafa6f47f00125aee249bf2f234ff78e99752d3d14f050da3f5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445374, "uuid": "cabde4de-a8f1-4c82-9ace-a1841d18db87", "value": "T1385538DA5CCCBB82C71942B7EB12F5FC052BEE4D968424963072FA4A2D331591CF64B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445374, "uuid": "5916f4dd-79d3-4837-ad44-f7d5541f628f", "value": "24576:LWQmmav30xSZyIw6Vz6NsrZydw6V26NOaz5nlQsTgRHa23ywIe:qQmmQ30646V+2l6VHtVljTma2iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445374, "uuid": "7740ce22-c70e-47a2-b41d-a858b503d83e", "value": 1295872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445374, "uuid": "18c156d6-3559-459e-8ae0-4013ad1aee54", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445374, "uuid": "c74d98be-99e3-45d3-9bb4-527242a95ae7", "value": "250.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b861cb-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424187, "uuid": "9f9b0513-42d6-4563-943c-3c3cc297fd04", "comment": "Malware payload (AgentTesla)", "value": "5918f36342af0aa9227e44d7557dbe7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424187, "uuid": "19bee03f-f54c-4454-bcaa-db8d1e48c1e3", "comment": "Malware payload (AgentTesla)", "value": "8a0632e1cbf30a80d73a312e84ae2f4480012b0e1eb71bb224b280ee5fd1e7d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424187, "uuid": "8bf9caa0-99f5-4f2c-9544-7e6f3801a1e3", "comment": "Malware payload (AgentTesla)", "value": "82667c40bee286ffa68c583531c59f641e34fc82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424187, "uuid": "6bcbb1ea-68a5-4c8a-b56e-72084472105c", "comment": "Malware payload (AgentTesla)", "value": "128a6df582d16c7a9e3673de5a3d9d87f69f225ea975804fc3616ca413d3793b7115a47b9583eefeea60e74d7622b8d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424187, "uuid": "fd96335a-ddbd-4e9c-8af3-a3116d27efeb", "value": "T1D705DF85E68466A0DD5DAB706A36CD3156237DEDA834A82C29DE3E373FFB3935021053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424187, "uuid": "9a0ff1d7-8d93-432d-ad4e-72263329a07e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424187, "uuid": "0a552ce8-72dc-42e9-8b38-5bbf41aabff5", "value": "12288:Y2iNZ1D7lgN+tsYCYwCSr/YUF41K1klUldqtG6L9MiAibvb1zOnbaK7IIAP7r9ry:Y1pDBUYCYHQF4LlBr9xAiDbIaK7It1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424187, "uuid": "c1602f85-65be-4ffe-b1c4-927adf58a56c", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424187, "uuid": "5e1ba7c0-3ec0-475d-b097-8cc53a854c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424187, "uuid": "cc7fd186-7171-40bd-bbeb-5cfeff39ddd9", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5455a4-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427130, "uuid": "09aebf41-b0a0-4ab8-ba3c-90bd05eb4594", "comment": "Malware payload (AgentTesla)", "value": "2c3e2123c78ea5262aee6c5a708049de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427130, "uuid": "221179a0-3086-41c6-af10-a2bec6e97ccd", "comment": "Malware payload (AgentTesla)", "value": "8a56b7670a881b9d9060043abd76222bba57ddccca657303946dade6fd026c04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427130, "uuid": "7824b2af-8759-4c9b-a275-e76196e85ec9", "comment": "Malware payload (AgentTesla)", "value": "bf4c71e5804071f9d3defaedc23cb21d6363168e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427130, "uuid": "3d778e27-c949-478b-a28a-d2e31086e71d", "comment": "Malware payload (AgentTesla)", "value": "7ee7b9fae08ec6ce006524c486c9bc616fbe1d0b4644771570137e5e64c7c7437f81bec9c628dbb8b8743b5f9a41bcba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427130, "uuid": "c5435fd6-31af-4c52-95cc-58da901add52", "value": "T13DB433DBD31AD1C0985F42A48C86E3F415FA700D631738A67279FFA2A4E357CC65B809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427130, "uuid": "7a6d5203-81b9-498c-afca-c065fe85b359", "value": "12288:wZNrjDXwd3k23Eplixw3L11cMzSv3AnYG1cUGCUTc9JCi1HT:wbjDKD3Ez2w35+7PAYGtGwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427130, "uuid": "0e12e752-c793-4f99-ae61-d8cb54494246", "value": 535446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427130, "uuid": "d2f1d13f-eead-41af-8939-88d5f0b6ee94", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427130, "uuid": "2ff47aef-26ce-4e21-a9d6-afe925ef4a66", "value": "GST INVOICE.r00_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5396a9-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450567, "uuid": "c969556d-e1fb-4c08-b560-0c3f64b1241e", "comment": "Malware payload (Mirai)", "value": "9a872c56dc92e8f58024631ad60319f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450567, "uuid": "70c86960-4d11-4d74-8c9d-049be468cdb7", "comment": "Malware payload (Mirai)", "value": "8b152161a243a2b6db71fbf5766a747214ea74ff93b942209b867610fc08c529", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450567, "uuid": "bd136cc7-7c96-49ee-84e7-7a3809afc480", "comment": "Malware payload (Mirai)", "value": "e4a57bfad56e67955ec1de9b531d5a900e9c5af5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450567, "uuid": "6f6359b3-a46f-4dd6-9827-f0ea4dfcdb73", "comment": "Malware payload (Mirai)", "value": "5ef27606e5760ac37e433ac9acfa69efb49a3af8bfc4382489679c605b0b8eedefe983723eb5ea9212b656705b6af599", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450567, "uuid": "2b95150c-5fb5-4153-a649-fe2368f3fe45", "value": "T15D730952B8818E15C5D813BBF93E018E33126778E3DFB212DD116F547B8A92B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450567, "uuid": "99857483-c038-41ba-8a96-64bcdb866a5f", "value": "1536:iNnUhIjLs3+4vJZMEmQ8ArVhxWzq91BIUUXznEcIbni/HeF/lkl1d:dIjY+KJZRbLhQ29LIsCHeF/ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450567, "uuid": "3a0979c1-8e28-4d0f-b9b1-92218f17a569", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450567, "uuid": "9efd98da-6499-4919-b8c6-4579c53611e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450567, "uuid": "dad12b54-8091-44bd-9c14-e2505acb3275", "value": "9a872c56dc92e8f58024631ad60319f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392f6a3b-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401168, "uuid": "af095d24-7a44-4f02-83d8-a7e31a3d4738", "comment": "Malware payload (Mirai)", "value": "e414efe4083473477ae01f2c5bdc644b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401168, "uuid": "2a25afc3-43f1-48f2-b862-215c3cf716ef", "comment": "Malware payload (Mirai)", "value": "8c591b032ea3a6d5b8a193951eebfa4b650f2d4f0215513c9e394ffb40e4956f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401168, "uuid": "57b6facc-0123-49cc-8f2c-e5b31d5f447f", "comment": "Malware payload (Mirai)", "value": "cf4e961a92fac1d14dbd6b56155f925b906f4ad7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401168, "uuid": "71efc4c8-46bb-4442-8b6e-3e1ace739de3", "comment": "Malware payload (Mirai)", "value": "319ea4735dfcc6ece17d03a7592981a6b691aa596e325984021963977ba05904580420cebd78bf519af92a8b480d0076", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401168, "uuid": "f5e6ee31-f96a-400c-8e70-a9926eea7521", "value": "T153335AC4F643DAF9EC4705701177FB339A32F5E51229E743C3A99A32AC52602A906ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401168, "uuid": "e57c6250-8bfe-45e1-822d-e17e29624f53", "value": "1536:GWa2d5sf1Gg+ya+nlQyFKffDRTfwVsp3MSfCYW:Gt2d5sf1GCammoKndjMW3dCYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401168, "uuid": "4dd4d19e-3f23-4a63-8d2b-de435f8f9d7f", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401168, "uuid": "35fe9a4d-e73e-4c6a-b838-0ddddb9f179c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401168, "uuid": "6fac09b9-61eb-43de-93cb-9ff4ad05875d", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b154fa9d-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694427140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427140, "uuid": "5c7d6850-c006-4588-a1fb-22003262088f", "comment": "Malware payload (Formbook)", "value": "e1b786b74762bec05c93625a67ca8d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427140, "uuid": "c4bb33f5-d678-4468-b0e4-bc017ea2a96a", "comment": "Malware payload (Formbook)", "value": "8ceceb731a2c09d552835ade18b92d47e10e24cb34cdb4954b1a97905fd10b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427140, "uuid": "8ad2899e-a1ef-4744-9a6e-8a4e94d5cd95", "comment": "Malware payload (Formbook)", "value": "95f70125a4cd1a019ef76eb02ebf20e7053175c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427140, "uuid": "9726a07f-f346-4f98-843c-cbc37143bd65", "comment": "Malware payload (Formbook)", "value": "173fc29d6b105df39c77ec5fa38074f0b1ef19f49f3c1601559045e56a449e40aed0cb4dbc72107f600d26936bfa37b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427140, "uuid": "74a113b9-570e-4090-8214-871ab1d36463", "value": "T1A4741339E31AC07AF4D30A723A3E1DD77EE696130C64D39F53702E28B9162849E2D765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427140, "uuid": "f4cfd3ca-ba9b-4038-8bb1-4317962e8f73", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427140, "uuid": "b7a46d50-c17b-4388-82ca-688077920609", "value": "6144:vYa62rQUGPOl1GrvQ4+lwHkkhHvtZrpUuQg2hhpzdnIePcHs8Haj+e7BO:vYAPGPvol0kkhHlP/QgKhp1IePmal8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427140, "uuid": "6a190066-4cab-4fc9-82d8-f3b3e37280c1", "value": 367092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427140, "uuid": "da63a25a-f03d-4591-84e1-a1fdf04bb25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427140, "uuid": "9ac55e63-31ae-4b74-a504-6be3ee1691fc", "value": "Petronas requesting quotations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455e4137-50a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694436407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436407, "uuid": "2251544b-e5c5-4267-89dd-cbcc44504207", "comment": "Malware payload (AgentTesla)", "value": "2cd08f71af441e396036fdade4321837", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436407, "uuid": "074d7ff2-6b8a-470c-8077-8a8d499c304b", "comment": "Malware payload (AgentTesla)", "value": "8e11fcd72d619a8b6ed15ad976a4df2fe36c2bd0f2255a8520ebbdb0ce2e5258", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436407, "uuid": "63ce0296-b8ef-449b-a5eb-d6c6a5489149", "comment": "Malware payload (AgentTesla)", "value": "e9f25474902f72c0eb05143ee140491be7c83b26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694436407, "uuid": "f37989f2-927f-4997-8990-d10bda41b8de", "comment": "Malware payload (AgentTesla)", "value": "ef4771e3ed402990076d9d04832a4e4bd8f053363c4b7dbb5c89d259dacc3c62a2df324cebb7278b6617af77c3af4e43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436407, "uuid": "1d9996e4-b9b5-4a92-9785-ccc4ee40ee2c", "value": "T19755A1B9E210E8D1E03A0D3DEDD101AC822495F5DEBF915329BF338D6CB144A6959FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436407, "uuid": "b54e104a-3dea-49f5-b87b-4451d512c28b", "value": "24576:Ep9Wip9WKaVilZairTZ0U+p9VPB4fJYOWG:wWaWKaVjG1gPBSJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694436407, "uuid": "8993dc4b-39d5-46f6-83ff-2c88660465ff", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694436407, "uuid": "67db95a8-78f8-438e-bfe8-ab1d282f4004", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694436407, "uuid": "67b9203a-aa12-46a5-bbf3-e47baf1455ee", "value": "Invoice_API22104567096544.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d142417-5062-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694409335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409335, "uuid": "1250a38c-a0a4-441c-a0e5-fb8109c3e00e", "comment": "Malware payload (RedLineStealer)", "value": "5654bc22396954de12aee8e04adbaca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409335, "uuid": "27935d9b-e237-4a78-abc0-9f3195c1cdc7", "comment": "Malware payload (RedLineStealer)", "value": "8e359dde4bb5bbef88e7c785804ed1544ce37b2cdeb8f50ff5eb0b9e8ad0f0bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409335, "uuid": "92f70916-fd0a-4f3b-a54c-a1735a657150", "comment": "Malware payload (RedLineStealer)", "value": "9348e966310fcedcc7135ede34fae1c314736b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409335, "uuid": "05da10fe-f8c5-47a0-8986-12889f7a2011", "comment": "Malware payload (RedLineStealer)", "value": "0b7d15e931280f9d261f3bd5c27f4c75e3eae1b50cb2536454bf1a43e4541a76fc313dd33b40d98418dd37c4bb473abb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409335, "uuid": "0d1b92d2-9fbb-4441-a054-f87d19545836", "value": "T1AB45125434E28873D437563949D8A7B70A3FB4A04B6198FF63B11F7E5F25390A234A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409335, "uuid": "713474fe-0ff6-41e9-a442-0846f275dd2b", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409335, "uuid": "8a6b92bb-6e96-447b-b719-d8e4014ce8e5", "value": "24576:SSyCJKu5VTFhJ6LXcj10Q/KyqtGrqIViCh2RymXIu1Hg:xyCJKutyI0kK2ViS2RymXl1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694409335, "uuid": "6105dd64-39be-4f96-b38e-b4d047759248", "value": 1180024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694409335, "uuid": "072e9792-41f6-4371-90fb-b1c4faca8ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409335, "uuid": "cedcb8c2-7626-4170-95e4-6d9b13258998", "value": "5654bc22396954de12aee8e04adbaca3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5a5c71-50f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694471076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471076, "uuid": "d023d820-df39-4c1d-9574-6d82ff5d6fdb", "comment": "Malware payload (RedLineStealer)", "value": "9aa1f27e5c0fbf0c2a45a2d942c72b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471076, "uuid": "f4328d7a-c84f-42fe-9f1a-e80ef12b0b50", "comment": "Malware payload (RedLineStealer)", "value": "8e913674dd4c4b71d46bcf7abc736662f46940206b7dcac65214424cf4dd93ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471076, "uuid": "e7be8c8f-828c-4c8a-b510-a307a0e37a7b", "comment": "Malware payload (RedLineStealer)", "value": "1557a396f0c8eefc2ba2efe008f00ef82063ca27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694471076, "uuid": "6affb046-4bd0-4d7e-8da6-1a19fd988473", "comment": "Malware payload (RedLineStealer)", "value": "23526849b085121da34026e902fd1a84699ec4e9ae121803b9c863d43a98c01f0299efef6bd61d6c4dbcc9c7b894f86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471076, "uuid": "23bea60f-4e75-45e1-8357-de6229ab435c", "value": "T1DDA4BF1393D17D60E91E9A329E2EF6F4371DB9508F5927AB2218BA2F07B01F2D572710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471076, "uuid": "6d11df9d-75be-43fc-8030-33a31a69d240", "value": "fd6dfb11bfd672e911229df79ae69bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471076, "uuid": "85adedc0-e64a-488e-8c5e-bf9d24f03105", "value": "6144:208o7WfIwY0AaUfXhXw+mRPjRAaFA00vqzj2FpB:246fIcQHmJjRAaFAzSj2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694471076, "uuid": "b9c16f01-f3ab-40a8-86c2-a30fa4596502", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694471076, "uuid": "f11c484c-9623-4919-91c7-f158b4c84c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694471076, "uuid": "e359e832-a808-452e-8704-edbb6403963d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a536a94-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694445355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445355, "uuid": "6c49ca7b-0488-432e-b4f9-0f54be5af147", "comment": "Malware payload (SnakeKeylogger)", "value": "f41273a3af3a01482ad6042518d669e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445355, "uuid": "ac8fb8bf-ac4b-4415-9da1-29c03582ae24", "comment": "Malware payload (SnakeKeylogger)", "value": "8f36e0c772a8ec44db818e8c062806dfd90c33eee49a8e03d04b217ca26d5cdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445355, "uuid": "39bb8490-1703-4d6f-b174-d2f1b748c9bd", "comment": "Malware payload (SnakeKeylogger)", "value": "979a122f9125f658adba7ff1c35bc8426eafc36b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445355, "uuid": "75cd6b83-19c8-4082-a06b-9ab0764665b2", "comment": "Malware payload (SnakeKeylogger)", "value": "966c38d56659dc38054b3d218a3599b4c57891759385e779841bc197ac956c379fdaf3b07a77d758b9e4761baf4ddd26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445355, "uuid": "42844498-da2b-4d4b-802f-60270c242c76", "value": "T183B4120263694B31D02E4BF9D449CB72E72924681D7BDE7DC9A58B4775E23038C2FAE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445355, "uuid": "e660a4ab-aff1-4499-bafe-3aa230ba2c88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445355, "uuid": "6e09041c-37eb-4469-82d9-5ad1c63a1c3c", "value": "12288:S2iNZ1DN5bbzDj7ubPqRtohLDxX/mjIS0MCsyNhTX:S1pDnPDj7+PqELlX/dSusA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445355, "uuid": "8b9f5e44-7e0e-48fa-ac66-34fe74fe4544", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445355, "uuid": "7fa0b3dd-18e5-4d41-82b5-b9b7363ab2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445355, "uuid": "d84ba4bc-3fb5-4b3c-b8ec-2f373898236c", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2761029-5059-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694405720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405720, "uuid": "a666acfe-ef59-4bf8-a86d-25c327c16243", "comment": "Malware payload (Amadey)", "value": "1154a9f3b9aac9f1403d20e5d48215c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405720, "uuid": "e248d1bd-f147-499b-ba8c-57432740e0e5", "comment": "Malware payload (Amadey)", "value": "8f88e33bdd0e76b100ac354a6d4863b0d1f97903b56d5577cbf8bd64ae98165a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405720, "uuid": "809b88ff-dd4a-40d2-96af-b51cad465151", "comment": "Malware payload (Amadey)", "value": "766e7bded4d869142e7465b87865259de0f29671", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405720, "uuid": "89897c6c-6095-454e-a563-440f41e1ebed", "comment": "Malware payload (Amadey)", "value": "964ecab87db01763e4cec47cc8720df1e0bd53029a513a50e24a62049c62ad63ce8764db41f2f3eada4cd7b613f465de", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405720, "uuid": "0a1d9610-3a84-438f-9f36-91209dff63bb", "value": "T13934AE10B4D18432D83315360DF4EBB65A3DB9600B6259EFA7E40F7E4F703C1AA75A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405720, "uuid": "b3e2d809-ea3f-4718-91b9-af5e4c008b1b", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405720, "uuid": "ef1aeb4e-3cbe-4ad6-85d2-96a521d64781", "value": "6144:fYaUvz6DCGbAR/VeDC1tAOCcCFWXIfYY6NrIQurBiIg:f4vzaC+UjJTYcxurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694405720, "uuid": "f03bbc4d-7bf3-4117-975d-3bdcffb45588", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694405720, "uuid": "e51b4221-6210-4714-9d8b-665ec613b999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405720, "uuid": "d4ca58df-332f-4628-b9e8-4e49e2639856", "value": "1154a9f3b9aac9f1403d20e5d48215c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb13b8ac-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438779, "uuid": "4640401d-70fd-413e-bc00-36a0e67da683", "comment": "Malware payload (AgentTesla)", "value": "90ece64bfb007994d6b53c8f89b5c0cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438779, "uuid": "d9ae99e9-2f25-4b6f-af2f-476ef73f4f45", "comment": "Malware payload (AgentTesla)", "value": "8fe468c75b9ca0fc6684a34ae5f3392f87d1f901b6986d2b081aec0a7000b94b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438779, "uuid": "161a6f4d-d6fd-4d4f-a1eb-7ad1daf69e83", "comment": "Malware payload (AgentTesla)", "value": "2e2dc7206259cf53cbb6a37338ea746736f62917", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438779, "uuid": "2203f811-72cb-4e6b-97bd-7e661e6d4b86", "comment": "Malware payload (AgentTesla)", "value": "9baf2cbaa2e8c4bbfa7bd083476545a598155aa17181e6dc7b206154b5f5c2b6544ea3e079035998bce19cfa26c023d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438779, "uuid": "00a7bd4b-456f-4416-875e-9653272d3495", "value": "T11CE40240F2F88F17D7BEA7F54414656007BA986F5131E7988DDAF4CB2AA0BE04641B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438779, "uuid": "63dce21d-2331-4534-8359-9a865f3c7e7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438779, "uuid": "31a3238e-6d1e-43ef-8ecb-1fa2fa6dc8da", "value": "12288:josL/PrZX6GgUn6DntANmKqIaVGEEIz7KDtMJ+5hEkDwMD8HU:josL/PlX6G0DAmBIUGn/5hEkDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438779, "uuid": "01363632-bdd5-4422-a9a5-6b4bd3541248", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438779, "uuid": "3add8eff-0174-449b-ab12-b0e912904a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438779, "uuid": "cbf92c4a-f6de-4595-9bb5-b88fa49129e4", "value": "Swftsend_05092317692346pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb621b5-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438755, "uuid": "f8854e01-82d9-4b53-9b6d-54336f939837", "comment": "Malware payload (AgentTesla)", "value": "3c2205ccb69bdf235e6352007c7cbfcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438755, "uuid": "0213adf7-f71f-4ef6-a6b0-3396643cd7b1", "comment": "Malware payload (AgentTesla)", "value": "9032d5df45deedc4c38a4cb97da6cf00d3438e8b34a2fc6c7700c1da3b09e109", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438755, "uuid": "eccdfd54-50c5-49cf-bece-ee09d2c452d5", "comment": "Malware payload (AgentTesla)", "value": "10d65cb42142c34f4d3af314908935e4c0c705ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438755, "uuid": "c9220805-a6b8-4cb5-94b4-06927b3b4282", "comment": "Malware payload (AgentTesla)", "value": "531d6c8ff3abcbb7bf04e6aef3870d7c0b65d80b73ab1f9bc6e407063eeee8a50dc44deb397386a4feba6d3a092ffd1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438755, "uuid": "adbacc70-cc5a-46c9-b53c-d225044ee78c", "value": "T1457412DFD74447A3D6D61676281A884853335F7EED9CD29E228DB2C06BB338301E497A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438755, "uuid": "c2f857f7-da13-4f9d-9b63-e5b227865b03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438755, "uuid": "194dd07f-553b-432a-8b61-65b5782d542e", "value": "6144:n7a5oa55AqU0BYgpGPHyTXo5TMUdIsccV9mtAYGiWtuf1CpXCMBHcWbu5xCIrK:e5o65ALkYvyU5TP9mt/3g9nLbuje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438755, "uuid": "314d5937-2770-490d-bb92-b826ffc0324b", "value": 363000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438755, "uuid": "73e1a0a9-a6bc-4c1c-b3b8-57711b596dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438755, "uuid": "15244a3c-b6e2-4549-922a-133920cfea7e", "value": "Doc01027391pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc133e5-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450219, "uuid": "ef26d3b4-3745-43e6-b5d3-b51eca0b2b9a", "comment": "Malware payload (Mirai)", "value": "c3e0a3202469a2c5c943425cda47caa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450219, "uuid": "33ed7c5c-032a-4903-8a92-57fd06e2ab0c", "comment": "Malware payload (Mirai)", "value": "9144297835f681f00d40ecc335a23eea9a1ea7a0f918b624078e999378b16286", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450219, "uuid": "7f68ca99-c711-455f-843d-37a7d5e7c491", "comment": "Malware payload (Mirai)", "value": "f6038f440d2d1e64d11e30248bdc05cd53662f08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450219, "uuid": "1f7129fa-e8df-4a0f-98f6-bebac880b07d", "comment": "Malware payload (Mirai)", "value": "b27306d76fb3978654ea745d0f7a01487d8a60bc982e7a1727e91d24778e16acf89c7b0f243df8069357e9851e9d058f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450219, "uuid": "601d552a-3310-41e4-934e-c8c46492da1a", "value": "T1AEC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450219, "uuid": "07b7c6e2-f283-43bf-bd5e-4b2b2756d44e", "value": "3072:4jDy/+mh1vtbPIKalbpcUPium7/L7QsvmGfIiNb:mOJ1vxfalbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450219, "uuid": "9c574b54-b040-48fb-9b89-31f6539d7d06", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450219, "uuid": "311cfdc3-b699-4eda-86e8-7bd26c90e63b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450219, "uuid": "b7064257-5147-4e88-8b3d-1fa8367d3b9b", "value": "c3e0a3202469a2c5c943425cda47caa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232cb1b8-50ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694441074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441074, "uuid": "0031b3ee-fc4e-406e-b6e6-0f98d2a3f8e2", "comment": "Malware payload (GuLoader)", "value": "35951704bf97c135fec65cca9bc2e1c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441074, "uuid": "eebfe724-e47d-4eb0-9ebe-425d97a299ca", "comment": "Malware payload (GuLoader)", "value": "932a29dcd8b778f2e7c509b3ef9d732632edc266596bea3ed351803dc08cd5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441074, "uuid": "677c69ac-3f16-4865-939a-94c32c3084e2", "comment": "Malware payload (GuLoader)", "value": "f5232f30da3a3c5df4a6d15aea178059fb14cd89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441074, "uuid": "6d34fa71-5dd9-4bf0-88e0-1c67b38f2e14", "comment": "Malware payload (GuLoader)", "value": "8642a4f19b741b79e05144eb8d72c54d787c770a4c2550a5eaebcf2205942020d2f59177d310d91ece6013e6964134ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441074, "uuid": "5d737b36-db7b-4d69-82a4-3be5b9b93fa4", "value": "T147D47C93B764CCB7F4A719B66E4FC06024B12D5D81E5960D62AEB71991F330260FBF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441074, "uuid": "fd65212e-e369-4281-867e-417c16b29972", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441074, "uuid": "2a66a86c-8fdd-49a7-a082-4bdac646809c", "value": "12288:Sgm/Sduud+GG2zwcb9ZSNpLen7CgAHWfRdaA:Sg1duud+G0u9ANJM7CCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694441074, "uuid": "63368b38-a900-4144-aa90-7e47052be44f", "value": 607684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694441074, "uuid": "27035f7a-c560-4a07-b43c-f431c01778cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441074, "uuid": "1eaf6619-00fe-4b2f-b065-7f60cb016d16", "value": "igucc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495053aa-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450587, "uuid": "f212ccdd-9cd8-4566-a643-2c898096efc7", "comment": "Malware payload (Mirai)", "value": "1cc75445d6cac073a258a2f6862ecb9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450587, "uuid": "e6a7d223-3151-4546-9633-dc01aeec52b9", "comment": "Malware payload (Mirai)", "value": "933f1f2f2cb5c7847fa2eccce3272b3be85176ecc4fc7a08ff8a11b2addb6b81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450587, "uuid": "0eb07e15-d8cd-41f3-bb78-410cbd40a6e3", "comment": "Malware payload (Mirai)", "value": "76436824725d5ce368b029a717ed32dc42d724b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450587, "uuid": "068682e9-58dd-41f6-949c-8392760e6e8a", "comment": "Malware payload (Mirai)", "value": "489e06b0bc1e9e3b55760c08ae6af5f5149d73890f07cc610dbfb0f979078547c68245a1b0a00779abae625193513b83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450587, "uuid": "43ae441a-41a7-4550-acbe-d2adfb333e83", "value": "T14483B509BF641FF7ECAFCC370AA92B05248D651A21A97B367D34D418F64B31E19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450587, "uuid": "ce0f1170-555d-430c-8b6c-522053e913d9", "value": "1536:/Ou3TUx46zrKch57ev1a/vZQLJzQl1dx:/Ou3AXnKM/v3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450587, "uuid": "118fc4f4-e13a-4861-a898-ae5dc9a96a64", "value": 81328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450587, "uuid": "6189d09b-187c-4d07-b0c6-f57d0064b986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450587, "uuid": "b38bbd0b-dd08-45a2-b18f-e0d819b2fee4", "value": "1cc75445d6cac073a258a2f6862ecb9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afabf16e-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694427137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427137, "uuid": "bae0ed48-64be-4253-b1fe-6cc422e2c65a", "comment": "Malware payload", "value": "533503349f6a4b8b36e58fb64e73698b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427137, "uuid": "91f846ac-70c4-4b48-9ca4-8f2a3954dc6c", "comment": "Malware payload", "value": "935b580cce8ab94a54cf2f48cb12feb9a28f7da41e4c61e8f9fadabb42c21623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427137, "uuid": "952b1e3b-9de7-4bc6-a567-acfececc3fee", "comment": "Malware payload", "value": "08a3a183adcb45f589ccdff109eaeca27f129451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427137, "uuid": "b3d581fb-7a0f-45b1-92ce-bce65653970f", "comment": "Malware payload", "value": "32fc73c85618fbad1760abf50f388cde6221aa0514699f1d824e24954e743dcecb52dd21427555ff61fd222bbd8b6fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427137, "uuid": "575b7277-103f-45e7-bdaa-dce01e58a1d5", "value": "T1520501C8E19C747AC76E6F7AFE9526D231F16A072DE089401E44C26B84FCA84717C9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427137, "uuid": "6a772f50-3391-4c52-bb98-b29dcbc44a74", "value": "24576:aUHLreK3/aGMw6ZT+8f6bu4fuf+JgpfH7E+/gW:XL3/6T+o6bXfujpfbE+/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427137, "uuid": "5a10b30e-a19d-4834-bc59-d0a22820c26f", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427137, "uuid": "4d97c0f9-d306-4632-9c48-d193ca0d836c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427137, "uuid": "5bc991dc-469e-4caf-8a23-41e7bf8723b5", "value": "List Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847ce606-5068-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694412032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412032, "uuid": "f74a7035-0822-4ce8-b878-1964ba7d4eca", "comment": "Malware payload (MysticStealer)", "value": "d6de685b4cc8ce0c68eb8fa33bd52e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412032, "uuid": "014eeb4c-27cc-41a8-9751-0229b0c4c08b", "comment": "Malware payload (MysticStealer)", "value": "93b7965798dc354b575775d75decbdf8610413e6a8a5b27b613061109fbe6a9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412032, "uuid": "1fc0fc44-2a09-4c1c-a968-856722325278", "comment": "Malware payload (MysticStealer)", "value": "93e6d60c3ac6694cd0adb81d714f92f4c385cef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694412032, "uuid": "b4f6f801-dc38-4144-8ce0-e15a3db9c293", "comment": "Malware payload (MysticStealer)", "value": "bb6bdb202375284dd67ff6292fa9a2a417f156cecc53a6c1ad3d4cb13e49517b7d445ea13f8c59b056936b7d3705b41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412032, "uuid": "dce7387a-93ed-466e-b3ac-092ebbba8bdf", "value": "T13774AF95B8D1C4F2DC3117360EE0EE7A1D39A9651B590EFB53A48EFE4B233C14626B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412032, "uuid": "e541df87-c771-4ad9-91f4-f6d7b8280802", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412032, "uuid": "1f60c0fc-a325-4fe3-afcc-d5d0c01aad07", "value": "6144:sPjUiz6DCGbAR/VeDC1tAORMCWjRsX0u9FPOwjKkiurBiIg:sYizaC+UjwkP9MZkiurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694412032, "uuid": "e8228d3b-47ab-457e-8062-aa7448fd7e0c", "value": 366456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694412032, "uuid": "6760f62e-bff8-406f-aeca-8cabcba7e191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694412032, "uuid": "3a68e5d6-f800-4eb0-9308-f82bad4ad51c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07193bb3-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395501, "uuid": "736ec50a-6bea-47a0-82f5-76139d9e9d51", "comment": "Malware payload (Mirai)", "value": "423797742c8d99a2dea6d7a40569bcc5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395501, "uuid": "b56f2382-bb48-4101-a95c-956cbf7f1540", "comment": "Malware payload (Mirai)", "value": "94293bb90d6b61e22ab7cd854e972eded64efdd01ff82c6ac8eaa34cb19b5c61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395501, "uuid": "39ea2af5-c7ed-4788-8eaa-a5468766a549", "comment": "Malware payload (Mirai)", "value": "4a8f58f710924ab148832f211c0c26998296a96a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395501, "uuid": "7a47580a-0926-4537-a9fa-b02142547c26", "comment": "Malware payload (Mirai)", "value": "229e2340b7902ff120ccc43d3508164b8da0745e4cb05c76210fe799368ddc27b8da0664dfa7ad1c004558ea7038d73c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395501, "uuid": "8014f5d6-8d3b-408f-adc1-4baf9965c9cb", "value": "T185D3F846F8819B12D5C151BAFE1E124E37131B7CE2DE7302AD246F647B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395501, "uuid": "c0ba2151-1f85-4fbd-9f87-bd332ab55362", "value": "1536:8gn4P+KhsoWEIvUl5B6crPMW5XyrtzxLGIgPaJ4Kiciaii2RXTW5ECh2Ekw0m0t5:nZUh/L15XWxiIgPaJv2RXKaCh2EZ/I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395501, "uuid": "01e4d579-74a4-41a2-bfa3-b7719df1fb4c", "value": 131932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395501, "uuid": "e69f322c-b263-423b-99bd-7ee5847efac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395501, "uuid": "c305a5f4-99fc-4456-b38b-5919d1a6db8a", "value": "cundi.arm6-20230911-0124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28187136-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450532, "uuid": "65526833-d1e4-43fb-96f6-8f976eb26b41", "comment": "Malware payload (Mirai)", "value": "4871fe6f840722d21bb47c6c57e252ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450532, "uuid": "e89d4673-e706-440b-bcb1-892912f93703", "comment": "Malware payload (Mirai)", "value": "94536072bb8d52cac60bac6230a1b84835cf0478b50431f5631784f28de7a5ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450532, "uuid": "9a867831-2ede-42a3-9548-46d4d58db83f", "comment": "Malware payload (Mirai)", "value": "2ce0b7cd01c4a6870312b8f39808b1c6230ff909", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450532, "uuid": "96e02f39-5349-4a1a-ba9c-0581f7807da6", "comment": "Malware payload (Mirai)", "value": "d4dc1a35ee2d4701f69dca53d313811f629464e75ff9561bed548184213e86c4b2e355866827208e3f8be14b2f6c8320", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450532, "uuid": "a75da5f5-7211-4bd2-96c1-3df9463fe3f9", "value": "T10D73CA1A2E259FBCFF9C423447B7DE219A4833A626E1C645D15CEA012E7034E741FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450532, "uuid": "4ef93b2d-57f0-402f-967e-ec132d3f1f97", "value": "1536:2Ao2zmbsTaL30vC0vhh53ba/BsNkTRjLzcS4WMV/xIl1dE:2ARmb53IxZ3ba/yNEjLzcS4WMVpIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450532, "uuid": "794a2f95-fb46-4378-be01-cd600ccea31e", "value": 80080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450532, "uuid": "44482c1d-41f8-4494-b86f-7ea34bf56c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450532, "uuid": "6fc96949-2b6e-47d9-a395-6849b19f2ed3", "value": "4871fe6f840722d21bb47c6c57e252ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6b1b00-503c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694393117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393117, "uuid": "64ac1c73-2d14-4ff3-badb-62fe53d3797f", "comment": "Malware payload (Amadey)", "value": "963bdc746406d9b7b0889e97b90bd83c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393117, "uuid": "6ee30dce-4899-4452-a342-c4f4484d65e6", "comment": "Malware payload (Amadey)", "value": "951c258f1ab9709b6a21deeddaec9c1bb919ca93bdc3159301bb84a1ff1019bc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393117, "uuid": "1dffa772-d833-498c-8a46-79b24bf14a2d", "comment": "Malware payload (Amadey)", "value": "6a9b0ce0b076ce0b021876589c35d285eb327341", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393117, "uuid": "7a9120ee-4ee0-4e34-95f4-7c93629510ef", "comment": "Malware payload (Amadey)", "value": "21407703993888bcce044d5ac7af8ce39496b514251015a541068332fe6175a7b7d290b229044c2ff0bd913a8b4e4024", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393117, "uuid": "07b9be92-ce55-41df-aa3a-19c578086592", "value": "T1C06512A0B4D194B2E872083605FDBB75967DF8300BA28EAFEBD55B3D0E507D1A338519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393117, "uuid": "f1ab549d-855a-4e3a-85e8-b41fb1e62cf7", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393117, "uuid": "bb8beccc-d27e-458c-8fc6-7f2cdc5d7750", "value": "24576:MzLCJ82wYD8PeT8OenZ9zL8gWECZ8htGvJDAE0QnVzxrXDR4IennEMoCtNQAkYm7:aLCJ1YGTNen5WE8Wt+JsE0mp4IenEqtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694393117, "uuid": "1e1cdb83-45ba-4950-8162-bef0085ed934", "value": 1544568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694393117, "uuid": "4edab3c1-aa40-4e0f-863e-bcd603975548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393117, "uuid": "649f68d4-f8ba-4614-ba8b-c368c1148985", "value": "963bdc746406d9b7b0889e97b90bd83c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a89376-5092-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694430080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430080, "uuid": "a28b5173-8eb8-405b-884b-1bef9e24e8b6", "comment": "Malware payload (AgentTesla)", "value": "6ffa3da88fe9fb0cb5e7c7a923ab6d3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430080, "uuid": "30921891-bd2c-4187-8e5a-0832d0e8899c", "comment": "Malware payload (AgentTesla)", "value": "96ab4c3761b4b910bdca7d6f5f8922c3e90ad8e0638fbec84366d79bc3a50e98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430080, "uuid": "6e1251ee-f3eb-4091-929d-054d3ef0ce6f", "comment": "Malware payload (AgentTesla)", "value": "dfd2d24feeb9cb0ee7b9b966769eb634554cfc40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430080, "uuid": "03106022-560f-49b1-b23c-012e8a89f55b", "comment": "Malware payload (AgentTesla)", "value": "8d8fad9a08452e83ecffc19d9344fde7575b922958cb96612649452d494181ce30c4844a936c0a504866fd99c12e8da0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430080, "uuid": "2b759c91-0cfb-4f30-9f26-8f74d0ad2e0a", "value": "T150A5339A824957B360246D3F102F5A4634B2DC3656C779E29BA18C4B1F813EE37B8FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430080, "uuid": "f7e10b52-cd4d-4f57-9eb7-84eeab0853cf", "value": "49152:2Fl4mOFq+PG0/e77dfzAO+K65KpytCE3FTMBUr2s2bv0Tt0J/cPFEfSz5zc:yljB0W77d/+K65QytdFGUN2b42xcPifX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694430080, "uuid": "1a3ae9d8-4de7-41c5-ae87-04c1918f34a9", "value": 2072885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694430080, "uuid": "ec526558-0066-4cd6-bc76-a92eff83cf29", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430080, "uuid": "0ffde285-d2e9-4160-b493-f7519f875ab5", "value": "Transfer advice Copy #ETT2104944098 PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b74ca57-5085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424338, "uuid": "74c2a28d-6e9e-4f90-a616-211dcfe649f8", "comment": "Malware payload (AgentTesla)", "value": "f172320c919ec0d9d8acd48691fd8b4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424338, "uuid": "cf480d39-fcb0-4fd0-978f-44e1c8a53fb8", "comment": "Malware payload (AgentTesla)", "value": "980fc1d5cb2382310df39286ba2167f5103e3381af97c355eddc133373c29009", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424338, "uuid": "33011b3f-0a9a-4dd2-806e-d7cc7c01bf6d", "comment": "Malware payload (AgentTesla)", "value": "099fad80c8e6100859b830cb3eb7ae76cadc940f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424338, "uuid": "fe397f59-e422-4f0a-8ecc-fee011e0b5ca", "comment": "Malware payload (AgentTesla)", "value": "d6eaaf0d1e64000a6cd3b2c78f72cfd11997d43dc722e3929cd0f83ad7e951fde7c1e249e063776b6363e5e9d3533252", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424338, "uuid": "f34c7109-ace8-4c3a-b1fa-e52f9407752f", "value": "T1F6D4121A7A3D0B31CA5DC3FED912052013FF655F8905FBA61E8AB4E27B933404B54AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424338, "uuid": "2745cf60-3e59-4f30-addc-745090673ca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424338, "uuid": "2bb7871c-ff03-48d8-ac85-8a6c0148b6a0", "value": "12288:4o1DxLrOAoTu9p5znSG8zGCX1vYbGg10W5dX9dbS:4YDwAl9pYGOZXFYqKPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424338, "uuid": "a6ec4af4-6849-4f03-a791-feb856d40edb", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424338, "uuid": "f82167bd-0f93-4e07-84d5-335469c6ce8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424338, "uuid": "6ea81349-56d0-4f10-bbc4-1b49b4dbb6fb", "value": "DHL Receipt_95501229018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb6ce1a-5091-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694429632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429632, "uuid": "40d68eee-f480-41e5-a6ea-4927f3357a9c", "comment": "Malware payload (njrat)", "value": "9ff1021962d8931d2e5226ac6a2f9137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429632, "uuid": "12bf4481-1b24-4134-9e02-b1cd24b1e957", "comment": "Malware payload (njrat)", "value": "98fa0812a3769b52d75f2721118d7f37523d6c99fdd808ff09e6fadd1cd6635d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429632, "uuid": "607c66dd-cb64-4969-bc27-2ea5c779edd5", "comment": "Malware payload (njrat)", "value": "8b3f4ff20bbbe8ea17232304737180adad46a7cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429632, "uuid": "b1f738fa-ebdf-4358-813a-6d5ef65a65c7", "comment": "Malware payload (njrat)", "value": "75fe4a07156aeb54407f67f97e640cf0a0e8563a05641205512b2edd03e10574f7b160e3d2f12acf0f8f05470c2911de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429632, "uuid": "0190a55d-44bd-4e4c-b297-3856b9b18d2e", "value": "T10CC22A5D3BA08162C5DF6BB40AB2D72102F2E1075A27EB5F4CD844FA9B773C14E819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429632, "uuid": "90f5c61d-9fe4-4b72-9854-362fd666c167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429632, "uuid": "0755d2fd-1696-45d7-870c-3bc1e3e035e8", "value": "384:tLd6yKwDeBC8GetHzCYe/eBY2OzRLTm3yilqr63hb8tFvGH:9LnDecUT5e/csEGFvGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429632, "uuid": "294dcb60-f046-48ad-97e2-9763c49a50c1", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429632, "uuid": "35cfc2af-86b2-4820-baca-0da8e6c8e029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429632, "uuid": "4424b8bc-0226-4119-a77e-94fde0ee446c", "value": "bP8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e44242d-5099-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694433067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433067, "uuid": "39c5348b-b8e0-4496-a88c-e27b2f995101", "comment": "Malware payload (Loki)", "value": "0704e4ae55e1180a2e472c337504742a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433067, "uuid": "09407b33-5d40-40b0-abbf-72bc44600bce", "comment": "Malware payload (Loki)", "value": "990a99fb190adc5ddd931855c9bb413cd21a758e5f4e9ad42ddc9eb4085cc55c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433067, "uuid": "97de664e-11ee-45ca-bbe8-83d3a2e1788b", "comment": "Malware payload (Loki)", "value": "bfa3609bb4b825921a3fcb045e516d73843e1d73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433067, "uuid": "e71958dd-bab3-40c9-a7be-acb947fbefac", "comment": "Malware payload (Loki)", "value": "e583c6f2e256f12b81e9f9dcea9c754cba9c678398c502d8f9c652926fa9631516c44d68d22ce6b1667cf63c92b02f82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433067, "uuid": "2162921e-de66-4239-9e79-62d635be1614", "value": "T168546B9C726076EFC867C4729EA82C68FA5068BB831F5213E427159EDE4D897CF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433067, "uuid": "ceda329b-2c45-4405-82e7-bad0262453fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433067, "uuid": "cc52f361-247c-4d25-b042-15972ea8607a", "value": "6144:8MnH7cw4WMAElQlGgFkw7mCw9LCGdb7Cqoz8xiFqY4wq27I:84bhpMZlQlGMJ7mCw7d6qriFqY4wqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694433067, "uuid": "67475a89-9abe-4ac0-bc20-263d45ed0944", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694433067, "uuid": "543fad1d-88bb-4a82-b269-d7d35686548b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433067, "uuid": "846ab269-bc80-4d0e-b2b6-592ec28834d3", "value": "0704e4ae55e1180a2e472c337504742a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e8bdd5-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694426884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426884, "uuid": "693359f3-72c9-409c-be78-2e690ff8c4c9", "comment": "Malware payload", "value": "c80ad48f9dbc8801bb3e88a3c263be40", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426884, "uuid": "fa51d273-6853-47f8-ac48-99d140027aa9", "comment": "Malware payload", "value": "995e563090bcd77792ca6af39cde4e626e5fcf39c90721a5e14f0f384f4b95e8", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426884, "uuid": "6305703b-47a6-404f-a215-f19c61b9fbae", "comment": "Malware payload", "value": "0525b374b318c0d28c6d826e757fed282000d51b", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426884, "uuid": "cc8ac514-5447-44ed-b033-3675b83f9003", "comment": "Malware payload", "value": "7807bf9bc608a10fb21241fc6b4a3d9c3a28c980450c75fa59a50718d8f70cdc998988bb651f8168efa748fae5da8611", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426884, "uuid": "8b89a751-f1df-4616-bbc5-abc5f89bbad0", "value": "T148D31377F965111B17EF3D1DA92DCC16028583142FD6A92FAC3BAFC9C6C054BAB32224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426884, "uuid": "95659a80-6776-4e5d-b94e-c94486f87ba1", "value": "3072:ZSJZ8ho87Ef+JQbslezO0d0KE2GkDOmKbiOUxceXdMOjnPnmKYQSX:kaA+JQbslW1d0bkimKmVxcejTmKYQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694426884, "uuid": "0376da36-e2b4-4df5-9c1d-22a1492a2efe", "value": 142544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694426884, "uuid": "e63e7172-6dda-4586-9f8f-85de3f93bc11", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426884, "uuid": "7544ca57-4903-46d5-a2a5-14f500bd2dc6", "value": "QUOTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87c9f97-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438748, "uuid": "0e32a63f-2575-4aca-84a0-d4d8f6c0df64", "comment": "Malware payload (AgentTesla)", "value": "873c08ab5d5788a09fdc964ee73db54d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438748, "uuid": "e0da0b85-6cbf-4016-b756-58729723e342", "comment": "Malware payload (AgentTesla)", "value": "999c8e9cd08980e7af54ff2b7f40591ac37d81b7fc4470cba70f40925707b684", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438748, "uuid": "b342545e-0479-4a66-8080-7516d5b237f6", "comment": "Malware payload (AgentTesla)", "value": "924ca259757e2604db5bf23a0eb21fd30f0a52c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438748, "uuid": "6735f523-389b-42bd-a4c0-698a894a53aa", "comment": "Malware payload (AgentTesla)", "value": "2a39741ba278f2402003ffdf1ee36271471665c0f17dfd057598a216a89461801c79505d08b2f5c56fe8e9c488c675b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438748, "uuid": "ac3824b9-d653-4369-a130-aee38386e859", "value": "T18734EE137E48EB55E6583D3782EF2C2413F2A0D70773960BAF48AE6569452837C6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438748, "uuid": "6e849606-f78f-4b6e-aae7-96468074c6e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438748, "uuid": "7613aa80-cb4b-4904-8f6c-5c0d73e782e4", "value": "3072:5D5hjqDUJ5WZWilnlXdpckB48NhlGPQDvpH13n:5DLqDgTillXd6kbNhkIDd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438748, "uuid": "d1e038f3-4263-4d4f-848a-88ce258b6853", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438748, "uuid": "ecf31922-4adb-4978-94c5-5d6e8c080b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438748, "uuid": "45099d93-e5a9-4d23-93ae-5989238f8a7d", "value": "999c8e9cd08980e7af54ff2b7f40591ac37d81b7fc4470cba70f40925707b684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e57f747-50a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694439107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439107, "uuid": "6532caf8-9b26-41d1-9941-ee8748269735", "comment": "Malware payload (AgentTesla)", "value": "c5483576dccee0ac23cc4bbfa5629543", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439107, "uuid": "efe57678-2f44-45d5-b164-0e52f4269167", "comment": "Malware payload (AgentTesla)", "value": "99e3eacb8e3e7a864986921418025df3e67f4e8e0c0c63337a7e58ce7e810ed5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439107, "uuid": "6ab6f141-b26c-48e5-ba16-5cb0aa1d716c", "comment": "Malware payload (AgentTesla)", "value": "ea2b344abddcf564d69a87855be4c2ce0d4015b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439107, "uuid": "94289249-a61a-453d-94d2-e4eea4986dd5", "comment": "Malware payload (AgentTesla)", "value": "ac45e9284dd78992829482a2683e1fcf22d883d27df6c7fe7be58cc34505aa5b860fe3ff464011f59031dfebf7a245f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439107, "uuid": "54335c28-ff58-4e6b-bead-4babe8cfcfd9", "value": "T12F052384D4B80BBDE532A7B1BCAA71102F7696E43812ED1DECE513CE6B90F06D603957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439107, "uuid": "4cefc5c3-9375-4f53-9c5d-168805afdee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439107, "uuid": "55a043bc-ae4a-45f5-a3fb-bf1754d8510a", "value": "24576:q11xjrk1663RaU2XudnflJ9V31dsHe2rYkO8v:q+1663RaUtdnlV34+gYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694439107, "uuid": "134c80c0-4ce1-4fb3-b677-d2e041657158", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694439107, "uuid": "62e66410-f0f9-47fa-8a24-855a6a42cab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439107, "uuid": "03605a7f-e309-4be2-a64d-11166cfd4466", "value": "Shipping Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63066cc7-505c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694406822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406822, "uuid": "77674ae1-4497-480c-85ab-eae2f7d4028e", "comment": "Malware payload (RedLineStealer)", "value": "5660dab1794185fc99477b9706ca2302", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406822, "uuid": "e2c003c7-97e4-40f6-888d-b553714dbd89", "comment": "Malware payload (RedLineStealer)", "value": "9ab07c30e9084cf44d5eb9f2a298c6913d2f81a038cd26715924deabfd9c20b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406822, "uuid": "13e1aafb-0494-42c1-9617-708fb9521ca0", "comment": "Malware payload (RedLineStealer)", "value": "94aff3be39146beb3bdd753e41a933da74789b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406822, "uuid": "8d7fdeb2-c12e-4893-b813-bd108f888da0", "comment": "Malware payload (RedLineStealer)", "value": "3d4cc044709e3a4b8ddbe6c5662856976cc6820ee62def7ec05c0572cd6196832021da18efc7a8cda8f3008cc74bb63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406822, "uuid": "627dde45-4013-442b-b2ba-0a6a9bfa5bf5", "value": "T17C84E013A9F0BC71E55743700F2DDAEC7B2EB8A2AE60977632249D5E1D302B1DA5B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406822, "uuid": "c854400d-20c5-4995-ba29-dff0e301f44d", "value": "f815858bb8146375fb6d659cf6f7de7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406822, "uuid": "5676e356-0896-43f4-a66e-49adf4ebcdc8", "value": "6144:LLZJST7csOjO5xyeKmB9zRIP+QwbVY6pmdETGPdAH9n:L9JST7ujuxyed7U+QaOomdETGSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694406822, "uuid": "d1dc8cd9-0dc3-4122-a27f-1a5934d80991", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694406822, "uuid": "c6dae75f-7da6-4b86-98fe-fe0df9c17fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406822, "uuid": "640f83ef-bbf2-4faf-9020-0e310937c49c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2175d84d-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424751, "uuid": "68751511-c6c5-4ddc-b168-b7a63b899f30", "comment": "Malware payload (Mirai)", "value": "3c274ce9956bcebd6750343960d09894", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424751, "uuid": "3bee53c9-cc17-4b9d-9e43-80ffb8c5f2b7", "comment": "Malware payload (Mirai)", "value": "9cb409287e833ba174b2e9ec2136f14f0944c0df48e4128b3c687965e7c6accb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424751, "uuid": "f32a3a89-b6f8-4ff7-a6f0-34ec7ccef651", "comment": "Malware payload (Mirai)", "value": "a76f89fc848917f2d4deb4c3263807eab9f99655", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424751, "uuid": "83604234-ed9f-4b04-962a-11b19e524f3c", "comment": "Malware payload (Mirai)", "value": "20dfdbcbee5346debb5105b7785263fedced72f3782d6c754f7e9a7465b586827377846f54889c7d3c75ec2a1d8e6aec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424751, "uuid": "4fa39429-518b-4b03-a101-4a6e63b0ec7b", "value": "T1F8C2D0B1F5C13C64EEAFD8B0AC91CAC963618B5F36B281D525A0EF17188776322C1AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424751, "uuid": "598ff320-9e26-48b3-8c9e-5e978db5cfe4", "value": "768:2LoFOHy+umJLgNg3qJO7WRk5jvYyhX/f4uVcqgw09c:whHtPRga3VDbX/f4u+qgw09c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424751, "uuid": "0d13aeb6-e52d-4e92-b7d1-ea66d2d4ce82", "value": 28120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424751, "uuid": "275a12e8-5c2d-444d-a038-c3bf37734f28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424751, "uuid": "3bbc489f-ab53-4992-9d99-5a33328796dc", "value": "3c274ce9956bcebd6750343960d09894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792e716d-503c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694393115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393115, "uuid": "0d8e1bf2-a6b7-4115-937e-e633701dd7d2", "comment": "Malware payload (RedLineStealer)", "value": "641d680ba3578e51d0086e3d212a8ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393115, "uuid": "f4d9fa1b-0159-4c2b-9a05-5c61a3295d8b", "comment": "Malware payload (RedLineStealer)", "value": "9d909ab13627db51dbe5779b8fa901321dd88338ffb5d19757cb83c144949ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393115, "uuid": "427bc038-5d47-4784-b1b3-f49df6689edb", "comment": "Malware payload (RedLineStealer)", "value": "7f406d70311248ab84f94cfcd8a7aae8f118ad33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393115, "uuid": "4e4e0be2-6f04-4c43-8dcd-96ad45630ec7", "comment": "Malware payload (RedLineStealer)", "value": "4f1147e4014867b686e5ec5ba3bcfce62f69cadc77f4772d46453817c11ad75db62952f2b9e1503a3037b9958a7b0754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393115, "uuid": "f452964a-769f-46b9-b087-f0e70b2588cc", "value": "T1D2651211B4D086B2C83B143606E19EB30D3AFA300B61ACDB97588E7D7E792825E75F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393115, "uuid": "75e7aa4f-f805-4e03-82b2-73494bf82cd3", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393115, "uuid": "2709002b-eb0d-412a-989f-177807f1d738", "value": "24576:31XCJg/4+vCWkzb3uMRel19bPsqC56DLAXrQSPMPrlFq3NW2Bu1Hg:lXCJF8kP+MRkuqC5AAXrQfANW2s1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694393115, "uuid": "1d061d7f-9e45-4fa2-9dd4-1ee9517faefe", "value": 1468792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694393115, "uuid": "bcc3cc22-04dd-4536-ade2-ca6350df150b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393115, "uuid": "82634db6-74d5-4d19-863e-d6aeced3bc56", "value": "641d680ba3578e51d0086e3d212a8ef6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3440fd-5058-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694405119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405119, "uuid": "4146ffd7-9194-440f-b3b9-e7c54111735d", "comment": "Malware payload (Amadey)", "value": "4fa62ad4ad8dfe4cf44ba0ac82966030", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405119, "uuid": "107027b9-0dfd-464c-9c2b-ce5b3921ce55", "comment": "Malware payload (Amadey)", "value": "a01ac2f8296137a71a673718ff2e4532bb0928abe213ac871de64d459cb33cc1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405119, "uuid": "22d87481-4eba-4b7d-a73a-44e80b7a05d0", "comment": "Malware payload (Amadey)", "value": "e72f3e683190918b6e2e173cf49a27cca643e5bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405119, "uuid": "ea53617f-5596-4566-94ae-e9c00348f22f", "comment": "Malware payload (Amadey)", "value": "12327e299fd11ccefa0b8c832d50a623f786891b1a182769cd405f9c2b3ac735502fa1270578ad4d373f920ac02b8e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405119, "uuid": "bf2391f7-0548-4aa4-9afe-89da50b03645", "value": "T11365126034A640B1D831163656E0EEB7233DBD601F5595AB13E88A3EDA309C18F7DFDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405119, "uuid": "84d818e3-085e-4e5a-9197-95b8094683b7", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405119, "uuid": "c43abdcb-8283-497b-9e54-f0933fe71325", "value": "24576:H/OCJQtRO0hS0M5TTrzZc7TySq4s71vyDtwCOXZ5OEj0phS/HfPzu1Hg:fOCJ4R/PMd8TRq4kyWCcZ5ZmSHfPC1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694405119, "uuid": "9f1c9c2d-545b-4e04-b2be-a3559f62d295", "value": 1438584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694405119, "uuid": "1ee76a98-43a2-4bc3-97b1-660ef07dac85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405119, "uuid": "a4696530-c82d-4168-9b7a-2dcc2e3139bb", "value": "4fa62ad4ad8dfe4cf44ba0ac82966030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a03102-5043-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694396142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694396142, "uuid": "1e15badd-db2a-46dc-9998-a6460bcb5890", "comment": "Malware payload (RedLineStealer)", "value": "1a95d775fa8f39b379c8a25772a6ef2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694396142, "uuid": "309c016f-0895-4e69-91ec-98876dc71056", "comment": "Malware payload (RedLineStealer)", "value": "a08262c0594eb1a4dbd3ab16cd85b8caeaeac88ec05260c9e8b7879009f09c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694396142, "uuid": "5c2cf74e-ba88-4525-9fa8-62c4f98354e9", "comment": "Malware payload (RedLineStealer)", "value": "099c67f7893f367920657f6b456682eae96b31a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694396142, "uuid": "a267b63c-6326-485d-823f-92f61c6952fa", "comment": "Malware payload (RedLineStealer)", "value": "2ef5aaacd09b46598422c389e7d890bed0c6ecd91e85ab254dc1a62cdaff5feecf2c4ed72a96b9338e68ad1c9afb3e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694396142, "uuid": "49962ddc-1d9b-494c-bc71-dd93dcead314", "value": "T1916512013582D831E8326937C6E1D77285FDF6601F49D5FB93A80B6D8EA4291F37D2A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694396142, "uuid": "c0184115-db06-40a5-b813-d1f998166b88", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694396142, "uuid": "f5cd2e1c-57ba-4e76-bc2a-14c0b6032d15", "value": "24576:97PCJ2SL88JBdco3IzRZDl1KNcsexnFhsi/bels1iXAxq+HsY0Q/4hRd4VRu1Hg:lPCJ2S9JBdc7ZeNcs2FhsiqfXAIcYh8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694396142, "uuid": "6e395677-6434-4a9b-9826-9182fc258a8e", "value": 1544568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694396142, "uuid": "b2dc4413-5949-41e7-834c-ccd72d931166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694396142, "uuid": "65fc97d5-e1c7-4e44-b428-af57bb9fb5e5", "value": "1a95d775fa8f39b379c8a25772a6ef2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4bbb4e-50a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694438248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438248, "uuid": "21d66a51-84d8-4872-8b35-3ea2da25bc61", "comment": "Malware payload (Formbook)", "value": "a91a56def7499547f5754f39f151ca4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438248, "uuid": "d44aabdd-096a-4908-9629-04f60b0ee560", "comment": "Malware payload (Formbook)", "value": "a28374f6b3b3ef8cbffa81fb7af139e116b356f23450f9454a57f0af02a1806a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438248, "uuid": "a44e6829-7b7a-4c93-b43a-af55a1515e17", "comment": "Malware payload (Formbook)", "value": "41cc6a9b9986b3d9ca7d098dd0da943b1783138e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438248, "uuid": "cbf85f39-921f-42a6-9e3d-72ef071bab24", "comment": "Malware payload (Formbook)", "value": "bfb4498072cd7903163f85c17dc8b887562b03f40c6fe31fefbeb23d0ace5d31e46fc0d12efc19c1d6fc72cf625d497e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438248, "uuid": "f9b67d00-f52f-469c-8a80-484126ccbc32", "value": "T1ABA41263EA34C3E3C9530730ADB657287BA490C1465A1957275839DABE21F63FE1C2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438248, "uuid": "1c638331-1a29-4104-a8bd-f2b71baecacd", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438248, "uuid": "f2882ab6-fe38-4117-8665-329c96932a23", "value": "12288:F0JI+8FhzuLGbrVCF8nyg77tQIUiohso4DV:q83zTxnZ7tQf1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438248, "uuid": "fe3cc9c2-9cbe-4de0-9471-916e3c52ab73", "value": 459160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438248, "uuid": "e33ae279-f369-415c-add7-f4fef98384e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438248, "uuid": "ec13a1fe-d7b8-49ca-b238-f441b3382189", "value": "7010096782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e61cd38-5075-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694417605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417605, "uuid": "24ddd488-f5f0-469b-ac97-c64322c86c80", "comment": "Malware payload (AgentTesla)", "value": "d9807b0dff986df4bb938363aa0b7380", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417605, "uuid": "a1abb9a5-6325-472e-9062-292f45f4ca9f", "comment": "Malware payload (AgentTesla)", "value": "a2ac581ff5eb7ffea03b665a0ebc77b50f86b7a8d19a8291ce6b66ebd35bc5bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417605, "uuid": "d1660dbc-cc35-4ed2-b5d7-8876ddcc0ad6", "comment": "Malware payload (AgentTesla)", "value": "92faf1c5848da73f59b4091d1300404bea064a0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417605, "uuid": "505bab07-80b5-48ca-a82c-fc969859cf97", "comment": "Malware payload (AgentTesla)", "value": "3ff20886fd1f9ce69dca4d29d71bc1412448165a45164fbd74d7d52ba50d5cebc394c60dedfaeb9a92080f23fd5aa37f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417605, "uuid": "5e50e39b-0ff4-46d0-8c96-11ea7d9212a4", "value": "T108D423180FE9FFD1980D64935D44E8A2F6CDAFF753C5EA192FB550380D4C7A868AC8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417605, "uuid": "d75a01e8-2555-44d5-ad56-520a8c6dade6", "value": "12288:igE3shwBc15dtrJ/TrQRCnsqwqfXbjXUWS208TatyPbbf2dXzqhH:iLal15F7B/wWveb1yA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417605, "uuid": "ffc42d51-c63f-4d04-8f0c-5fe8a8412990", "value": 653795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417605, "uuid": "8195217b-a7f1-4475-9cd0-f57b6bb945bd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417605, "uuid": "5563316d-b719-42a2-a74c-8b9a3e19c094", "value": "Credit Alert.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13280b5-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694423811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423811, "uuid": "3ef4485e-b6b0-47f7-8015-abe6a6097660", "comment": "Malware payload (SnakeKeylogger)", "value": "41cf765b1a5f3dd3e45210e171e15427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423811, "uuid": "50a2f2c1-4196-44ec-b601-8a9ac0d974ad", "comment": "Malware payload (SnakeKeylogger)", "value": "a33eafbcec3736e5d47d6c951a6824ed67a0e124131425f04e2e03864edf8502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423811, "uuid": "94c024ce-b9e4-4f82-b92f-8a90397f44b7", "comment": "Malware payload (SnakeKeylogger)", "value": "28892df0452c3c4f8e691a2c4a6e8cf95ac9de06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423811, "uuid": "8043df31-dda9-42c9-9b85-33ef7b439c6c", "comment": "Malware payload (SnakeKeylogger)", "value": "f26fe2e32489c480c80b40445d961c0336935740b00c7512547e241273a645fc5da86db22bff54f19c61602712c89aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423811, "uuid": "73ac67ae-b53e-4ba9-ad77-f9e1b1c7ed46", "value": "T176054CD1F15088DAED6B09F1BD2BA93024E7BE9C54A4410C569DBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423811, "uuid": "f83bbb1f-62a2-4429-bb16-5d6dab0f543c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423811, "uuid": "a721752c-d9fb-4285-a6ca-104d14c4e354", "value": "12288:E2iNZ1DadBpD/+O6rvu0eIdLivYZwtVXOZcq3tp:E1pDGpDJ8vun0LivkdZcq3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423811, "uuid": "a61bb9f3-a6ad-4767-8811-233888c4594d", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423811, "uuid": "78c937c4-e04d-4c19-ab0d-08de455ce726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423811, "uuid": "f4479422-ca41-4786-997a-ea4599154a2f", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6ff5cc-507b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694420125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420125, "uuid": "f9349265-d5e1-44dd-85cf-40ca3af8d8a6", "comment": "Malware payload (RedLineStealer)", "value": "e70b8a77f95261e4bc294d902084cf38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420125, "uuid": "ee8722d9-67e9-4213-8186-e72b79920021", "comment": "Malware payload (RedLineStealer)", "value": "a34c801df1ebf674ea2bdc00d6011b000c49e9e417e5911b4a9fd8ba12b7ae73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420125, "uuid": "7512c7f3-bac5-4591-a34a-07169247cf20", "comment": "Malware payload (RedLineStealer)", "value": "ba361f3f37c8bbdd0675d7ab9836e24a30be48e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694420125, "uuid": "0aeecdf4-f0b3-4c5f-bfff-6e35b2d89b26", "comment": "Malware payload (RedLineStealer)", "value": "32ab6da82620186b3951a7839a921e664df2b6a02d48c72936967fa6510a045c6b23bbd167e7ded40c77f819bb1b59cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420125, "uuid": "759f60b0-b217-448f-a8e1-75d014bf0d76", "value": "T1CC646CD352D0A8B7E52246318E1AC6E42E1EBD604F5536EBE3547A6F0BBE1E1F172301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420125, "uuid": "9125429a-be9e-4367-8323-e0ff3628863e", "value": "6c0d1a96503717b34f08f8921d0cf906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420125, "uuid": "c17ee7c8-721e-4202-89fe-3af388b92a8d", "value": "3072:2i5l4mVg564NNN0A0vQUp/67Z0eRe2IXEPHpERHDJEN+MHwgVS:ar564NDL0vQg6xeJ0PHpyNI+MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694420125, "uuid": "c5f13db7-d779-459f-a15f-150c4cd00874", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694420125, "uuid": "881068dd-f0ff-4a48-826d-3281ced11aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694420125, "uuid": "3c4d9680-8869-4ccf-ae18-b7afd808d286", "value": "e70b8a77f95261e4bc294d902084cf38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e62765-50bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694449526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449526, "uuid": "ccb5937d-bd07-4f2e-9df1-4648885fc0c8", "comment": "Malware payload", "value": "01347dd4214ef8ce566216467f2c8047", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449526, "uuid": "ec8d1b46-48b3-472e-955c-84f304072fd8", "comment": "Malware payload", "value": "a3c341fdeeaa3c8d1462042aef68f99c75c5c301bab46b0d6973db1fc905918c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449526, "uuid": "691c6d9c-1c73-427c-a416-2b9175433dfb", "comment": "Malware payload", "value": "03348c2c52d6cf90bc66a9556fa7e86884c669d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694449526, "uuid": "7acf3aa3-016c-478c-a6dd-7b8b34dc23c2", "comment": "Malware payload", "value": "3fd38be12ac09e5f29104ec5e7d80b8acc947346ab5a5f7aee2898d6f8650c4119db6140cfa7bc2091976470e5cac8a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449526, "uuid": "9a7d7d8a-bf29-49ac-b6ca-7c48af42647d", "value": "T1BC866BC1D5848E4FC32B6E702E5582D8666DCE3BCF00CE8E14BD86AE6DB2B45D57C624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449526, "uuid": "77eec7f0-46ef-4049-96bd-61cf309f1229", "value": "49152:CSFIqIJFY83N+qsoFGsimna6QTC5GCpNifB8kP7CcfaJDJk3uEi9y2zk9:krJ1woG2a3TS3pN26V9DQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694449526, "uuid": "5f771f11-bd1e-48d0-9907-d728ef0a9116", "value": 8563057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694449526, "uuid": "39a68fbd-0ff6-40b3-b6d5-0c0bc2634063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694449526, "uuid": "8b9614ed-765c-4966-9d9b-5fa36acfa49d", "value": "a3c341fdeeaa3c8d1462042aef68f99c75c5c301bab46b0d6973db1fc905918c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8bc28d-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438760, "uuid": "97e5e0cc-7377-43d8-88e8-7e336513e9e3", "comment": "Malware payload (AgentTesla)", "value": "e90456a3be8234d07514219bea18ba86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438760, "uuid": "13037613-3655-45f1-8744-db55aabf4a52", "comment": "Malware payload (AgentTesla)", "value": "a43494a9af463fb67f733c43ea74cd629728cdecacaad0ca471c0c69e475b8a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438760, "uuid": "c5216496-2ad9-4dc3-9dd6-1900aef82d0c", "comment": "Malware payload (AgentTesla)", "value": "cdc95490c6504580ba032d8ed343df00b4b1ba1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438760, "uuid": "5fde6fe2-5a1f-44d4-a3d9-bed0152ccb9d", "comment": "Malware payload (AgentTesla)", "value": "1545b34cc7dbda086201b73244ec3fd22170a6c5df4a3c2b9cb9560ff641f48d652d7f0668d9e7d02e846772e22f0b4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438760, "uuid": "7a95c6e5-ff49-4f3f-ae4e-e8950abbc366", "value": "T17ED423995C291FBDCFA30FB12012AEC23B7C4D543104B6DF69EC159D69A2F174A23993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438760, "uuid": "7ca0b05f-9a0b-4528-b6bc-a70b6854589f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438760, "uuid": "4d2343c8-04fc-4399-bb47-d960f16ad53d", "value": "12288:5J2iNHxWorymjHnFmJfz1ET9V5TjPzffFxtjoadY/4JEipI6/Sa:T11xjrymbEf69V5TzzVxtjHd84Zp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438760, "uuid": "17d7210e-fa8a-4101-a1dd-89f8ecd662ab", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438760, "uuid": "384558ae-740e-4c30-923b-e85e28209e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438760, "uuid": "0b2a4435-99f2-4d34-8c22-aa42e1c61c60", "value": "HANIR00110876_VRTI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7439b33a-50b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694442928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442928, "uuid": "1fe4e639-f383-4a82-adf9-8990ba8ac0a3", "comment": "Malware payload (RedLineStealer)", "value": "96dc6972d086e954a8b26414d984bdac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442928, "uuid": "f7557c34-6ece-4f41-8b6c-258507fb5187", "comment": "Malware payload (RedLineStealer)", "value": "a4f8591f4d334bd38cefd3d69a596a495725aed03f7c434f5ed5b8bae51b4094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442928, "uuid": "7b74df18-cc56-49c8-a466-42292800c381", "comment": "Malware payload (RedLineStealer)", "value": "3fdf3210c7dae4635cf13b2eb8dbdef5018c1f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442928, "uuid": "e4d44769-6500-473a-9915-81ab27d9481a", "comment": "Malware payload (RedLineStealer)", "value": "e313f85544513f0dbb620d2698b1ddeb264f6d2966fdac20cac51a66099b05393b335392a0f1268688c91cd181e87a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442928, "uuid": "9b14d062-a1d5-4c95-9a2f-ba9d1b409852", "value": "T183651200B4C1C032D5A619368DD0A7E50DAEA9325B228BCFB3D42E6DCE6FBD19731567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442928, "uuid": "f641d80b-5373-4cf9-827f-49330eb8b99f", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442928, "uuid": "66e54a58-134b-4932-84e3-6b0d4b5020ad", "value": "24576:GeSiHCiSBBl2VjsBKMEa2oFWkc13A/qPQxQbuLHNpdOGbjuF9H:GiOBvIsBKvhKWk0g9xQbuD9OGnuF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694442928, "uuid": "a5e6d806-69d3-49aa-904e-555688a8b73b", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694442928, "uuid": "42564c65-f94d-40e9-ad8a-f2e1a9f464f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442928, "uuid": "76b8b172-7298-4354-9070-34045c66e1d0", "value": "96dc6972d086e954a8b26414d984bdac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b64903-505f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694408083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408083, "uuid": "18e6b796-312e-4ab2-bd5c-8a30478948a0", "comment": "Malware payload (Amadey)", "value": "114dc452d2dbf9e4812f427bbc4e198b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408083, "uuid": "8001a5f7-ebb3-4739-8ba8-ecf2650bb63f", "comment": "Malware payload (Amadey)", "value": "a53cad98526322a304e2f06fb07cc835341cbeb51a6f8e64ca49b8cd12f74a9d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408083, "uuid": "4525fcc4-67bb-49a9-92d7-612401b656e2", "comment": "Malware payload (Amadey)", "value": "bc025ed1d49dfea3dcaf1a0c1d9b9b05744638e7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408083, "uuid": "286a1c5b-8486-4c32-b521-21472de5f2ad", "comment": "Malware payload (Amadey)", "value": "66bce1fcb65705994bee0df825d5f52cbf00f86ac2e47ddabbba900e47cd95422867af7a05fd0753b4e826ccbecdfce3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408083, "uuid": "ff2aa300-25f8-464d-9f23-5f4a038d680c", "value": "T1E4248C136CE0BC61D567C7704F2E9ADCFB2EB8625E64871B32040E5E29312B1D96F366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408083, "uuid": "bd553268-b9b0-4b8a-8337-408d2663298c", "value": "f815858bb8146375fb6d659cf6f7de7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408083, "uuid": "e49dbaef-eba7-4f4b-8996-47711c1825b9", "value": "3072:A43OLr6zOIelzj6YW06UfsAtF6PEZOxBKls1S35AHC7Gxp:OLYOImj6L06vAt6E2nlHCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694408083, "uuid": "88893904-5147-40d9-b521-710941af41fc", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694408083, "uuid": "3216d867-56d9-44f4-bb69-27760b04e911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408083, "uuid": "b6622334-7388-4dc9-aeef-ead7a8b0d655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfb79b5-505d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694407134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407134, "uuid": "83b4614e-909a-416c-8d7d-c912d1d9d468", "comment": "Malware payload (Smoke Loader)", "value": "467ec37098a62e5d58dacf30336ce2ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407134, "uuid": "7d0a5fdc-f93f-4a73-8d1e-e0af3ddf19d9", "comment": "Malware payload (Smoke Loader)", "value": "a59a55716baa83c1ead452011fcb236787398c4c5d0c978aa9ad0b9b1bf15057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407134, "uuid": "88c218a0-b132-43dd-824c-a6b8b59cf5ec", "comment": "Malware payload (Smoke Loader)", "value": "c480d016715239eddf70edfaf2067b7fb8f6d923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694407134, "uuid": "24475814-e1d4-49b7-84b5-2eebeb3fe099", "comment": "Malware payload (Smoke Loader)", "value": "9de18f23e776ced71cbc8fcaf3846a9842e36d7b637884b90dfcc90cb09da25fe24366c4ea93b9d87e7495dee064e79f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407134, "uuid": "5a6ce3ea-adda-40fc-b76a-030a61b353f2", "value": "T1CF248B1365E0BC62D5A747354F2DDAEC7B6E78729F628B5B32041E5E28313B1CA27312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407134, "uuid": "65b14009-7ad3-43d1-98bc-b53d5dc50a35", "value": "f815858bb8146375fb6d659cf6f7de7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407134, "uuid": "5fb88021-3e04-47c3-aca2-213ec32dc13a", "value": "3072:GXV5LHenoeAPBGwxN4fBrJa9yYGmECyt5A+6xp:MLcozPrxCp1aAYvd+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694407134, "uuid": "de176db7-ff7f-4449-b3f4-62f125bc147e", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694407134, "uuid": "db0fcdbd-d548-49bb-9821-1883a1da175e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694407134, "uuid": "33aeb614-3d88-4abb-af8b-3b4563d03642", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b08f77-508c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427357, "uuid": "5cffd81a-732a-4147-a603-e990126e98cc", "comment": "Malware payload (AgentTesla)", "value": "37f38da5ff590566dfd19af906271720", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427357, "uuid": "3e9dbddc-e920-49cc-837b-f4a80456e620", "comment": "Malware payload (AgentTesla)", "value": "a5de04d4675515879727c01c0238d7f1a887057f71632eb5095a412ffc92561b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427357, "uuid": "68957d57-9ee4-4b71-9b4e-47724f186ba0", "comment": "Malware payload (AgentTesla)", "value": "dab5d0445ba16b4c0605ea65f85986fd4450f9cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427357, "uuid": "5e3fb565-d4b4-40f9-86ad-0692169833fe", "comment": "Malware payload (AgentTesla)", "value": "1eb676a343ae7c05a52e4462fb2d1dbffb3baedf37972521ca716e643acc47c127ba0cf7ab0dc3759b99e5d168ac4d43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427357, "uuid": "d7e5abfc-5e8f-47b8-a444-b7216193e555", "value": "T100D423906858664B6C980CCD5792B8A6EC0737FA18DB37207B5F53917A0EB8F05DFC52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427357, "uuid": "c74dfaae-991b-4d81-ac97-9e01417f86c5", "value": "12288:odjbsaNSOModWnMazSt2Zlnf4lI1RQNg7tGBT9uIx3wrxe6xfRGQ9XeP7:oxsaHMbfSmln3n+uIarA6xfMeOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427357, "uuid": "10d52eed-ab80-4ce8-abad-1f21b8ff0320", "value": 607065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427357, "uuid": "4db12227-d5d6-4b5f-b98f-40af85a024db", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427357, "uuid": "ff25f575-3f07-474f-ba9e-dca6b67d4619", "value": "Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034196ae-5073-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694416540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416540, "uuid": "6f1fa5a7-87f8-40a4-88d9-1af4b78c97b6", "comment": "Malware payload (LummaStealer)", "value": "9617ac638cce118fa86821f2e66625c2", "object_relation": "md5", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416540, "uuid": "a0af37ce-05ae-4e8c-96f3-5d289fe47e6a", "comment": "Malware payload (LummaStealer)", "value": "a8c2dc91210c554ba020b333741e494b1eb4ee3443440fb2c4e990b74a57b896", "object_relation": "sha256", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416540, "uuid": "ff23bbba-5688-4352-acd5-9f3662126385", "comment": "Malware payload (LummaStealer)", "value": "9fa73bb1a7f2a8cd7c231ce55811c21da7911205", "object_relation": "sha1", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416540, "uuid": "d01ecc49-87f4-4b7b-9714-b2e4039acfcd", "comment": "Malware payload (LummaStealer)", "value": "bfb9f5d95c595902dfe9ac39b691c207110d83807ef99e17681f16f1a36a93f4034092baa97107940ad6ee7c22d33f7f", "object_relation": "sha3-384", "Tag": [ { "name": "documents-notificationsapps-com", "colour": "#F6EA02", "exportable": true, "hide_tag": false }, { "name": "gapi-node-io", "colour": "#F83FE9", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416540, "uuid": "ccbda44b-17a3-4433-86da-9e0222aea3f3", "value": "T1FDE4AE9CB7D0C972EB2B2232B61035E5489DB0DCE716A3B772CC737A2331595D99D288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416540, "uuid": "7a2840a7-cc95-460d-85d8-bbe2842d96ad", "value": "12288:9BLHkCA16BInLyl+GbRoBhV40o3u5jP4yJLcwqQfIpQO7yra7Q8QZ:9BICImUml+OyBz4Du54qLlqDQiyra7XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416540, "uuid": "231b9251-1fa3-4b3f-8f12-ad04ca787c7f", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416540, "uuid": "ee8ab08f-3a1b-49a8-8e85-b24e6d731256", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416540, "uuid": "9bc18c03-cf08-45ba-b69c-117d02f7d1f9", "value": "Document.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24a1497-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427141, "uuid": "eba5159d-5118-4d09-8a96-88b354924636", "comment": "Malware payload (AgentTesla)", "value": "1daf425d56a364d0cc875bfe9436f0b9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427141, "uuid": "4a10671a-aeb2-40c6-b52a-76c0c2952b83", "comment": "Malware payload (AgentTesla)", "value": "aa31992f2caaef02abb41b20b5e6c8c0e2065edc02b128ebb9fc505733584444", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427141, "uuid": "9c4a27ca-4932-4ef1-abd7-ad4b4d432ba3", "comment": "Malware payload (AgentTesla)", "value": "b16862ccd488e8690a97a5afe2d433b89a0f246e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427141, "uuid": "f7783be7-19eb-40d5-8a4d-50a59472c631", "comment": "Malware payload (AgentTesla)", "value": "abc8710af9a3f8ecb24bc50c1210c68798944a2aa7b3fd957232a0bc07888d7098ce248b33fc9a76c46194d76cd57150", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427141, "uuid": "8d358766-0803-43dd-b0ec-10004bcbe10f", "value": "T1A7B42340AAE71651C0D289639C3A0B7634DD3C2716F26F9B18FD4AC33111CEAE5D6EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427141, "uuid": "9b13af68-bb29-4ae2-a7c9-eaa32a3ec519", "value": "12288:+O1spAyLvJvOTzHW5B+DUgoQwi2ciEdFuj5BBUGBRp2mSDpF:NsWyFvOTbQ+DxnJio/GB7ZSDpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427141, "uuid": "f7a6c128-d4d5-47fa-af18-ed4f80479566", "value": 538063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427141, "uuid": "1a4948f9-853f-4654-a27d-2e1c51ca04af", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427141, "uuid": "b7176032-9151-4691-bbe0-d80f5a7992be", "value": "PO-001120230627_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94caf50-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438749, "uuid": "9784cf1f-8acd-417b-8611-c3a3305f04de", "comment": "Malware payload (AgentTesla)", "value": "d8a8a5f1d475fd9a680971d1ef386d7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438749, "uuid": "c697df02-42df-42b8-9d12-ed6808d7f9d8", "comment": "Malware payload (AgentTesla)", "value": "aa64f84bfac1047400eb05f1a8a4c9876badb46d76d7bf58587cfef60edf0485", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438749, "uuid": "f16402c5-9dc5-4afe-8cd6-9d10d91f9df4", "comment": "Malware payload (AgentTesla)", "value": "d2d6dd6acede77d2da752654a1ab834891845972", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438749, "uuid": "a1f09696-4213-453a-9be4-f221309aebb6", "comment": "Malware payload (AgentTesla)", "value": "249bff190fae665bb2e0232cc8809d64b4100e74f0ad67ad939878795c0af1ba7b835112e5b1eb25ef88618f2b0b1ef3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438749, "uuid": "492ec3d4-cdc0-4c50-a981-ca269bd6bd7a", "value": "T16634FD037E48EB11D6983D3B82DF6D6413B2B0C71773964BAF48AEA529552436C6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438749, "uuid": "85426657-77c5-414a-9d27-03ca1ba16f62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438749, "uuid": "a2a26401-a982-4207-848e-642c859bf67c", "value": "3072:Mu5vKz0l1RqRLYwQbNZ3WeCF1DMapHNGv:JK0ljqRLYfbv0Mapw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438749, "uuid": "f9ca4331-3970-4c47-ac85-1750b53ae413", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438749, "uuid": "afa559a6-5f98-4d5b-9db3-8dafbcc382f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438749, "uuid": "053376cb-a852-477d-8928-6698c7b7e4b0", "value": "aa64f84bfac1047400eb05f1a8a4c9876badb46d76d7bf58587cfef60edf0485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09f0edf-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694427138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427138, "uuid": "ac5bb335-9afa-44d8-b523-943a34ecb7b6", "comment": "Malware payload (Formbook)", "value": "3e872f7ad96072d1cdd0e1a07ad9f05d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427138, "uuid": "1cfe56e5-d58c-4a82-a026-9605fe4cacf6", "comment": "Malware payload (Formbook)", "value": "ab74e640824726577683513e668724031b57f603a83e8ba975ac6e8d75a2e7ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427138, "uuid": "e1b7624a-d9b6-4c4d-b11d-5c3e6b2fa8b2", "comment": "Malware payload (Formbook)", "value": "f45ce1f78534c712d6e04625b5b26c516a6e1c7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427138, "uuid": "7535f7cb-f44a-4d3a-9536-862d7dbf7d4b", "comment": "Malware payload (Formbook)", "value": "a01b3ba58a7327097838fb3fad0fda417e19227af9dc9afbbfbffb64f047c5ce1ac4aea133b0aa8e4b4b440b659d67eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427138, "uuid": "af28b0bd-a460-4168-85db-f1a9dec16472", "value": "T11C74233FC30FD1B839C25DE2322E1CDB356A86634E55E2EE42B07D25B04A19C1A7D65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427138, "uuid": "19bdbddc-ec2d-40c1-99de-3ee7d12418f1", "value": "6144:mjw54yBPqwUGPOl1GZvQ4+lwH2kxHvtZDpUuQA2h9pzdnI8PcHs8/aj+eABz:mjwyBGPlol02kxHlD/QAK9p1I8P0alw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427138, "uuid": "d8a94180-7afb-4514-93bd-2f9b3f43d2ad", "value": 353121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427138, "uuid": "58225644-81a9-4fb1-a548-21f53858a0d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427138, "uuid": "5da2e4ff-fe2a-469b-8803-8c9020b8d017", "value": "Petronas requesting quotations_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b123b1-50c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694453724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453724, "uuid": "d9fe3b25-e55c-4c80-a4f9-1cee41aa764c", "comment": "Malware payload", "value": "e2953d1567e6f37d5ff3e7cfab85d09a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453724, "uuid": "4306cba8-024f-4a15-9c2d-48249ecfdfd3", "comment": "Malware payload", "value": "acf074e8d938c5fd0ecb13a568c819c0cdfb94ff9504406d779846806cc7a4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453724, "uuid": "52c64fbb-713e-4fed-bb27-9ca5ea99c5bb", "comment": "Malware payload", "value": "1e6882a962368714d841477da7096a2324604633", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694453724, "uuid": "7628918e-8ddf-457e-bc1a-b605fe83e7bd", "comment": "Malware payload", "value": "1caa5911f4d7621487de55d6662e714023887e15c80e4b3110740efb787107ec11d841e52627c34f9de37de7e3f62e1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453724, "uuid": "b7fb6acd-b910-4c4d-923c-f42316e28dfc", "value": "T10A0301D11321178C9366EB78397E701A853C122B32D51E003D97E64EE64B725987BEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453724, "uuid": "87fcfd74-1fda-4a8e-afa7-4c1324c80596", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTN:87vbq1lGAXSEYQjbChaAU2yU23Mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694453724, "uuid": "0ad551af-5ffa-4101-b2b1-e4d80a2d0129", "value": 40320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694453724, "uuid": "81555b70-4384-4d5c-b480-603b9bb51e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694453724, "uuid": "aad45247-f343-4dbe-98cf-12974517f682", "value": "SecuriteInfo.com.Linux.Mirai.4338.24587.25284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b376d143-5080-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694422419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422419, "uuid": "eaff7363-5d89-42b0-9ebc-dad2cb6b04ab", "comment": "Malware payload (AgentTesla)", "value": "6971dcbb42faaaeb2cbe61a8807d7a0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422419, "uuid": "54cb567e-7609-4b1b-a222-a1c80b43904a", "comment": "Malware payload (AgentTesla)", "value": "ad2a1e6ea8fb128c76cafb20b9eae42b641ba5bf8932ac1867a8e3c51889192a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422419, "uuid": "e564ddb2-2847-4a4a-a287-3c7ae2ec4f23", "comment": "Malware payload (AgentTesla)", "value": "a580bd25248fd299c9e9678dc7cf7dbe35856d23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422419, "uuid": "1e05a9f3-cb2c-4ac2-9c95-7f4f0a53cc0f", "comment": "Malware payload (AgentTesla)", "value": "b40a04cd54545334b061c077b7207df4c7955882ac760dbb02e81deea176a03c8971690ad6f77d4a4d825be7eed3a7ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422419, "uuid": "7d792753-62f1-4218-9e06-45b60d74460e", "value": "T1B2D401447AD84E22C3BE037895652268D7B10167093ADB1C7FDE359B6B3A3101B87F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422419, "uuid": "7b8cbb3d-1aaa-4762-90a3-e5c981a8da07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422419, "uuid": "c4e1c08a-66d0-466c-aafb-a1f7711f401b", "value": "12288:s4VDaq/DJGWTLLRuAaenGzIbiDh016tscAGlv+/fgh/eL9GSOg1BeWhy:s4VD3/DDLgAaqGsEsMstIPh/eRDOaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694422419, "uuid": "9bcdbda4-cbbe-4d74-8b01-925d8c3ff3bc", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694422419, "uuid": "50865f3b-f43f-486a-a515-96241b91c7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422419, "uuid": "769a175f-d2c2-4c3f-9b07-8d4c2ab6608c", "value": "BANK DETAILS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24a1d7b-5071-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694416028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416028, "uuid": "a15b89f3-e443-46e7-904e-a819e443876b", "comment": "Malware payload (AgentTesla)", "value": "53f718679543e8426d524e109a5af5e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416028, "uuid": "3b5ce10c-0a11-47a8-ae39-0f9db26b6bb1", "comment": "Malware payload (AgentTesla)", "value": "ad72b14d0f54ea817b982343147bedea1eccf899bd737341f78d5e647fda22e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416028, "uuid": "55038dc8-01de-4422-bcb6-05a7eae2c875", "comment": "Malware payload (AgentTesla)", "value": "7de9c3155953bad3d3e60c451e025d1f0df778c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416028, "uuid": "b513d102-6a62-47c8-9436-514f18f7ed9c", "comment": "Malware payload (AgentTesla)", "value": "baf65a16d9d7db3fe776a8ba70e161e33647144efe47a969e3b1210ae17609a459fc2b00c3bf468f92c177208983d466", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416028, "uuid": "373d7ce5-626a-4617-a895-16102b081032", "value": "T1B2D4124422FCA762E1BA4BFE29B0105013B5B19F3B65E65F2EE912CE0C37B591712B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416028, "uuid": "85d66ded-7b41-4ba2-b098-701088829533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416028, "uuid": "00040eaa-6b66-48ce-9168-5baf6b731bf4", "value": "12288:nRv6OJPYtkPfNajPshzUTGbxFhXciY8U32DsYPD8ecUZfrtHbX:YONykPfvhzUW3zDsYPwmZTtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416028, "uuid": "9fc05d35-aa76-43f0-8f06-eaf33fc70c02", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416028, "uuid": "94b3a896-d2e6-4c3d-8bfb-ed158b125f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416028, "uuid": "e2f049a7-eee5-4712-ae09-9aef48971af0", "value": "SWIFT copy56650XXXX_0716NSMI0015024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4c4144-5049-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694398516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398516, "uuid": "d96fbcff-710b-46f6-9724-4ead20f37ebb", "comment": "Malware payload (Amadey)", "value": "c56aaf54e230879b50a7a64783148d10", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398516, "uuid": "4822b2a8-0f3a-459d-b5ba-40216b606784", "comment": "Malware payload (Amadey)", "value": "adae27992594d21e3d9b08969d6159068b82c8c1cda9c9cc9a2390dbec26a9da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398516, "uuid": "3f9fdbae-7028-4882-8f39-43b460147dca", "comment": "Malware payload (Amadey)", "value": "1d621db3c3d7cab49d53a1b3ab92eb77ac6f691c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694398516, "uuid": "1a3860e8-7ee6-418f-8a91-7ccad6d3effb", "comment": "Malware payload (Amadey)", "value": "6225b4875b4f2a5f7caa693c1d01a154e99f47d5b7b70c5a164b8aeb799f4d69b93d33d5edc2edba195ec200460a8d3b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398516, "uuid": "a628ed29-16a6-4e4c-8b77-2af528e6b16f", "value": "T174651244BBD09831EA736A3408E29E75097EB4501B51BFEF9F561FAF1F103C09A31A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398516, "uuid": "01a20b17-2484-40ea-8590-c994aca16f36", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398516, "uuid": "a3bd5c19-e6b0-4840-8a6f-4dd263522615", "value": "24576:OKqCJUGYE7nEfo+mUwLGdZwiPzOflkCqJg6ONU7sZhn25u1Hg:NqCJVR+mUw6V7Of+JDONU7sZtD1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694398516, "uuid": "dc3673d6-1cfa-40e2-9ef0-ee5ed31fc6ef", "value": 1469304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694398516, "uuid": "7b11b344-e120-4662-bf0a-0b9dc13e4bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694398516, "uuid": "5fc5d9d3-b80f-4c1f-8f6b-5b08e1d65e1f", "value": "c56aaf54e230879b50a7a64783148d10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ecf670-50a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694435949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435949, "uuid": "5b46c09c-e6c0-4c68-8110-15958b1f5556", "comment": "Malware payload (AgentTesla)", "value": "face43cb2d7f432bd24d30bb250f9ad2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435949, "uuid": "bb555cc9-0e89-40f9-82d5-2b70c6752bf2", "comment": "Malware payload (AgentTesla)", "value": "ae09550a447b87b7ce8cea331dd7b9884b9e420947afe802e14c47c887f5d9ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435949, "uuid": "bf01c054-6a17-4e84-b3ff-cca98e66337c", "comment": "Malware payload (AgentTesla)", "value": "1e416a9e89f1d67fa87635613e0b419fd2cf7e86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435949, "uuid": "50db9a35-f423-442d-9f6d-280b5d46ca00", "comment": "Malware payload (AgentTesla)", "value": "246999b81b9e3e84d00b56dfbb8c5a9accb9dfa3cce2070b02e9074ff4a4d4ff42389d727998078c71efc53dedf88ff4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435949, "uuid": "bd1d16aa-3c27-486c-96b7-bc5703ae7f99", "value": "T1A5C42313ED68C96FEB946815261298B3684966113AFF15FFF3164D1F800ED23887F86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435949, "uuid": "d19ed17e-a047-4c91-9f33-47350d6f234b", "value": "12288:wzuwtl/74+9UlWp8rSkUJ7b29CZERXYPp93fM3+zN:wXHs+dp8rZUJ7beqeAplVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694435949, "uuid": "425e539d-a002-4f21-b8fd-d948fda7dc37", "value": 558552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694435949, "uuid": "01f7b912-dd64-4b5a-aa3b-3a0a8daa60be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435949, "uuid": "2cc96fe4-4cf0-45ca-9e71-c7d87ff4be06", "value": "PURCHASE ORDER.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3986d2-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1694438751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438751, "uuid": "3f4bf827-e383-4311-b8e1-6adeb50b31b3", "comment": "Malware payload (DarkCloud)", "value": "a054b38a04dc80320fc4981b72c0ca52", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438751, "uuid": "37dee359-48a1-4802-bc12-a17c151d997e", "comment": "Malware payload (DarkCloud)", "value": "ae3e90aef418f7299c1ec1c976f6c9e5b09e831a1a28ca42f6259e1bd727533e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438751, "uuid": "e40db031-98a8-4ea0-989e-038bf493bf23", "comment": "Malware payload (DarkCloud)", "value": "8aa61ea32451120632cd3c3ff3c9e84c45208717", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438751, "uuid": "193e9f3c-4c0f-4dba-ae6b-7dd0c3a60065", "comment": "Malware payload (DarkCloud)", "value": "a9522bed647e5e9ce3e8ac8fb00c66bcd91166f57a42e6736324944ebc75835756c725e615c6ad2906bf740fa9ceda4d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438751, "uuid": "37224631-fab1-4add-8043-3b2c053e56ae", "value": "T136845B27EA20B02AF453C9F1A6A5E25B68656D361640EC1BF3819F4935366D3B0F133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438751, "uuid": "819c5219-55de-4298-b094-f4ee2bbb477d", "value": "bab3bd386c484be724df74a25048f623", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438751, "uuid": "e79c7621-a1fb-4cea-85c3-1905f8f12b81", "value": "6144:zqkBUUCf5aB8n+v9AAFd8T8HE0xpSDu+yeIZXuf8jp78d1/w5KA81IJ8GpF6nuTB:dUUCf+8n+v9AAF28kmR+yhXZlAjYKkJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438751, "uuid": "157ff332-21c9-44dc-b07a-0d0a09a0406d", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438751, "uuid": "6e7725a2-6d1c-43d6-9dba-9979f0014f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438751, "uuid": "72fd8e09-d8c6-497f-927d-88eff3cabc28", "value": "ae3e90aef418f7299c1ec1c976f6c9e5b09e831a1a28ca42f6259e1bd727533e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec8be7b-508d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694427994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427994, "uuid": "908266c1-318c-4c74-8403-16b5b4fc7988", "comment": "Malware payload (LummaStealer)", "value": "52bccae1b5f1aaaab79d01e5fe8add8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427994, "uuid": "12e6d2df-85d9-4a1e-a2a7-c7fc8527f2ca", "comment": "Malware payload (LummaStealer)", "value": "ae4309340330b3a02bbf43334313dce26f423708304cc4ede2449443f12991ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427994, "uuid": "f3cfc2f4-e49c-4c2b-ad8c-3af4b73ab75c", "comment": "Malware payload (LummaStealer)", "value": "9def24bcdeccafee120da8fa8a57321fb328a912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427994, "uuid": "6877e6e3-7c06-43ef-9256-b90219465e88", "comment": "Malware payload (LummaStealer)", "value": "ef81cf81a2e1d75869e790041e9bcea9bdd201643f6e8d060b120a9e1b1892e061173bf43323dc59332743afdbfdbf49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427994, "uuid": "f63925ba-2281-4bc8-9919-8a13e0c66e07", "value": "T1326623301D95A073D3FEC0391145820654386B69C358B9E326F09FAA4BBEBA787E375D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427994, "uuid": "9fab30b4-ac44-4cb4-8e52-e410e9fc0e2d", "value": "17b4ae29c535da5c4c677633219893b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427994, "uuid": "2ccaf169-9dfa-4648-8d82-c24f717ecc00", "value": "98304:KQDPyTspI5LQ/GxjZGUgMg35QO5H45V/QCULrZDNDvazYnjBnL6FGsClxt3sz:3hWf67Gq9xDvazYtL6alv3sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427994, "uuid": "b621c610-1d7d-40e6-b5f0-532df68c3a1b", "value": 6487448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427994, "uuid": "6b42eab3-dd98-4511-a938-3417694c5810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427994, "uuid": "c78c9888-0b45-4e90-b76b-d5583eabf6d6", "value": "wedding video ideas.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9153c9-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427128, "uuid": "39c23559-fc5b-4206-8a41-bf98a757b391", "comment": "Malware payload (AgentTesla)", "value": "2e26d0a1175dbd7ab97fe24be134af47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427128, "uuid": "4bd1e1c2-d2be-4b4d-a67a-0cfaa5a1770b", "comment": "Malware payload (AgentTesla)", "value": "afdf3bdf3bf5d4a264161b83f826d025abe07791c00738a96b5bc45ca668be8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427128, "uuid": "bf4d8a62-7300-4d96-af55-6c83c7190bb7", "comment": "Malware payload (AgentTesla)", "value": "4245d34eea5cd8e50cdb9691210bbc7806d6c151", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427128, "uuid": "796837bf-6afd-427a-9b19-8d012f8b4bfe", "comment": "Malware payload (AgentTesla)", "value": "bf02f3ea68c8dfcdfc26bad2151579b1d51aa1a49cc44be8ec5ec842ea539d75d6f993fbcdfadf746c05ae198b08bf21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427128, "uuid": "33799030-0e57-4c83-a36b-6e9b5c752a41", "value": "T179254EBDE210E8D1E03A0D1DEDD100AC926150F9DEBFD5532EBF638C2CA14566969FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427128, "uuid": "45fb7f1c-d61d-413a-ab00-44307df1d16e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427128, "uuid": "b1dcf400-0eec-45da-a23d-5e50356dbb59", "value": "12288:UTp6qWip6qWxRF2SERYUCN77CGx5RzLlZsMbZ7YTVAn:8p9Wip9Wx2SGYUA77CGLFLvZaVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427128, "uuid": "02536234-15ca-44a9-bb57-5bf658918f1e", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427128, "uuid": "5c0d8a9c-4325-48ab-a164-08a01d300825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427128, "uuid": "43d02ecf-939f-440a-8a44-f16e6b9ce8e3", "value": "GST INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418465cf-50b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694444132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444132, "uuid": "cf84fa44-26a4-49ec-beea-cb46d6cc3dcd", "comment": "Malware payload (Amadey)", "value": "78832a862fed3974ea7ab66298e5d7f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444132, "uuid": "8916db49-c47b-4a6d-901f-8d441787b349", "comment": "Malware payload (Amadey)", "value": "b195fcd8ae87ad764ca22c51b3d10978cedeb61796144c6c0f4711a7e211a7ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444132, "uuid": "a6b21aa5-5f3c-41a0-92f4-eeaa7537ce56", "comment": "Malware payload (Amadey)", "value": "51a688e6163b938ad41afebc23ab87cbe6fd7805", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444132, "uuid": "09adca69-b0d8-40bc-ae81-1b7596bca5bd", "comment": "Malware payload (Amadey)", "value": "2964cffe2b3707efc599d17e1f4ee7c471776cb909768d0e4ab3e36205f76422a6f2513e5a2f8c3c4251cad520dbab06", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444132, "uuid": "3c4ba1ce-c18e-4883-bbd0-685206068c5e", "value": "T112545CC29390B8A1D6664E31CE2AC6E4BE3EBD504F1967A7E3546B2F05BC3E1D172350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444132, "uuid": "1413f940-6949-4ac5-9676-fe797b224316", "value": "9510dea81cc5ce11a4de430720afcd42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444132, "uuid": "88070107-67dd-4656-bf5d-9e8b7e01d229", "value": "3072:nY86GQwdsoS4DwpWqboA+f5PtgejksAgwmm11O96m9G8QW5kG76FAeeOwedlfVR:h9OoxDw8qetgeu1usWeGArlH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694444132, "uuid": "a27dbdcb-6321-47df-99a5-93808c060255", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694444132, "uuid": "f4f1768b-c80f-4b94-9b54-fe680363cd8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444132, "uuid": "7dfd237a-2ddb-4eac-8ea9-e878d312a681", "value": "78832a862fed3974ea7ab66298e5d7f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e71e329-5094-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694430839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430839, "uuid": "5463baf7-d341-4a34-ab51-c32629bbcac3", "comment": "Malware payload", "value": "6dcb0e9bc08e161d44ca96165a618137", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430839, "uuid": "770375c7-1d9c-433d-ad54-1db4bb4142cb", "comment": "Malware payload", "value": "b26e9f7d049e9dec59ccaf0de220dd9f33c46fe1c4926069786a3fa234905e75", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430839, "uuid": "f76b1f29-a8b9-44ea-9873-9e8a7f0d284a", "comment": "Malware payload", "value": "81566a33fbfd2de1dc586c99f47af82cafa09bc6", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430839, "uuid": "5101580e-34b5-484e-9a8c-5db57e4dc3bf", "comment": "Malware payload", "value": "0629ebcd170df9a377e9446c963648965d5b36da5d2fe9b84d489452f7c01a03ea0f953a55f781bb11f07c9e4f8bab25", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430839, "uuid": "098b95f1-f609-4185-a3bd-16d9734ecbe5", "value": "T1D301B11A59DF3D64C2D3E7B4091440BD2227E72736220530BBC955F09B92C65D2A6FF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430839, "uuid": "3e2c9bc8-705b-4df1-acf2-eb0b6cf87562", "value": "12:IyKyVwqAuAy9MR3KsSItl5MMxv0XGl5Ci0W6WZ++gtF4xMyeWfagWLxH3lUKMYue:AqAs+VMieG3m8+NMxMfhlTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694430839, "uuid": "737f027d-d601-4dc1-9950-3bee029c656f", "value": 786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694430839, "uuid": "6d7a303d-9b7c-4e15-8163-f51938957295", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430839, "uuid": "ad490838-26e2-4e3e-98a8-01b76877fd1e", "value": "i4.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea81af7-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694423833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423833, "uuid": "890a9ed2-363c-4dc2-92a3-b9161035cafa", "comment": "Malware payload (Loki)", "value": "0d956f75cccf0ee406fe1ec380f5b83e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423833, "uuid": "24ecd93f-9164-4660-b5a5-1993679d2178", "comment": "Malware payload (Loki)", "value": "b319dc9242aed6684c36a2a4c4d3abf84bfdac400551cae2449bdf3bc412ce17", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423833, "uuid": "cfb025a0-25b6-4621-8670-25ba3c6850aa", "comment": "Malware payload (Loki)", "value": "b7467cb50b1a58693d93eee171de80d78a72697a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423833, "uuid": "d5bcfa1e-97a2-40c0-90f2-859fb34e86a0", "comment": "Malware payload (Loki)", "value": "9a29b30d3b4066dcc623c2e18edfb073ae8bbdbf20e620bab0f13c268a5636731854194bfb7f6338518a7ba4a4c03244", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423833, "uuid": "0e6d29b7-0a35-4f8a-8254-e13f2a8b9207", "value": "T1F85549DA6CCCBB82C70842B7EB02F5F9057BEE4D968524867071FA4A2D331591CF64B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423833, "uuid": "c5590eed-aab6-4f09-a28e-2f7e4e536b82", "value": "24576:1WQmmav30xSZyIw6Vz6NmGZyww6V16NMTvBStQ8TARdoFrnqw8t:0QmmQ30646V+Bw6VYNtrTXFrqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423833, "uuid": "d4d13ce8-f3ee-45c4-9232-a0eead074358", "value": 1295360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423833, "uuid": "b687dc8b-138e-4f49-a9ba-855518cfe123", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423833, "uuid": "8678bb70-2111-4f66-ad31-eb331f6830ab", "value": "64550135 INV, PL, SI, MBL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7affa3a-50a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694437109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437109, "uuid": "94f568b2-2dce-43d5-9992-2d8727f37085", "comment": "Malware payload (Formbook)", "value": "f27262f812ddefcf2893f87f551ab341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437109, "uuid": "eff3ea57-c34a-4c20-a23b-21492f025942", "comment": "Malware payload (Formbook)", "value": "b38b57a54529989adfedab2ef64d18b480154a208cb23d455de6c06668061a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437109, "uuid": "01de8002-f950-496d-a948-95f8bf4dd019", "comment": "Malware payload (Formbook)", "value": "edbb227deb1d93281cef758c08329bfc5aaa95a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437109, "uuid": "30f7ba18-e27c-463c-aec5-b10bd1c2515c", "comment": "Malware payload (Formbook)", "value": "b6cfaa14cd5733f2d69bcfd9146447d0e4093e12f1a3025a84c786338c2902353a94f68ae3df642837e00f4fcd7bcf00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437109, "uuid": "75434c1c-95a1-4fab-b93f-6d75ef79ae49", "value": "T15A7423526361C3FBD8B619F34C3E53AAE5FAD603006A93172BB057DEBC29201C51E7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437109, "uuid": "e849603f-5063-4229-b0d3-fedc4726822d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437109, "uuid": "8c9afd3a-2029-48f6-a287-86b44312cd4f", "value": "6144:/Ya6D0S574idIXeJwXAfKyENSiwDImn0pVMTEYk8VIkMp5YXNo:/Yh06rdx+YKnN8se086vYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437109, "uuid": "c764986c-3756-473d-962a-5ffe8dcd3502", "value": 367694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437109, "uuid": "2b161bba-b834-4f21-86e9-1d708f1ca831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437109, "uuid": "b2ff1e56-925e-4026-aa19-3524602a181d", "value": "IAENMAIL-A4-230529-0830-0000570.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5477d711-508c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694427413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427413, "uuid": "0cdb7b45-0709-4afc-ab0b-5f55ee19ef44", "comment": "Malware payload (Formbook)", "value": "bec4e29bad2bb7c98ca3be77a4abf840", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427413, "uuid": "6303de73-e3ba-4b06-9c53-a8d141bf62b4", "comment": "Malware payload (Formbook)", "value": "b403b77348036ba1247fc5600d17502be114f45ba68fc58dbd848a144170dfa8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427413, "uuid": "06ee6adc-b7ce-45ad-8a8a-f063724ad427", "comment": "Malware payload (Formbook)", "value": "3501e7b6c4b7a59ab5666043b9271938547e8c44", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427413, "uuid": "2828d227-fdf5-461f-95f6-481ae23bf5c5", "comment": "Malware payload (Formbook)", "value": "fe1db6026d4e597b66381297cf28468c16fca5de72381d869ae492f9df452ba805f0f18f3d62b3603234c7fdaf15abbf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427413, "uuid": "ad3ca585-6c7a-4675-97f3-8837d3aeddb2", "value": "T1F6B4333A70CCC7A513F1E6A1C67A02A27400305346C1977486FBAADDE97758BFD2E52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427413, "uuid": "27071294-773e-4c6c-98dd-c2a57e38537a", "value": "12288:BysmK82Gqioh395k03Jh0rOsod5qzBg7seHRZIM8qVG:ByQZioh39OoJh4Old5WBg7ss8qVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427413, "uuid": "230aa5b4-fbeb-4680-93b4-8ed71a70cf55", "value": 537025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427413, "uuid": "53c9b665-c95d-4dce-b4a7-a89821250ecc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427413, "uuid": "8c5350a3-dde0-4285-9540-fb39f6dc92f7", "value": "Purchase Samples-404995.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a542a5d8-50a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694437857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437857, "uuid": "6234cb8c-8fd6-4b5a-aec2-3e2c3afab2f7", "comment": "Malware payload (AgentTesla)", "value": "6254a45957b6307ad1693d4f3034ec11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437857, "uuid": "b315888d-77b8-4fde-b41b-d9a8195e3676", "comment": "Malware payload (AgentTesla)", "value": "b54d5c5ed52cbf718bedfc3c3406844a80b5893b679f5685df6807bc96cc97db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437857, "uuid": "01a39a7e-8e4c-433b-bf95-09b4d4aa752f", "comment": "Malware payload (AgentTesla)", "value": "bd30b100803fb184b496a882d7446ba9a234431f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437857, "uuid": "7f75d410-b153-48f1-826e-7bfdd84f8495", "comment": "Malware payload (AgentTesla)", "value": "f4ddffaea078e6bfa5bfdc4f203348e046fd90e1f87610ec9a29b0a4673fbed695389b5a5be173d01ba133d815d3be60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437857, "uuid": "606d4107-3c7e-49bf-a8c5-03b81219c9e3", "value": "T103253EBDE210E8D1E03A0E1DEDD100AC926150F9DEBFD5532EBF638C2CA14565969FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437857, "uuid": "de5a9622-5302-43aa-8d21-0864c38b901e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437857, "uuid": "0aa56a5d-b67f-4e0b-9683-538e938fbe6c", "value": "12288:xh5p6qWip6qWTohM2mMCvkgBXznVEWhWHVI9EPv/AOP7YTVAZV:Vp9Wip9WTohMpndDO2YV/PaV4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437857, "uuid": "ccc9dfe4-4f04-4b92-8237-29fb0e2b5233", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437857, "uuid": "1c7f0b76-b1a6-4eae-a29c-c7644292ced2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437857, "uuid": "e9288747-67ff-4e58-aaae-f72546923e63", "value": "September New Order,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c8705a-508f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694428699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428699, "uuid": "28c42f0e-cb68-4b35-8fbe-ab56cd8c4182", "comment": "Malware payload (Loki)", "value": "7ca3826b76be6c938e247327779d99c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428699, "uuid": "4d8a069c-b6ae-4beb-bdd7-9bc14bcc0c66", "comment": "Malware payload (Loki)", "value": "b56298b20e417285f7cb1be59968adade02d04b06166542cd7b6abb8bf4ef2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428699, "uuid": "a4fa988f-a4c3-4513-9aa9-58659de050ba", "comment": "Malware payload (Loki)", "value": "15913338e6547be0443d3500afa4b64667b3d0d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694428699, "uuid": "53c2c51a-674e-48be-a3ee-6e77ea550741", "comment": "Malware payload (Loki)", "value": "af3905cf7960a3f00c70233fcb3ab4a9255c8800957866f6475a0778ea9fce7e6ae71b2a192b1812ae2049c42e164caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428699, "uuid": "099b5f27-e590-44d9-8a6a-e18ef3999d2d", "value": "T1EBB4CEF9612AD3E6D3B413FF506795348A23BE6160B593CD377C36848EA5AC30922D72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428699, "uuid": "87c21493-417d-4428-b5d1-c4420b471ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428699, "uuid": "d1758057-2261-4c40-b1a0-edf42fee2a48", "value": "12288:Lw5fVsbR2CIv9K+E5xMB15+eu5wTtPkRKU8ICqQ1E2e4m:stO2X+MB15+ejPKKU8h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694428699, "uuid": "17373c1a-156f-49c4-81b9-7ae12bb9cc2a", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694428699, "uuid": "b150ea9f-2464-415a-bc88-3472617f804f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694428699, "uuid": "03a0ef07-d727-4e9e-abfe-4a864e449594", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88f124b-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694427125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427125, "uuid": "ab95b7c4-dc95-4684-ade2-3989d4823dfc", "comment": "Malware payload (Formbook)", "value": "10c06703c7dd670b6deecddf31927bb1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427125, "uuid": "a07e501d-1854-4283-8998-a54c0e408880", "comment": "Malware payload (Formbook)", "value": "b712c01de55ba9e76f171e4f0372758ee4fcd7092d4446958a479e1a788fc74b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427125, "uuid": "f06ae394-72c7-4c9a-8a77-ad4ca4920058", "comment": "Malware payload (Formbook)", "value": "07b16bdf9141c892c14a512c9d4f0e6419309cd3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427125, "uuid": "9048edf6-69b8-49e8-97fe-591aef92176d", "comment": "Malware payload (Formbook)", "value": "9e37df989ef237a35befd3c2a845a2abdc8bdc07e2472b4179c40f163e29ac3458312622e41effbe3e9aa5a37ea7d75f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427125, "uuid": "bf63869c-f9b1-4727-bfa5-2f8b89d02d10", "value": "T114942312A743BA5BBF70B7168B4E974535FE47E0603BA24C2F26DB1532C5110E64EF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427125, "uuid": "69762ff2-24e3-4323-bbdb-4325f590c3a6", "value": "12288:RHTcZokE+bKsDL6qzth+kwK+i4x3hyVIxAt6:RsbfnvX+i46In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427125, "uuid": "32e192f3-199d-408b-a971-99e19f0a6290", "value": 410864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427125, "uuid": "a8ff1844-db0d-4178-9d43-41d247fcc614", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427125, "uuid": "2cc862d0-aa2e-448e-b2a9-283596a29bd5", "value": "DANONE - demande de devis_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3867fa-5074-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694417197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417197, "uuid": "64fc824c-54f3-4f3f-9ba2-7541c24f8d8e", "comment": "Malware payload (AgentTesla)", "value": "2d9871a155f3a3fcd5612af69dbe7b81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417197, "uuid": "41d91a13-47b1-41c0-a6be-d3c62a5af0a3", "comment": "Malware payload (AgentTesla)", "value": "b848f864d15426bbb923cd36c954b86c6f159465f8ed21527757edeba7a415b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417197, "uuid": "5994c150-17a2-4a20-b452-45c23d0ce37a", "comment": "Malware payload (AgentTesla)", "value": "26505183e2c68b2b546d20d01689b411cace8ce3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417197, "uuid": "10a659cb-70d6-4e04-876f-18d507a0529a", "comment": "Malware payload (AgentTesla)", "value": "c13bb91299ddb5928e1d37e2f9adce43f7cab71929efd02b4670d4764173db03c6629cd823c5b22fe437639e02e9f6e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417197, "uuid": "3bf60c7d-5907-4565-b53b-5a841dd6e32d", "value": "T17EE4230383A4B4FE25ACF5568D0BC5F794A618DF3C1CA98127DAE0AD535D4342E7CEA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417197, "uuid": "8cf79f82-127c-4720-968a-e76092f580cc", "value": "12288:Kfpxx5GgYXVtjLsX/tjFB6xTU0s4/X5ZeM9VlNawCGkZ6oun7qxV4Mnf3rPof/9S:0pH5JYXrsBo40/A0LNj4Z6D7yNrPodGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417197, "uuid": "d40a0655-28a9-4741-ae31-247e768c64df", "value": 664654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417197, "uuid": "1ef3ee20-6747-4845-b961-00a860a2165b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417197, "uuid": "4c5b87eb-c663-44aa-936f-3affc9f86f46", "value": "Proforma Invoice..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55bed1a-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694423818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423818, "uuid": "2caebbce-3f33-42ef-b6cc-38b08f4de60b", "comment": "Malware payload (SnakeKeylogger)", "value": "44c4a29b37e87def6b16118e56ab73f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423818, "uuid": "911ec257-88d9-4619-bc42-1504340b16fc", "comment": "Malware payload (SnakeKeylogger)", "value": "b8a76e849d701bfa5c38f38601659af658b512c274866d5aa51173420b93d249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423818, "uuid": "eaeb6f4a-b0a8-4eda-9d34-16b962164a0f", "comment": "Malware payload (SnakeKeylogger)", "value": "9cadc5d7a5ffb0adf8b822bb3c714370fcfa5494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423818, "uuid": "07665f8b-5e78-4b2d-95f6-3849dbfcc2e8", "comment": "Malware payload (SnakeKeylogger)", "value": "e02c5761e607e3363128c6c64bf0bba56df811599c5df8287475e98b4c20f596cd1cdede65f163bab63dde1c04514593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423818, "uuid": "da56bdc3-7855-4226-9c9b-8aeee79fc5a1", "value": "T12FB42287B7C78670C74AABFE5EA152153FB45A46125CDF2E0FC82C9788617464838FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423818, "uuid": "295e1baa-636b-4fcb-8a6a-12174a309168", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423818, "uuid": "9d2e81c9-9608-46aa-ae00-821f714fbb77", "value": "12288:/2iNZ1DaUePf0fjYY8XP7hraPs4ecQtlfAWl9kXSCv:/1pDPenM2P7hraolIK9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423818, "uuid": "2d4c465a-83cd-4258-93cd-066070630a5c", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423818, "uuid": "302b7653-28e3-466d-a02c-b19349de673e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423818, "uuid": "45644fc2-371c-40c8-ac0e-107277f13246", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ce3426-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694445379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445379, "uuid": "562d3d03-ba09-4626-8398-797c7bde393c", "comment": "Malware payload", "value": "0b6d552a2112526089b08ef478a17109", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445379, "uuid": "f9f2be32-ca3f-4a53-94fb-1c50033e3291", "comment": "Malware payload", "value": "b966ba8c9a5e820e7e5b694e97330c517ff6ab944a4062ab12c55686a4c0930b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445379, "uuid": "272efcd4-8ee9-40f3-86c8-98fc35b5e5ca", "comment": "Malware payload", "value": "ce4970823850b4dde525492a07d0f4a0768680ca", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445379, "uuid": "b9ad38e5-3215-46e0-9757-4b67a400a8f6", "comment": "Malware payload", "value": "2c646b24e753b1c25bb7529c08f264820790e9e59850685b8e462cd6cc4b86f71cd96f440552cee6eb5c0bd4d3464d74", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445379, "uuid": "3c6a462e-81ee-41c6-b8bc-b1cb7b246de5", "value": "T12E43E16DC34F41A9CF129377AB1A4E4502BCBB2EB38552B2346C433933EA83D51656B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445379, "uuid": "1388c91c-8bb1-4fed-bb23-e6cad4ba982b", "value": "768:JwAbZSibMX9gRWj4ats2dmMS5lQ1bqgiH70BFj25ibsl:JwAlRD28agb0BFj2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445379, "uuid": "f678d0de-39e6-4566-aa99-abec4356b1f8", "value": 58351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445379, "uuid": "0202e4d9-3475-40e4-963f-705a2e1192cd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445379, "uuid": "ae845d4d-9b33-4d46-a9d2-62f8f060b2fd", "value": "0b6d552a2112526089b08ef478a17109.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642c8bd1-5085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694424433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424433, "uuid": "be36e214-e4e3-48fb-926e-c030e27e1459", "comment": "Malware payload (RemcosRAT)", "value": "12cd1835961c603957c2a740689664b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424433, "uuid": "e40e4142-0630-4629-944f-b20a0a1b896b", "comment": "Malware payload (RemcosRAT)", "value": "b96df82e2a9e14b2854a68e6645598e494aa818801a18384f2d81a2ff514824e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424433, "uuid": "903f1a3e-d74e-45a7-af47-4ab454be3f7f", "comment": "Malware payload (RemcosRAT)", "value": "fa1391981cf1d94e3b217a2d225ad4e988a54cf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424433, "uuid": "0afad706-8967-4b5b-90ed-2a31d5fa9362", "comment": "Malware payload (RemcosRAT)", "value": "2f29d86d0891b7ce0ff2e265f6e62666464af0289695a3c265a2166a669635635584bbeb5e70d6615a2635fbefac4fd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424433, "uuid": "4d657b20-e1c2-417e-bfc6-6377b6e20794", "value": "T152B49E01BAD2C072D97514300D36F776EABCBD212826497BB3D61D5BFE30190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424433, "uuid": "b5f97aae-f924-4f00-ab39-d831e972ea65", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424433, "uuid": "d5c98c58-81d8-498d-bb8d-65de56541972", "value": "6144:ku/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7jbv:ku7wNB5iedQ1RmPEVAWONjpcs/Zp3bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424433, "uuid": "7aaebba5-fd23-47f2-8a17-e4db2cd6f7d4", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424433, "uuid": "4a4076dc-0922-4644-a108-23ee1398255a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424433, "uuid": "aaf0f640-bb9a-43b5-b9ac-20ef0dda8f89", "value": "12cd1835961c603957c2a740689664b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7813c106-508d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694427903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427903, "uuid": "c4e6c7f8-b2e5-4015-8920-554a27c4a17c", "comment": "Malware payload (Loki)", "value": "ca86d6a82fe262e4677d13502a31f91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427903, "uuid": "4666366a-e283-451e-9d66-cad1c7044175", "comment": "Malware payload (Loki)", "value": "b9eccd20c288f890b67eb5a9c1229eab71c1dc60f5e3ea10598c0a2aa35a5afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427903, "uuid": "0b199074-9bf9-4fa8-8fa6-3f78ede538ed", "comment": "Malware payload (Loki)", "value": "00658e1dbf21efa9abf54bcfdc31fb5ad6ede269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427903, "uuid": "9d8bbe23-c4b5-4a3c-805a-bb487d562e36", "comment": "Malware payload (Loki)", "value": "33fba6b779f49e5755b19ec795387455184e9f1137ae094475618f7a4ea3c9cde466be4ae2c8d00d943e5c074fd18585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427903, "uuid": "74fff342-3656-4d69-8325-6d6e79ef8faf", "value": "T187C4AEF83111E3DEC766C7BF49575C7499137C62523A828A723F36888E9D9C78E118B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427903, "uuid": "59de2c66-1f10-4675-89a4-521893d56efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427903, "uuid": "91553886-824f-47e8-89a6-762f16fc1971", "value": "12288:A95fVsbR2c1v32GwOvIXkwSGqZaHRN/SBKblj9XvfFXI:A9tO2832GwOQBSGqZef6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427903, "uuid": "3cb19dc5-8be1-41aa-b8df-dbfe56340107", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427903, "uuid": "86c2680b-fed1-4aea-b558-fd6157265aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427903, "uuid": "fe5f8f35-e264-4d69-bfaa-6c176d9049f7", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9e030c-5061-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694409172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409172, "uuid": "d3bf0e04-4f57-46ac-a0e0-641754c00111", "comment": "Malware payload (RedLineStealer)", "value": "cc82d8b861a0f17892833fdee61e2ea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409172, "uuid": "b2b5c1e6-07c9-4fee-a25f-6bf74d3df9f2", "comment": "Malware payload (RedLineStealer)", "value": "bae02060e3de1b57a470310639fe0b5a5f9d114f02bed0c3da69f8e0473ca481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409172, "uuid": "9257d632-eb1b-4999-b7e6-e5770886ffb2", "comment": "Malware payload (RedLineStealer)", "value": "8858a2dd7adaafaec4f6f5c94a914cfdb311cb70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694409172, "uuid": "57ac8fc8-8846-497a-9999-fbaf0485a54b", "comment": "Malware payload (RedLineStealer)", "value": "3cfd5740a7abb35d0c2c19a6011eb63d6849c6a8c3ac03e81e0866f8549f3c7728bc425ebd50fed5744a4b5789d4eea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409172, "uuid": "5fafba2a-daaa-4daf-849a-4bc900d660ff", "value": "T1B9E523817B68BB0EE4A5EC3CCC5106ED9800ED9C6C2577833AD4BA6BB97751376C7680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409172, "uuid": "6d32eeba-31f5-45f4-a075-f29af2f28e88", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409172, "uuid": "4c72767f-f60c-48a3-9579-c90b5121a1b0", "value": "98304:0Nkxy8ass/0iQiQkaFOdtaGMtDVgkv+sPxOK:0NkxyveicFOdEVFv+Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694409172, "uuid": "d6a611b0-c534-4235-b929-7f42b6185274", "value": 3256832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694409172, "uuid": "756cc679-2701-4e0e-a6bc-bfd7f845f6d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694409172, "uuid": "ad4a4d34-62ba-4596-8279-370abc250534", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f670800-50ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694441202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "b58af1c3-91ea-4f42-81cf-246772c403f0", "comment": "Malware payload (AgentTesla)", "value": "aec27890a6baa1c9c73629ec0243b934", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "824421e7-a31e-4138-85a1-b84de8063877", "comment": "Malware payload (AgentTesla)", "value": "bdcd91e4266d9ecf799414b95f91a2b447dc2db8a1cc9aaf40ca68d94a7e0aea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "c457c1f4-18e5-4ffb-8acd-d64018801ff5", "comment": "Malware payload (AgentTesla)", "value": "464455576ad2a0c0a8f7446690955ef068454f80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "f90c2eff-b10f-42ae-a376-c182441e9fd3", "comment": "Malware payload (AgentTesla)", "value": "12e6eb8273588d97ea4f26cf3c0cf684e60785af76c72c1c71483926c9b545b75a0a0ec9a02c1f97a5b8dcd7d63acb78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441202, "uuid": "1a408397-3325-4757-951b-77d7b561b834", "value": "T15A0533B4C6F9663D39B3FCB9FCA3A430B99F8045314371A8C85F4758EB22219E41B466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441202, "uuid": "c3204a21-6b07-4531-85bd-2876375fba58", "value": "24576:296lcqqhaUHuVxfPxTV33JsHpPrYDiEgc6:N/oaUOVxpV3GRYD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694441202, "uuid": "4fb7e566-7efe-43cf-9b2f-05578bbc062f", "value": 823504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694441202, "uuid": "7bd91db1-db98-471d-ba40-36142c562075", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441202, "uuid": "ce351aa3-be9a-4160-8f6c-136d2251f316", "value": "Shipping Doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8145bf0-50f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694472329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472329, "uuid": "79d39254-76dd-49c7-bc27-87463ae3f711", "comment": "Malware payload (RedLineStealer)", "value": "655e4dbb19bce86c91c6a9dcc006a056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472329, "uuid": "83273e17-a3c1-4bf7-b334-81a75c7f7079", "comment": "Malware payload (RedLineStealer)", "value": "be0d143cba0eae01c30976430152c4c5b0fcb32c5afc43e599adb0c0c90cbfa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472329, "uuid": "ff17bbdb-a6af-4cee-9113-023028d3423a", "comment": "Malware payload (RedLineStealer)", "value": "3c566f647f7f1b10941ad323e29dc921afaee0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472329, "uuid": "9ebb66eb-3deb-443d-b104-cad6b2d4678a", "comment": "Malware payload (RedLineStealer)", "value": "8ea45be23e0e979a27cda2df687bca04efabde0971a709e53f76bc55ded1cf0a06a978004977e816e470fac8508f0e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472329, "uuid": "97b3b01c-6a2e-4774-875b-8b40f7cb8d06", "value": "T10E545D1393A17C64E52F4A729E2EC6F4761EBA608F5977AF22186A2F07B01F1C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472329, "uuid": "58a2c947-3957-45a9-8f39-ce61a0217585", "value": "fd6dfb11bfd672e911229df79ae69bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472329, "uuid": "e1902bb4-129e-4335-ba14-9a0ef38a6387", "value": "3072:OgHm8RkoYTpSO4RSvQX5U4wxOZYV1BD2NRHmXJun+qQJnJy2102MqF:zGboYTpJ4hU4P+1ENZMJBBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694472329, "uuid": "443ad6f0-1c65-47ee-9ab1-cabdf37986d4", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694472329, "uuid": "1d2eee45-1266-481c-af77-57106081923d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472329, "uuid": "95d0785f-cdc7-48ca-a95f-d79b5d17a6de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385ffa21-505b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694406321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406321, "uuid": "2d8e6ea1-fe69-4789-bb85-b4d3a32df884", "comment": "Malware payload (Amadey)", "value": "2f26035981c6ce81485ab1eabf2194a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406321, "uuid": "9b71b3c2-5dbb-4798-a64f-4a5a9de508a9", "comment": "Malware payload (Amadey)", "value": "be23ed0b351d0cf5b6cda8595d937cd69697cf3cfd8707748a8addb744b4dcb8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406321, "uuid": "9a6dca93-3125-4e92-86c7-5ee460e2f7aa", "comment": "Malware payload (Amadey)", "value": "a060f3b2979a531001c3883c1e19031bea5fe8ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694406321, "uuid": "0ce4a773-0802-4f43-9138-afcdaa60de25", "comment": "Malware payload (Amadey)", "value": "f5c75f414d0b8831f816358b759855b6be7dc94549bd2584ec206f0e09764c0f962e6d721152ee027bb3c5c828aa5b1e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406321, "uuid": "a34ce378-9200-48d2-a239-4f720fc94e0b", "value": "T1D3651254B4E1C472DB7204350BF0EABD493DB56EAB7149BBA3E04B680FA12C0D679736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406321, "uuid": "e221e5c9-2179-493b-9327-c7143068fbe9", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406321, "uuid": "1c48cb83-1b6b-4ba9-bedb-7997d1499619", "value": "24576:F91CJxCE5tG5nZL3sMcUw3ZmIsvUFC9DIu+42BOLY51GvMKcEM+WUHjVX362o9m9:b1CJxCE5tG5nZwj3c9QC9DZjxkKNjVHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694406321, "uuid": "a5cf42f3-d0cb-4b66-a37d-ec0b876fb417", "value": 1470840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694406321, "uuid": "6fb0d63c-46fa-4028-b82c-be5cc9b45d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694406321, "uuid": "bcd9e6e6-062d-4308-bee9-b28db0896a83", "value": "2f26035981c6ce81485ab1eabf2194a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4311935c-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694445423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445423, "uuid": "dce49e00-57af-45e2-bb76-9bf9496f7f17", "comment": "Malware payload (AgentTesla)", "value": "7c780d099c75d037bdd9082075a526ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445423, "uuid": "6fb2c884-b3eb-4177-8e24-679de25e3d0e", "comment": "Malware payload (AgentTesla)", "value": "be6c4e37f023ce184bec96fd9588fed31af835599ec5d1432a69e2c00401a6be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445423, "uuid": "50978d63-52ae-40d3-8cd3-ef20d46859c8", "comment": "Malware payload (AgentTesla)", "value": "abbcc76e8de5708937ecc5e32bb67bfa1f5447dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445423, "uuid": "cb03e074-2087-46f9-96e9-1ad67ea630ad", "comment": "Malware payload (AgentTesla)", "value": "00934fde2754ba99168702151044161acdf8aaa4ceceaa63e1c99eca9391288fa1c2aca5830c30dd0526623e854c1394", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445423, "uuid": "ffe2214f-32ca-4954-96c6-c75dfe6f346e", "value": "T18714D613B79B99B2C28B173BD6DB49000374D981A293DB4A3ACA13EA08C77F79D45747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445423, "uuid": "741b8e04-a770-4040-8fe0-393b97ee7764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445423, "uuid": "bb396788-aead-49b3-941a-a4c9ed03b52e", "value": "3072:Go1RjNs77l1EgwgRg/CWPi+TwHIcH+FCjUY1nl7xtsqDhelDrmklQr3kmI7SmfN:R1jsfDEglgaWPiboYVjUY1nl7xtsqDh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445423, "uuid": "77579ceb-2fad-438d-af13-1e4bdecd7b0f", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445423, "uuid": "75f9e331-1d7c-4f45-a90f-73e56bf33755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445423, "uuid": "1cdc1419-68cd-4964-abd2-0fd25e272e8c", "value": "G\u00f6nderilen \u00f6demeyi onaylay\u0131n-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18304904-5098-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694432466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432466, "uuid": "924e539e-4e39-4ecb-a013-4b16f7e80ae4", "comment": "Malware payload (Loki)", "value": "48b728dd7775291aa5dc2543d5854519", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432466, "uuid": "ed77688d-9b0d-4d92-8bde-d15ba3d4e0f4", "comment": "Malware payload (Loki)", "value": "c0f6fee53376461d4a7c5ec19062661fbe617d1569b518cb8a107db73bfade0f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432466, "uuid": "c536118e-0510-4acf-80ba-f5b97204c2bb", "comment": "Malware payload (Loki)", "value": "bc17c2651bffa8158df22659e69b5a96012a9977", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432466, "uuid": "9c8748fd-6547-4fd2-a0c8-ad973096f62c", "comment": "Malware payload (Loki)", "value": "ebf3e19cf63e1190d4e6b505da2f1c8d936e7f1fa9683d8b45f7c4042c6a2f18b628e6971c5c93bdf5d2410e89bd918e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432466, "uuid": "be772668-55ac-411a-bdea-70bf655d9d3d", "value": "T141A42386207F26EB42BDE46D1F38986AD9650E2B2AC0DDDDC9CD4F7239D9102438C5BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432466, "uuid": "38a8aede-7046-404d-82dd-04a1877cc91b", "value": "12288:Nlufsm1g2j+lfonOGz5x74q++kjISLJLqnTVLmt7w:3wbb+lfonOax7DDkjISUpg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694432466, "uuid": "a9550a5d-1192-4b20-816a-584562930bbd", "value": 462271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694432466, "uuid": "89de6b6d-276e-4d6c-bdf1-307a66d4cd1a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432466, "uuid": "84c581db-942d-4f82-add7-6caa52c92c9f", "value": "INENQ04220 for IT Equipment and Installation (Amended).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42155f8-50a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694439627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439627, "uuid": "06fd422f-6325-4d68-8fd0-77d96435d843", "comment": "Malware payload (RedLineStealer)", "value": "a58a3507a6d7707183747c1c83c505ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439627, "uuid": "8147a38b-544b-42f9-96a1-ea75fb80c142", "comment": "Malware payload (RedLineStealer)", "value": "c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439627, "uuid": "5d6fbc4f-f34c-409d-8113-5eeb09f5b1d9", "comment": "Malware payload (RedLineStealer)", "value": "954e649d66a79af88520f6c92d4d41b4c7af5b70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439627, "uuid": "ccadc9a7-b31c-40ba-8dea-890077a6a8c1", "comment": "Malware payload (RedLineStealer)", "value": "571df63c340b39c423f5e87708387cfae5e36c7de3009fff4459905f8f8d47e54a31db9278a9f258b2a537bc7c6c4e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439627, "uuid": "5cbc32c8-5f43-4807-9299-c5840d63febe", "value": "T13265120DB1A0C836C52711362D20D7F5D5BEB6280B6AA5DBA7910F7F8BF02C1D639E91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439627, "uuid": "dce17be3-f681-41d9-8426-5a1bfcebc1c9", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439627, "uuid": "4d6d7ff7-5942-4c50-9442-ba53bc786acc", "value": "24576:9uSiHnfg5Mz4wC/gmYC+f1HIIS9feDMyQuN10xGIFZdUZWL3FeXsM3vS1lvEBVeY:liHfDoIFCQHIIKWQaBIFZrVeXEv002kA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694439627, "uuid": "4293abeb-7684-49f8-bfc4-95486ce18e3e", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694439627, "uuid": "bdfdf415-fded-4b8b-a613-60ea6becb270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439627, "uuid": "a974ec94-f1dd-4131-88d9-cb7e0e1f065b", "value": "a58a3507a6d7707183747c1c83c505ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3831bd33-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401167, "uuid": "ce812cc1-fdf3-4a3c-a8b3-d6b57d30b433", "comment": "Malware payload (Mirai)", "value": "6fc416f60a48fd5f7a37c089a33259af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401167, "uuid": "19881478-7e59-4b64-9048-89426c0f7771", "comment": "Malware payload (Mirai)", "value": "c286be02c4a888d3f4ad40244bbe4c766e0336d29b070b6306d4328aa186937f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401167, "uuid": "e79265ee-6c37-49cc-b656-d49b6633bfce", "comment": "Malware payload (Mirai)", "value": "feadc9b5836949398e87e2d291b4e60c8ff65c5b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401167, "uuid": "50e2bd83-d695-4ef2-b080-4196e3dd6eff", "comment": "Malware payload (Mirai)", "value": "e92fc732427cbf75a8666d577a392bdd6c36ebddae3030c6c76865d09031b2101829d56c20706e9052bd8bfe14ed4272", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401167, "uuid": "703dcd53-7ae7-4756-8c43-1d76dd5fbecd", "value": "T189630956F8814B22C5D6027AF92E118E332357FCE3DEB2229D206B2077C696B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401167, "uuid": "cc2bab1a-bd4f-4a53-8f39-026d398c45cf", "value": "1536:tpnqh/sOR5YbAP+uppI46EBGaHA1zuInig8F2+lhyS5bYonX:K/9R5MEWaO8F2+lhySRBnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401167, "uuid": "8c7856cc-6d67-4691-b58b-56d12ec84376", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401167, "uuid": "d4638714-1bb4-4f7c-993a-7412cb2c8a7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401167, "uuid": "a4772fb7-2689-4af9-a6b1-97dd4806657b", "value": "m6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564474c3-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450180, "uuid": "e48bb0e5-8ee8-48c1-acc5-05d5f1e78654", "comment": "Malware payload (Mirai)", "value": "8b719fae500bb9f70304f87170ceca1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450180, "uuid": "7c8b71d1-adb9-475f-b9a4-1c2c8be297e8", "comment": "Malware payload (Mirai)", "value": "c2c24959f119b604b4351274d478eefaa5246ada554cf552508df4535f5af9a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450180, "uuid": "9934caf2-ef04-4c7a-a226-2469badcf16d", "comment": "Malware payload (Mirai)", "value": "09d8dcf556356154bcaab0954d738b88b8596b50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450180, "uuid": "10abdce1-9763-4ebd-8f5f-a68c1ea60ff1", "comment": "Malware payload (Mirai)", "value": "e5145f62612168c6c2cf19f55ccfee8e823044874ef969724d0602ba7ce8904644df72cc67355fc5240c954503200904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450180, "uuid": "f2f6a521-a458-4c76-9ea0-9cd3358a0dca", "value": "T112E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450180, "uuid": "cce12a0f-1334-422f-aaca-6cd7aef91cbd", "value": "3072:dgZc9h1jlnLA2PiXYeyCcZVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZZVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450180, "uuid": "b4fea98b-aa62-443d-affe-0f2987283442", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450180, "uuid": "10c8fbbf-abc8-4794-916d-99a6817d1026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450180, "uuid": "b0f92a32-8f04-4a6c-b8af-1c3f8e8f5a03", "value": "8b719fae500bb9f70304f87170ceca1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3288ed14-5081-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694422632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422632, "uuid": "7350d4c1-85af-4792-aa8e-3ec11ca24229", "comment": "Malware payload (Loki)", "value": "509456326e4f7f58a12748209e89f0b8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422632, "uuid": "2525d057-8286-4596-92a6-2a9d21423673", "comment": "Malware payload (Loki)", "value": "c38ca4010f11e73c6438d36f808f612173e168a57ac289a92633b608a20590c5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422632, "uuid": "96b78f65-bc92-4a63-80ad-5e1219d99694", "comment": "Malware payload (Loki)", "value": "3c0715985ad9859af8abed82e690e8c2d5ab9a1a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422632, "uuid": "cce22f23-06c1-4b12-83e9-c2a84371bbb0", "comment": "Malware payload (Loki)", "value": "f586ca1721e755749b41676a7f80e0e87e16f8349c8f76645713805570b5a43e63bc97b7845f08712e2bed0db7b65632", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422632, "uuid": "6f08e60d-d8cc-4b71-81f3-5a1d02e84403", "value": "T1359423A2F96D260CA3E88634BA4A17D5CF37B41B23CF97EB977430956C02D8E53A7105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422632, "uuid": "dd7ed0b1-b0d5-490d-88b0-24bc2cdc13c4", "value": "12288:fDe8BllH1cSKcNrWwqIzsYSgVA9gs+eVcPDZsc8vT:rPBFjKcNjqkv5OKb6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694422632, "uuid": "12f80433-bbb3-43a8-9822-6a741e566709", "value": 440290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694422632, "uuid": "204c5008-29db-4027-88bc-5b0f14d8969f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422632, "uuid": "4358aea4-9875-4645-a276-78c89338c933", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061eaaf8-5042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694395499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395499, "uuid": "42221afa-3e03-4c31-a5ff-3044975b5fa3", "comment": "Malware payload (Mirai)", "value": "0d1315bec7e308de44fa308086e1b3d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395499, "uuid": "efc0df23-1088-4082-84b9-861366e82122", "comment": "Malware payload (Mirai)", "value": "c4d0759f028be6bde0a97127109c9c7f9c01d503b3cd34229fb9d01a826b1c5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395499, "uuid": "1bb1efd3-00e1-495f-8587-484ec4d5749c", "comment": "Malware payload (Mirai)", "value": "88cd96b8847c4557dec7901a042c53d642d52c6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694395499, "uuid": "b6720626-2029-4c8f-98fb-59359bf3e9af", "comment": "Malware payload (Mirai)", "value": "26f3d634017176f1edc0093188bfe11d034bde0301981d4ef915f5adb2346b26ab5d2c8eeef810be2b39b0d8accdfc90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395499, "uuid": "7c310530-f10a-4af0-bc85-e1dcf2bf03fb", "value": "T1FCD3291775D1D4FDC8E9D5B44F9AA13AEA72B02C1238B16B27C4AE272E4EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395499, "uuid": "260b7045-3685-4ee8-8c30-3160db4f039a", "value": "3072:PntXRN16wQ4MyuaogvXpmQ3xzJMAbl4d:PntXtjXZ9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694395499, "uuid": "2d64f24c-95e2-4b6e-8956-9ac043c94527", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694395499, "uuid": "2a49739f-985c-4f3a-a95d-5f9a0a3ecf06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694395499, "uuid": "7903c525-6b00-43c2-b409-d6dcaaa6f644", "value": "cundi.x86_64-20230911-0124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e7936d-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694450374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450374, "uuid": "dc9eda89-7cfb-482e-b18b-43efa431aafb", "comment": "Malware payload", "value": "93361e403b633b251aaf21f7699a1e57", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450374, "uuid": "829a9450-39bd-4a71-a72b-dfc3002f7459", "comment": "Malware payload", "value": "c4dbda41c726af9ba3d9224f2e38fc433d2b60f4a23512437adeae8ef8986c57", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450374, "uuid": "530fa158-330b-4fbd-8111-5c735add0e96", "comment": "Malware payload", "value": "2f3eda9d788a35f4c467b63860e73c3b010529cc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450374, "uuid": "d33736c4-5042-4e62-b651-fed1cc6b1127", "comment": "Malware payload", "value": "78e014f153eaaacd2294ce82321a9b9abe805578710f6ef41cf9441581fa301e1a0f6ebd8c3152ecac0422a0d1ae507b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450374, "uuid": "1acfd07a-51ab-4c13-a799-932917712c10", "value": "T17CC48D327971C032D16292F04E6CA76514BDB9700B3685EFB3D85A2E6EB15C17B32A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450374, "uuid": "17035f35-032c-42b1-8d65-98975cc43503", "value": "204cdab7e7427039100122feacaa964d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450374, "uuid": "37197bf0-9a23-4ed1-9e11-742d76676b71", "value": "12288:gjnnGixPlhYMXn6EdOgsvmlNn0R05tE5w5MzFHaMEHdw0hMKsLbPugzfjuGOVw:gjWI6SOslNn0rh6MYdw0yuCfyGmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450374, "uuid": "0fa328e2-3892-4ada-8dbe-fb9d473ecbf6", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450374, "uuid": "d61506fc-4b3a-4562-ad70-a22d5f0f0a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450374, "uuid": "b1da7630-587d-4764-b3c2-a9608624e1d8", "value": "93361e403b633b251aaf21f7699a1e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c34a46-5087-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694425154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425154, "uuid": "c0150437-fc39-4fc4-bebc-71a01319bdfd", "comment": "Malware payload (AgentTesla)", "value": "84a1afc92c5de5f740c1ce529938d51f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425154, "uuid": "1edff8c1-41e4-47a3-80e3-34e20f74418f", "comment": "Malware payload (AgentTesla)", "value": "c58c29838ea80655ce6ec3b4041693c62b5f20940a2fd97ede5cd326ff76eb75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425154, "uuid": "3ac30f1a-3def-46ff-b82e-936387f77b3b", "comment": "Malware payload (AgentTesla)", "value": "1dff95022de44b3c3e3da812f45b0db22980dcfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694425154, "uuid": "cfde61bc-8036-4797-be75-50ada6fffe81", "comment": "Malware payload (AgentTesla)", "value": "8bf73c56ceb2df56cf670f404efd53cb47bcd3955fb2958a846793aef273d99df4b52ecf027e52d6f254843cf0e2ac4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425154, "uuid": "e2196151-582b-4aef-84d2-f8b528a75c49", "value": "T1C6D41201337E8736D65DCBFCE556191613FAB12E8205FF0D9FC6B0F62622B854188AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425154, "uuid": "a1060e7c-376b-4d21-a874-7ff4ad640579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425154, "uuid": "cdd04aa7-77ba-491f-8f77-ef67219e92e5", "value": "12288:ue1DjkWWS0Pfn9auGHwOaBXsPeDvGF6gVo8CeDBPneoHIHfHqKJHTfi2/JuGro0i:uqDYWWSQVCWTa6gW8CKPRHIyqHTfi2BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694425154, "uuid": "47e6d1a2-83be-4f03-8455-da03fbfe95ca", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694425154, "uuid": "48293d7e-5678-4832-9663-569dbbfcfc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694425154, "uuid": "fbcbf591-72cb-477b-9ace-72fd3af4f9a3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17382.4750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd727646-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694423831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423831, "uuid": "56b6b7ed-3f9d-4700-b58f-ec2a4523f64f", "comment": "Malware payload (Loki)", "value": "f47e83421de7278b9e69b9ee4109b46d", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423831, "uuid": "de35eea5-7859-4dd5-a37e-efe159c80668", "comment": "Malware payload (Loki)", "value": "c5d3de05ae979f172612527eb099472aa182fff015ab59ea89c07d45f458ee90", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423831, "uuid": "9d912a4d-e86c-4504-98a4-3aa5c23af2a7", "comment": "Malware payload (Loki)", "value": "33604e090aedfb8b5f25d674e6e129bb0a617cdb", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423831, "uuid": "52d3661e-eeb5-4f55-a1f6-1ba5187d4376", "comment": "Malware payload (Loki)", "value": "857f136476f91faf718b86b762e8c45f648789cef29248574a89c1b04081f7bec6b2fe47970b4f86f1913348d08e240c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423831, "uuid": "f672500b-af0d-4a14-8e8b-f81d5abc3f5f", "value": "T10104C046BA81C856D54CDB364CE2C6BA7A75FCA25E2A870733447F6F2E702D0CA1750B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423831, "uuid": "6f9aca4d-d8fa-4d59-97ae-7dec9a78bc05", "value": "3072:NPxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAUbYNubjjVloqdLq7ngCOn9TinfIZ+tI:9xEtjPOtioVjDGUU1qfDlavx+W2QnAUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423831, "uuid": "787ef881-100a-42b0-a584-0d479de929b0", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423831, "uuid": "634b9567-6016-4b31-80e9-f202cc2f19a6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423831, "uuid": "62eda853-4319-4ae6-a527-2639f68f0086", "value": "Siparis_Listesi.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ebb68e-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450199, "uuid": "433b93f0-b055-4de1-8f59-1713ef30e1ff", "comment": "Malware payload (Mirai)", "value": "88e53f212ab5c2c6bef15907a8bf919a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450199, "uuid": "d3858720-0658-4b32-8335-f126e8b81f36", "comment": "Malware payload (Mirai)", "value": "c745de9034489b176a78a4ede185e57d74c219d12b8cfb5e3f84c70ca045364e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450199, "uuid": "9cfad27e-81ad-4a18-a1a8-39484a30fa4f", "comment": "Malware payload (Mirai)", "value": "161cbd2eafc13d38b9819dcdc9c53a6fe6ce724f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450199, "uuid": "156efbc1-f966-46c7-aeeb-28bd0eeea512", "comment": "Malware payload (Mirai)", "value": "2db198c8674ab2a687fd9e803b7069d6c392ace868f8cee1d5830a76adaaafe5c6f36fe7ae33a9c542de09e50c831e48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450199, "uuid": "29552cd0-233d-485d-a73c-a44ad6208530", "value": "T123B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450199, "uuid": "7b3d7814-c100-49db-ae96-f3a299063723", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZooamm/QcuLB1niDNb:YuFX0GIk1MHyphxamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450199, "uuid": "8bc4d1f3-f39a-4bae-a707-5a0f801686a5", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450199, "uuid": "ab8048c0-e00c-4208-91b8-dcd26aa7091f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450199, "uuid": "f3ddfc8e-ce6a-4d38-947f-040ab9cd3e71", "value": "88e53f212ab5c2c6bef15907a8bf919a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901d6f8b-5092-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694430090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430090, "uuid": "b31383f7-0a97-441a-97a6-9f37b413ecef", "comment": "Malware payload (AgentTesla)", "value": "cb1672efed94a51147efbc4586d98b1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430090, "uuid": "7f87997b-e2f1-4584-810e-38da236bdf8a", "comment": "Malware payload (AgentTesla)", "value": "c7de60f7c221c6c5cfcf441c5501de5b1006cbea58a07b8f009b230236de406e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430090, "uuid": "56e797f9-3098-47f0-8730-d8d01b01eeaa", "comment": "Malware payload (AgentTesla)", "value": "9ecb2031b69741916bfc31adb5940c112ec54c6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694430090, "uuid": "79506437-4326-472b-b878-cd9b4b72bce8", "comment": "Malware payload (AgentTesla)", "value": "f9e79d10718ba94d1edcee2789d355ce84cfeda56728874e328b808e8119ff0686baaf2e5fe1093040a4aa8ea7fd9bc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430090, "uuid": "cc8c6f8c-edcd-454f-a0d0-fd02f3c49113", "value": "T165661930D35195E4D1ABC430CE9A4FF465E2743B81365E0F1A84DD1A2DFAE609FAD2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430090, "uuid": "08f7d745-bf14-431b-9990-4224a710813f", "value": "7bdb343cd21cb591ba504d8130502f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430090, "uuid": "180c765f-6b93-4929-be48-3081a9fdba54", "value": "49152:Pcb5mSpez+Sf+52jF8cQYh99idPtS2y0VZvt3LDqKIhAWl59TGIrgrNDq8ngFf8L:P63lY+tbv9+Qedni52zVwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694430090, "uuid": "cd1f37a9-1c25-4a50-b54c-550159f748a7", "value": 6605824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694430090, "uuid": "eeac37f2-7c40-44fd-8a57-156dd265a300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694430090, "uuid": "44da99b6-79e7-4662-adc6-1feecdb24968", "value": "Transfer advice Copy #ETT2104944098 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d56339-508a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694426723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426723, "uuid": "c38026a0-bafc-4b00-9a03-abe00e2f42f8", "comment": "Malware payload (RedLineStealer)", "value": "7c9a817e63843b6f41e203cd3cf7f47a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426723, "uuid": "ae85a3a9-0c34-433f-81ea-00a46c6af354", "comment": "Malware payload (RedLineStealer)", "value": "c891e3032f2179def6000a036ad4641829efe55670408110ac1d2683e8b17273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426723, "uuid": "e1dcff1a-a1dd-48a4-8bec-d0630729b9f2", "comment": "Malware payload (RedLineStealer)", "value": "46d0dae4d90a73aa9d3549d377eed4ee158a9558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426723, "uuid": "6154ede0-8e8e-4fa6-a0a3-195959db13b9", "comment": "Malware payload (RedLineStealer)", "value": "1959c79ec9a5c24441ed99cad26918881b7a5ef1afa55bda260a5fbab6debc315dd850c10b5f82f6dd4f06d8f2128bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426723, "uuid": "1712e655-54d4-40ce-bb71-6a5b92697e63", "value": "T15D65121478909E31D936183608F1FAB44EBEB8701B297AFB63954F2F1B606C19B3B517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426723, "uuid": "f591c475-cc92-466e-836e-49141c76849a", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426723, "uuid": "39cdd8e2-3ea2-47a1-98b0-cfb47876df2c", "value": "24576:poeCJ4evdU0MvbTT+GTD7Oqrr7AgDN1JvFjfDxWNb2EPB/eDzBxnPFuSvOR232vS:SeCJ4Ud/8Pd/7/8gDnHjDxgb9QDzBBw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694426723, "uuid": "eb6469cf-eec9-44f3-9f2c-22feca335293", "value": 1542008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694426723, "uuid": "ed1673f8-f1b5-442d-8596-9fe21119e1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426723, "uuid": "a36d0d68-76ef-4c86-be2e-43c06d24dada", "value": "7c9a817e63843b6f41e203cd3cf7f47a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc64580-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694424714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424714, "uuid": "bf983abd-e51c-4038-99ff-0d7c27ccc9a6", "comment": "Malware payload", "value": "f889004a88b3eee046b395c6d3613200", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424714, "uuid": "84ba4575-05a2-4a69-b20b-7788672382bc", "comment": "Malware payload", "value": "c97487000f1706dcecc7bffce85d9016b5f77aa1fd5b92e22e4ecde622ca8b88", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424714, "uuid": "aa364bad-ceb3-4719-9f22-bb9190b6b61a", "comment": "Malware payload", "value": "10056871661de49cb50c3e0d7ebd601e0b4ba964", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424714, "uuid": "0be73834-f451-42d2-b4ef-a6d706313427", "comment": "Malware payload", "value": "4d698a2b11149821833622fc8e1247310ad106522bc075726e2327986e157407587abd3016cd1a1b883311e1d9bf17bb", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424714, "uuid": "bca43ba7-c328-4941-afe9-3d6581c820b4", "value": "T10CE0689AE1C0AE316D604666BCEF9E94F32D94D80372E00A8D6280263732E3D03639CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424714, "uuid": "67ba5f28-d129-4256-8f02-45de06af66db", "value": "12:Ap9djimY+2KGRkT7YEFBye9qy0ZduNc3F:Q9CUTkKw9ZsW3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424714, "uuid": "e30c7ad6-85ec-4798-9b29-685e0567309e", "value": 387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424714, "uuid": "698f26ac-e1cd-4068-9520-32892b303116", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424714, "uuid": "0c803f65-c449-47a0-8d99-92a476bbee35", "value": "E-mail-Details.82508069.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd1f55e-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694416235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416235, "uuid": "f1bb0169-9f16-4bcd-b37a-4b2532cd4c37", "comment": "Malware payload (AgentTesla)", "value": "c57836fd5f5353eb2c7a63bc839159fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416235, "uuid": "b147c228-1bc1-4518-a67a-3d1f889bb11e", "comment": "Malware payload (AgentTesla)", "value": "ca815e6202518ecaa612223595ec6f954159ecfc7c1908a092c561a51bd933ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416235, "uuid": "2ab69326-7a12-47c5-b416-cfcbe1124c20", "comment": "Malware payload (AgentTesla)", "value": "f590a20a4317ee949417e1c315df8753013ab4a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416235, "uuid": "efcb10b7-21c4-468b-b4d5-847f956afd4b", "comment": "Malware payload (AgentTesla)", "value": "079ef3bf287df09349915cbcb31ea4202301491c81d1a19e927e07459c3d1a6265911025a77f65a6399c7caeddfbf9ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416235, "uuid": "7b1cc979-96b9-4f35-b599-27909e571e2c", "value": "T158C4F13473886B5BE67D4B354B12280412F4E8456633EA5E3FFA20C95E96B84CFB1B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416235, "uuid": "d9bc0cc8-9900-4a4f-8e3a-adb357e9cb66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416235, "uuid": "2e38b462-0c4e-4efd-a40b-43d6e7111eca", "value": "12288:1eBSzZPaQ//nhhu12d3oepAgunmIEjCba/eLhftK4qOQ:D9iQ/vh41yxAJmIE+bawtwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416235, "uuid": "fe1542f0-5662-4c01-987c-1e8cd648a5a1", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416235, "uuid": "a6cfaac6-7c3f-4700-8421-3b3b6bcd52dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416235, "uuid": "236eaa26-6d55-40b4-9480-5f3db29fcc29", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f56751-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694416495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416495, "uuid": "8e8f3bb0-6533-42cc-9235-9f329ab9bc59", "comment": "Malware payload (Loki)", "value": "a3a6aec3a94fe465aeae3a76728b3a65", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416495, "uuid": "3802741c-6b73-478f-9f83-b0184e1af5f7", "comment": "Malware payload (Loki)", "value": "cb399925b044b2c7271b905089943c08c05cb7e78d318e1203f36605250c5c72", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416495, "uuid": "3168591f-9d78-4467-b52d-6cd470d036aa", "comment": "Malware payload (Loki)", "value": "f44cfc40e915ee7053dfb686987f8c63c42690b7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416495, "uuid": "482d377c-e1da-45f4-90e7-dc824c10c4c5", "comment": "Malware payload (Loki)", "value": "bee3ca7bbd9456258f6dcd8ff4292f926a3e7613db1d970e1ea86b47ac98bcc11ae35cd3b93bc55068a2ce853e1a72da", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416495, "uuid": "2d0d87e4-c621-4587-96b6-888966025761", "value": "T105C423D013E16B0E4A8F4A7DB29F9D16155A387235F446A04291C16EC247B18FF3E7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416495, "uuid": "a148e6d7-34ce-4310-9486-e57117ee8ae9", "value": "12288:zz5JNiukIb9/O5VSEVShYhAb6Cs1+ODAQzNjaxVwtxe3QuOS:zzfcXtaYhrCb4xY2xe3QRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416495, "uuid": "82b68d18-23c8-499c-b580-ce6bc9b47bd9", "value": 570900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416495, "uuid": "629bbed2-b8df-4f99-b3e1-f11a5fa1d1b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416495, "uuid": "d60bd0d9-9d11-4487-83f0-441422755372", "value": "Order Confirmation 004172019Sep order_00417.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1254be-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694424154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424154, "uuid": "31208f12-63e3-4b3e-a5bc-ec3f1a460595", "comment": "Malware payload (AZORult)", "value": "b45731b4c9e6ed16a8d8939f300ac484", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424154, "uuid": "ba2cfb5b-f224-42d1-8a69-2adc5e16519c", "comment": "Malware payload (AZORult)", "value": "cdec4792d77b336fc7e1094af730dafaccb4fb4e0b954cbaa9e4802b8cfc0edb", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424154, "uuid": "ccb4a68c-5f5b-40e8-abe9-535a0e4db5fb", "comment": "Malware payload (AZORult)", "value": "6b5fe936b4f18102b91d876bc41e8d4ab73498cb", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424154, "uuid": "eab67f3d-6019-4a7e-ae5e-245d0b5fadbc", "comment": "Malware payload (AZORult)", "value": "6f3e7a76708aabe642468233fde1564486a7b655d8df22fa7ccbf9fc98a5bcb05ddd3b9e367bd8436204c4d57f3f8cdf", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424154, "uuid": "b3f46f34-ed0f-4a1c-95aa-b0f80a35843a", "value": "T111D47D53B764CCBBF4A719B66E4FC06024B12D5D81E9960D62AEB71991F330250FFB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424154, "uuid": "02cc9cb3-1f05-4f02-ae8c-5b1dc085cfcf", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424154, "uuid": "e2d38c37-450c-4987-86db-71e0c0d1a73c", "value": "6144:SgORa6xKTuuuqjL7IMLeSjKlJICEQubqPyLtOW4u+L7lChzkKoetcKPkHGTTXooA:Sgm/SWrICTpyLtzMTnet2mPXoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424154, "uuid": "b3e11d5b-7173-4450-ac4d-9bb85ab2f2ff", "value": 611760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424154, "uuid": "c637be7a-cc32-4c96-91a4-a86e3c299773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424154, "uuid": "3e1dc030-edcd-472e-8426-857620e97c81", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2766bdd-5055-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694403922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403922, "uuid": "39ffad6c-885d-4da2-9f61-cd1693fa2cfd", "comment": "Malware payload (RedLineStealer)", "value": "6739c93c900e7f21f4b36cb25bb3e43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403922, "uuid": "f04e7fd9-ee0b-40f1-9567-6e03e87bd7c5", "comment": "Malware payload (RedLineStealer)", "value": "cdf404176827e3b57fb0f78291490b568d35bc200f3ea1cd66595420ef3253d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403922, "uuid": "399edff9-2ec2-44b2-aa55-53d481198b2c", "comment": "Malware payload (RedLineStealer)", "value": "b6894e5118e71a2654cac290479d8e9389350a9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694403922, "uuid": "26e788ef-d996-446b-956e-e51a76bc21d7", "comment": "Malware payload (RedLineStealer)", "value": "e05be77602b35c5fc5f157174f094863788f8a6a6b2016f45ee6b639aff7e44fe210f2fddc09a3a6f1116b5f1189f774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403922, "uuid": "ee2ecac6-8139-43d6-a2a5-fe900f4707fe", "value": "T14C65230C71F78473DC72043259A0EBB65A3E78210B3346EB53B91A9D5F246A0BB77639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403922, "uuid": "4e11e58e-9978-43ee-a050-382a40d35c58", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403922, "uuid": "c11e9757-508c-4747-9e28-5277bcccc0fb", "value": "24576:/XJCJc6PbT6201rAS8n0zwWOKE3C61SZZy3KDVYYcLgx/d3P3tXP0s3jDcqxAPJw:vJCJcobTh01rD8e03C61SZQ3KDxccx/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694403922, "uuid": "2292830d-53e9-4f32-863d-dea667c8c1e8", "value": 1471864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694403922, "uuid": "9dc3ee59-3ef2-4e72-9bf1-4b6aac108ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694403922, "uuid": "c664c449-19b0-4dc4-8cc7-2105fc1860bf", "value": "6739c93c900e7f21f4b36cb25bb3e43b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df7f4a4-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694423430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423430, "uuid": "a164f895-f29a-4fbf-a773-97e052189101", "comment": "Malware payload (Loki)", "value": "69a09092311de18b2e02203a4315f281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423430, "uuid": "2c16d7fd-7364-47fa-9737-b1b4573cccb9", "comment": "Malware payload (Loki)", "value": "ced38ca893b62cb4367f5c8e62c5caadb1e887b8d913ee6e4b84e65c60283602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423430, "uuid": "7d2f1ffd-5052-483b-8c3c-5ae18c7901eb", "comment": "Malware payload (Loki)", "value": "0e77a5f374dcb4ff1eb35d010f2aec06e54f9b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423430, "uuid": "2f0eb84c-460a-47f9-b2a9-161c0c6d2662", "comment": "Malware payload (Loki)", "value": "60d3b92a311cb8924509cf2c98d15ad1c8948d3949d69fd3afe50be20a1f3fa60aa1d1baf90e85a0851aca627dd37352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423430, "uuid": "568fad88-dce0-4ab5-a886-6a8d104b069e", "value": "T13484BE9D726072DFC867D4729EA82C68FA5079BB831F4113A06719EDEA0D897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423430, "uuid": "ab95501a-cf57-4b4a-9c70-d149c96c0cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423430, "uuid": "48149622-bd28-44ba-8c76-d9777acc49a6", "value": "6144:tNHRNcu1R3GOYXBVqq1Z09OcGKO4CMrYTZmkTHAtUgBIxXlIXiKdwVJq1aZ5+I:tNHY0VJYmNlCL5LAtUl0iKdwVJq1aZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423430, "uuid": "87334329-5351-4eff-9e68-7806273feeae", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423430, "uuid": "412e4732-58a8-46c9-9ca7-15f4cf4533f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423430, "uuid": "5ddf8254-ea56-4c04-bfbc-ea1752d880b4", "value": "69a09092311de18b2e02203a4315f281.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ca9c46-5073-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694416562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416562, "uuid": "221e1ac2-c91a-43da-9f49-6eb2f5061a91", "comment": "Malware payload", "value": "04fbd87846c302989c6c8057136e0577", "object_relation": "md5", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416562, "uuid": "9fbfec00-4634-4d7a-8fb2-d5f72219f1a6", "comment": "Malware payload", "value": "cf26975c853294d18539147159b303dbdff25678469a6186ada08a8ef5378408", "object_relation": "sha256", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416562, "uuid": "b5a31902-16fc-46bd-b184-2dfd95f70177", "comment": "Malware payload", "value": "044349617571cc9f2b83e9bf20afc2b42f774852", "object_relation": "sha1", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416562, "uuid": "b62830de-be57-4d66-a602-eb00ad23f563", "comment": "Malware payload", "value": "fecf00c5fed26720dff8109022ae4d85e54065115c79763b99105a658e88b63dc2d53bcdcc42b8b977bec04362b10590", "object_relation": "sha3-384", "Tag": [ { "name": "91-213-50-74", "colour": "#C84498", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416562, "uuid": "fb07a473-d89c-4264-9767-c6d9ac395cdd", "value": "T12364D7F6521F6A4F85160E15E1081211DCACE867E3EF96F4DF0D4AB249B61684CECFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416562, "uuid": "1f4b21ea-ddfa-4b7a-829b-6d95dce37a8c", "value": "6144:fUDMcVbU170wROT6Jx9PE39RHGxslRAidW/qHNFSVLUohUli9MhV6+1ft7:CMcVbA70kx9Pe9e/qHyVLUo+li9G6+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416562, "uuid": "943da22e-a410-40e7-b50f-a8bdbb9687f9", "value": 333144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416562, "uuid": "b53aa3af-ebf6-4813-9248-adc45f3100a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416562, "uuid": "b6908cdf-3806-42ea-92bc-9d53355b08f1", "value": "PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b04c10-5085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424385, "uuid": "92b9427e-195a-44ec-82a0-be2b167033b6", "comment": "Malware payload (AgentTesla)", "value": "4c6809a6e2690485e68b0563a6d80033", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424385, "uuid": "691ee1af-07f1-4862-8a13-ff5908869db3", "comment": "Malware payload (AgentTesla)", "value": "cf642ec687df562bd5b7b3cf5927ce00c74e9596274e4cd6e31433e90dc71312", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424385, "uuid": "174f8326-d1d7-43fb-a67b-0a6bdd936829", "comment": "Malware payload (AgentTesla)", "value": "264302eaa29fbdeb67cd4cd224b062b34d0211a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424385, "uuid": "78511ab1-2e73-4214-8dfc-a81d3f6956ef", "comment": "Malware payload (AgentTesla)", "value": "4a2f3e569bd39b4ead70fc6b6654e7923baaf894ee1275d5482a5ca1717e77f67c3fd70604f5aa02166aabd5b390066f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424385, "uuid": "ac2ec206-8a52-4707-a61f-3561c1041948", "value": "T1CD347346F68452A9CC18A3B07932CE7407167EABE974645E5ADD3E273FB78F30066843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424385, "uuid": "41245eb9-b9f8-4713-a46d-a35c3e25e56c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424385, "uuid": "44a99e04-8e2e-4d81-971b-f0bac6362178", "value": "3072:2t8fPl67SQzNMbu3zbxSY7KZnS/KzJBLu:2Ol67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424385, "uuid": "f4ca8cb4-91a9-4a15-9c2a-7c4cbf62992c", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424385, "uuid": "32d3ba51-3b36-43c9-b8b7-ddec7762054d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424385, "uuid": "2dc4beb4-646e-4201-a1e4-989548eccc7c", "value": "DHL_BILL_LADING_DOCUMENT_RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41736ace-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450574, "uuid": "7c44ead4-ebeb-46f2-94c4-f1211044a1df", "comment": "Malware payload (Mirai)", "value": "f75702bbe58a8797bc565af8159d2f06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450574, "uuid": "f836bf5c-d239-4c6f-81a6-680858bdec57", "comment": "Malware payload (Mirai)", "value": "d04040c2ae37e0416c1c7b326a7861e374bd8600b91b41adb107c44427c98095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450574, "uuid": "811f160f-1a2a-4371-bc71-7715569fb745", "comment": "Malware payload (Mirai)", "value": "a31bfa934de2b6dc013cbe0e7aac8440a88451e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450574, "uuid": "7eeb8d3d-cdb5-4ae0-87fd-3c4881f83195", "comment": "Malware payload (Mirai)", "value": "e3fa42d0c5735f2b8033ea4200d6be364bb04658f4ee1e2c7715109d09f62e0696e28fe9058d383280b94a7c797b2eb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450574, "uuid": "73b3a614-13d9-49bd-b71d-7d9c892af755", "value": "T11C537B316E7A2E17C0D0A07E22F34754B2E0679E36A8C61E7D721E4FFF25650A40B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450574, "uuid": "9c1d45c0-b8ed-455f-af1d-c9ce552cd154", "value": "768:LuoVS5CjwAE+RU+fECef6Vq98bttpqoXdC12AgYMO+EkqrwJh+CVNUH:LuXkjY+RU6ECef6VS8bPpqsm21f9VNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450574, "uuid": "a47668d4-ad64-4e08-9f90-3254abdacfab", "value": 64768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450574, "uuid": "07e14946-8cfa-4960-abe6-f1b0a4198973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450574, "uuid": "3bf22ff4-f69d-4fc9-a17f-1fc480e694d2", "value": "f75702bbe58a8797bc565af8159d2f06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2ef250-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694427027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427027, "uuid": "c5f077bf-467c-482c-96ba-12b6f83b4dc1", "comment": "Malware payload (RedLineStealer)", "value": "036be5bde271d9d0467ca6f5023d8b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427027, "uuid": "675d01d0-b1b7-45be-821a-7d2b4308361d", "comment": "Malware payload (RedLineStealer)", "value": "d0ae8f9b1f19807ab32f3b780888a2ecd27decdfe8250c0758a2cf3da8a05293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427027, "uuid": "d022cb4d-246f-48e2-97a3-0bf74b7354c4", "comment": "Malware payload (RedLineStealer)", "value": "1b7da5ab3e797982af106f400bbc6d414fa7cbb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427027, "uuid": "64cba9ea-da2e-46a2-bbf3-e9713ceb8fd4", "comment": "Malware payload (RedLineStealer)", "value": "3424920678022c3eda8327c1b17fad018f186b3fc2923d678c752399d1d48c5de9ed7e76324531f39609871c6e9a59d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427027, "uuid": "30c9c29d-e153-4599-aec0-bba44696f241", "value": "T139646DD363D0E871E5264632CE2ACAE42B1EB9604F5577EBE7449A2FC9BC1E1D172301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427027, "uuid": "e2b67ddf-2ca3-4029-ae33-8c0fe698e495", "value": "956d4bfad20bab24e49b479aaad17e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427027, "uuid": "f8f3e1e7-e9a4-4c0f-b6ad-dcd5bbcbbab1", "value": "3072:9c+7TsNY5rqtNIww+9tpdwqvYvFtDclSaDrWwCK1O6HVdM8kT+Dw/e1mIKtvVm:hB5rqtZw+9pwq0clSafLCKzHVlDwDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427027, "uuid": "7d944938-7db5-40b4-a369-f146412d4b2d", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427027, "uuid": "45bc7fcd-678d-4512-9813-5de1b211cc6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427027, "uuid": "f913f149-9afa-4150-81cf-cd4016b5fd8c", "value": "036be5bde271d9d0467ca6f5023d8b42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d549208c-5052-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694402719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402719, "uuid": "78e943c0-4b7c-47fb-8deb-e887fe9af9dc", "comment": "Malware payload (RedLineStealer)", "value": "3f42f173f569228e5d1792e7abe81c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402719, "uuid": "1b3f9e3c-43c3-4382-9646-0d71e69d5601", "comment": "Malware payload (RedLineStealer)", "value": "d194ed494c561893ad08c0c91b1ed3dbcd229ac579cebfe23f32481f8410ea72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402719, "uuid": "82b6c5fd-232e-477b-ba42-e2cda5c75e85", "comment": "Malware payload (RedLineStealer)", "value": "78c5f716183920a224810296ef230745b3c375c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402719, "uuid": "57694021-7c59-4786-84b3-0bca0818a85e", "comment": "Malware payload (RedLineStealer)", "value": "3fe83dd26f911b3fd6a8ffb658494437fb18ebd4b8f01dbc49196a9ac776935913338caf0bd84b2c35b678a166c0cb91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402719, "uuid": "31ab97ca-7944-443f-adcd-7fb40e0aae4e", "value": "T10B65125072E1C833D0B32A3309F4CBB99B3BB8A14764D97F6761EF6E1E642816630476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402719, "uuid": "b1464968-4709-4e54-b81b-ef214ba6e79f", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402719, "uuid": "fc583516-ade9-432c-b0e4-da8c1709019e", "value": "24576:HXYCJ6kUjjFLVI88VvMY9Zv3IUC4OtQRy7JidIUGsdnxILBtVPmJC52KjigUk3vu:3YCJ6kUjjR4MYX3I34MQRydid/VxKBtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694402719, "uuid": "046c7784-796f-4d6c-b9f6-986c642469e4", "value": 1470328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694402719, "uuid": "e2734839-e646-4764-b3a0-2324189f62bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402719, "uuid": "ff63324e-4bed-4350-9970-69e601e9bf88", "value": "3f42f173f569228e5d1792e7abe81c00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8483fe-508b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694426892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426892, "uuid": "ac1e07a3-8b4f-4dab-9e79-3c0ed46d4f4a", "comment": "Malware payload", "value": "c643a2eb64b9dd288ae13601ea142f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426892, "uuid": "e0be3269-e55e-46bc-9cd6-3794a23b48cd", "comment": "Malware payload", "value": "d1f452044edc5465c22aca481be32243e417ac60690a02177f4a9015767b0303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426892, "uuid": "047ca094-0b8b-44fc-bf20-9ed5a9293e6c", "comment": "Malware payload", "value": "75c758a33b5f1a9bca13343a45d634d4af02ba75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694426892, "uuid": "a4e6e265-6f31-40d0-8ff7-11cdf9cb67e8", "comment": "Malware payload", "value": "325c968dbf1868c75dfd1d44af86ae50dd0800280a3cea3372a221b93cd814a7a6a1f2561f4a77302f3c1941cdcbacce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426892, "uuid": "04445161-6053-4191-957d-8d729a402fa1", "value": "T1DB84D713BA4EC9F1E2891736C59B149413F1D685639BEB0AFB8A13BA04433BADD015F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426892, "uuid": "160e3817-d25c-44d7-9ae2-ecbcc3b2d3b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426892, "uuid": "6f818585-fdb6-4b68-9a25-703af0039662", "value": "6144:yBoWnRinbVUx7Qqh+UghH+BoxFmeelQXUhZj4skerImtUGFm:yhYUR/hHS8oHmDQXUbjhCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694426892, "uuid": "3754ddb8-06c4-4bc7-a10b-493c38e0993c", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694426892, "uuid": "46438009-5317-4ba9-a234-98e62beaa264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694426892, "uuid": "5b3469fd-bf32-435a-86f9-82c815b05180", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a336bd8-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401170, "uuid": "4a0ca3c7-f7d0-41fd-98f5-b4400f06e5be", "comment": "Malware payload (Mirai)", "value": "a69cc6abd6c4fb4ff6d30ad80e5d5c87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401170, "uuid": "ae5f04f9-08d8-4343-86bd-5b23f392715a", "comment": "Malware payload (Mirai)", "value": "d23076c53ddb7e883f07e295cbcbe6a53ee6b33de490da0d6983725ff07d98c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401170, "uuid": "e0cfdedf-ae2c-47f8-8880-d903c335e55f", "comment": "Malware payload (Mirai)", "value": "1de07a135e542121c6bd92a8f5a81db3c69b368c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401170, "uuid": "24f2ee46-333a-41d1-af7f-00177bd8f4a6", "comment": "Malware payload (Mirai)", "value": "8d57510f852f15dd14c41d89fa6137b1889f41f9920ce4ab041b1bb583f70c681719510fe094276bda2b5e15c1135ce1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401170, "uuid": "291f9306-2450-40be-bb50-58e07aa74af9", "value": "T18A73C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7534D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401170, "uuid": "a139a48b-c269-4fe8-a3cb-8d2176e2849a", "value": "768:K3sJmkqElhWHgJvd8p6Ef5Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwnaS:KcJmk51w5B4RcBvC8W2ZpMe7+pcI3na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401170, "uuid": "c357aeb3-ca24-4b37-ba7b-de3333023542", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401170, "uuid": "3f8895fd-db2d-4983-a504-66c2d856994c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401170, "uuid": "a8c6ff97-8fb1-4dd6-ad94-0037af13cbdc", "value": "psl.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1301d6d3-5076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694417855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417855, "uuid": "16f6b3e2-8b68-4133-895a-23a333853f5a", "comment": "Malware payload (Loki)", "value": "ea1d28d692382a5579b91f8a81599f89", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417855, "uuid": "02f9b4d4-34a8-4dfb-a1e6-e1471bf10cac", "comment": "Malware payload (Loki)", "value": "d36047b6f7d7bc746464b5f2e9e77f9e57bc27299d6074e19f9039374ec41616", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417855, "uuid": "eaa8497a-88cd-41e0-a4eb-334a2e484d03", "comment": "Malware payload (Loki)", "value": "4be222abecbac60e7eedbe7f96ac72cc6365b87c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417855, "uuid": "8c934037-9f79-479c-9270-014a3e84233a", "comment": "Malware payload (Loki)", "value": "cc3782117042903ee46105c4521bd71e941bda96eb9473d34d5cf88f36f0c1b4f940cc9361ad118d1ef4faa8b5f77169", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417855, "uuid": "bc1dc7bb-3a78-4c9e-a5c8-5d8fd937b9b8", "value": "T1D0B423C771C8F13679E85BF88039D84DEB394BD269F995C820DFBC6870E5150ACA2369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417855, "uuid": "46b3a07a-fcd8-43ff-b405-7b9349e83f83", "value": "12288:0O7XEgw0gyCmJI4+CT9yVfd9EQyGauqnXjE/ipZD:1XE//yCmJr+09sy/GatEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417855, "uuid": "e10c276f-1a65-4621-9470-8fdacc3e6853", "value": 504068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417855, "uuid": "cdfbe136-185c-457f-9634-308856e68f28", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417855, "uuid": "39ac30df-1f6d-4e43-afdf-72af716cf9e1", "value": "Transfer Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd266df-50ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694455828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455828, "uuid": "499eb71e-b7b3-4e86-8d15-1249e1505de6", "comment": "Malware payload (NetSupport)", "value": "3e8454c9af307f7c5e9d05c6106442dc", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455828, "uuid": "70401eed-af4e-4c67-9a58-e85ba146da1c", "comment": "Malware payload (NetSupport)", "value": "d38c05a7306ce8dd6439608a00b8515dfc1873e6e8b00d247dd23fe60fa7ed03", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455828, "uuid": "0ca90a19-fdb4-4582-a7d7-e29469db219a", "comment": "Malware payload (NetSupport)", "value": "a2d3b76d8b346d1d0f232aa4a3c3101bc720fc0f", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455828, "uuid": "d121cd82-1e41-4789-be1c-faf6e8db2ab6", "comment": "Malware payload (NetSupport)", "value": "84799b50e2073e3849a759f6120dfa4bcb7a4bb9574423a83bec4efc64e3edbd0323ebf7c9bc107eba43e6fc5f1130be", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455828, "uuid": "7a594107-b025-4bda-ad87-bcc5c75e9449", "value": "T1B2C533134671AD96E522223FA8D6BD30667DD23E7D626DBCC15A85C731CDD86CE6CC00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455828, "uuid": "2956552f-afa0-490c-b79d-ccc1be6e1bda", "value": "49152:XcqtEwZjZgN989SQ5PWZMB1qEzda5D/GatWTjvE/OOKnzUjznXq:XVtEw3e989SqPdiERqpWvMOOpPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694455828, "uuid": "c12f58b5-c078-407b-b0de-8ff50b0dc6f9", "value": 2681400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694455828, "uuid": "56c96b58-8acb-434a-9a58-b0f8c9adec39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455828, "uuid": "e18d3588-9f43-4727-93eb-ddb3453f1e7d", "value": "DancingParty.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7047e95b-5051-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694402120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402120, "uuid": "d24cb7f0-a496-410c-a1d3-16352539a8e0", "comment": "Malware payload (RedLineStealer)", "value": "a6ae2bd6afd6a40724304d19ed76f26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402120, "uuid": "fc40bcd5-6523-4701-85c0-196e04c14937", "comment": "Malware payload (RedLineStealer)", "value": "d523fc3a996f7d29e5ef1071ec0e2ffd6a4cf7fdc73b5750974a1e5e3108ea71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402120, "uuid": "0dfbdadd-a683-429e-9f4c-3aaaa78bb4e0", "comment": "Malware payload (RedLineStealer)", "value": "f5cd1760b68de3e737473c2fe0f2a4dcb7597f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402120, "uuid": "7b9448e3-bafc-4cce-919e-2a63c5167df5", "comment": "Malware payload (RedLineStealer)", "value": "ae3dce36be47ec73d6ba172e0ee6ac5fac287e6c27ad0eb073a5ab7359ef95c095fdad143af583759093fa25843a6c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402120, "uuid": "e7becb10-f929-4b54-997c-694a3ad4d518", "value": "T16D65124175D0C472C67116F20CE1D6711EAFF8322AA609DF73E58E2D0E37181ABB65EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402120, "uuid": "f3c97e09-5527-4f57-baad-bec3a142372c", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402120, "uuid": "2368c328-fc36-438b-ba5d-c91cf8696d17", "value": "24576:wpOCJYRlbE2jMG5PDLAW5uYd5qg7FvmK604rKcJLMwchKgfbJawq12uyu1Hg:QOCJYR/5PHdFFva04rBMwI1awuT1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694402120, "uuid": "60b94e5a-a0eb-46e4-8ed1-b8bcf381f526", "value": 1545080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694402120, "uuid": "0cb1a40c-caee-470b-b861-ed1e1047d905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402120, "uuid": "749a5466-f8fb-47d1-a956-01a84b88139a", "value": "a6ae2bd6afd6a40724304d19ed76f26b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec7b4e3-507e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694421310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421310, "uuid": "644f2db4-b22b-47a0-910b-ed845ddc23d5", "comment": "Malware payload (RedLineStealer)", "value": "7c6d12dcd138418691419f9783f8d3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421310, "uuid": "be56b696-5a5a-451b-a1f7-f325ae97177e", "comment": "Malware payload (RedLineStealer)", "value": "d52795d63ad44b0820ec52756b38b8f94c6d73f607200d7f2cf255f0c7e0dde2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421310, "uuid": "d1d3562a-4f84-48ed-9d2d-7bd904c8222e", "comment": "Malware payload (RedLineStealer)", "value": "c707b19f4cba1221a1805f1b64c7a088adb862fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694421310, "uuid": "7d000ae2-b010-4e5c-b0b0-7ed475ab0cd4", "comment": "Malware payload (RedLineStealer)", "value": "dae8d990b1eea044691cedee5e201949855c5bccb112ea0e0aad552d998f638eccb06dbe96929b823ea5d3e7286924e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421310, "uuid": "d13a8611-c44a-450e-82bb-9b551b99ab7b", "value": "T1D2747C35B881C471D5333E3D2EEFB2B5096DF7121785C96B4381EE7E0A34182EAE552A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421310, "uuid": "3199843b-891a-405f-b021-654c6cacd3ea", "value": "2627254264278e0e80567712e48122f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421310, "uuid": "9d4676e3-5bec-4828-bed0-ae30d04eaaed", "value": "6144:I5tRVoHUWbkvb6ZzlU9o2gLBiiAOe20LRhX+w4WfPS3sCJTty:I80WYvbgBlXczLRhXZMsCJTty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694421310, "uuid": "cbdb4153-9da8-4313-ab65-f15d0575eb7c", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694421310, "uuid": "7f1d343a-e9f7-462d-ace4-f2f057bb78e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694421310, "uuid": "87323b1e-1368-48d6-b724-d3ec31debd00", "value": "SecuriteInfo.com.Trojan.Inject4.60935.10191.10320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65a6cec-5052-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694402720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402720, "uuid": "baa6bca4-484f-495d-b864-9af59182ece3", "comment": "Malware payload (RedLineStealer)", "value": "83efe5f1b79a77bfba21409d3c359cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402720, "uuid": "0139e125-8bf8-49b4-8448-d26a7ac36ee9", "comment": "Malware payload (RedLineStealer)", "value": "d710bfb8d4ee7669e489785deccfd7e7cd8c9ccc936b10519615e5a7f3748d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402720, "uuid": "43ba4a55-2a4e-422e-a7d0-09fad493f72e", "comment": "Malware payload (RedLineStealer)", "value": "735de36da94d8292be6fb27c4b016d9dc34a9e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402720, "uuid": "a0d52dc8-653c-476f-a21e-39cfeede123c", "comment": "Malware payload (RedLineStealer)", "value": "059587b4e5bf753e3881302a10e51028b6708442bee6f7ebbd7e0c1ac257eb5bf73d5e708a927ea89a859614088800cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402720, "uuid": "29fca533-7880-4d65-b9ae-0742b2dbe3a0", "value": "T16C6512F9B8A1C437E471103646F1AB794EFEB821C78619DB93745B2F0E18BC1E62152B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402720, "uuid": "d840da85-bdfa-46fd-93db-e72a65fe6d3a", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402720, "uuid": "b3194186-8eeb-40ff-966f-0b4239d1a142", "value": "24576:1FRCJo9QmbGkwLeF/BtCyfKLi7a5VvX94B+2H4dZprnuHem3MCfY3h0dILVu1Hg:TRCJo9PGkwi0iO5FX94BidZprnaHYK0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694402720, "uuid": "8683ef65-f8c8-4a3b-bf94-36dd39acf6a9", "value": 1539960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694402720, "uuid": "59b643f0-a2ef-413d-880c-16a25e59d85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402720, "uuid": "724ad5d6-902d-4509-8664-4b8acab9ef53", "value": "83efe5f1b79a77bfba21409d3c359cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7151ad8-509d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694434880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434880, "uuid": "a1b67d21-262b-4ca7-b3c6-6757897f335f", "comment": "Malware payload (AgentTesla)", "value": "395aad2a97f3bbbbfe3a502a31a4b938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434880, "uuid": "4c0407f4-08a2-467f-8c3f-862b35152cc9", "comment": "Malware payload (AgentTesla)", "value": "d8532b6e5e366374bf5fe95240f3f95c467db9b7a897b8e7c6baa6080ad02afc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434880, "uuid": "a2ddabf4-e0d0-4c98-9ecc-aa468dbe58ab", "comment": "Malware payload (AgentTesla)", "value": "31a64914853a15e760f4c84118b702d7d8ae72f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434880, "uuid": "caeb7131-3cd2-4e89-b81c-76a38ffb3e2a", "comment": "Malware payload (AgentTesla)", "value": "ba8210c440f97c5e87333cfcf366ddcb761674662e245c5f918af9b7a8229fa0599e60b7bb49ccf8b64e9e30ad0a0799", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434880, "uuid": "9b973245-bdd8-4caf-bf2d-1605ebc769e7", "value": "T18655A1B9E210E8D1E03A0D3DEDD101AC822495F5DEBF915329BF338D6CB144A6959FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434880, "uuid": "5c5aba81-26a0-40a9-b0ca-e379913e7bf9", "value": "24576:up9Wip9WKaVilZairTZ0U+p9VPB4fJYOWG:eWaWKaVjG1gPBSJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694434880, "uuid": "83d2906a-40ee-47e9-b55a-0adb5d42eece", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694434880, "uuid": "27901aec-057b-4116-ab92-3a06fd0cb21a", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434880, "uuid": "c74b92aa-7199-4e19-9def-bf2f3ff4d6cd", "value": "SEROO4NE4.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9934472-50b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694444736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444736, "uuid": "8d13181c-4d73-453e-bcbf-1e0245c33f58", "comment": "Malware payload (AgentTesla)", "value": "40c97d45e36cb3764c94341db6d5886b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444736, "uuid": "5503e958-6257-444d-90ec-9fd6e3aa2771", "comment": "Malware payload (AgentTesla)", "value": "d8b5d4fe4499976563bd1d47c252c70c0e0e4aa424ff5b8a082a2aaa6cc39ed7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444736, "uuid": "297f2518-f840-4b74-b9cd-d45098b0a11e", "comment": "Malware payload (AgentTesla)", "value": "1e3c4876576b8c93854ec408abc8096c23d963ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444736, "uuid": "e2a2df24-a6af-4be9-8cfb-6e0e52d01f16", "comment": "Malware payload (AgentTesla)", "value": "f7c02031b89a45e77c5aa98f56a25bdead2f6f4840721df66ab44865992c47ff47178e4691cee5c4d9b2b33dcb5d68b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444736, "uuid": "d2791257-1fee-48b5-9bbb-97b2eba0a54d", "value": "T12CD4238EF7EC413FC90D4DF97C1B53516772A80B62C1DF4FAC989825886779E8D20266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444736, "uuid": "33add270-350b-40f7-bdf9-2f933998d29e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444736, "uuid": "22bd5fdd-9141-45b6-9054-8df6cd2a7b72", "value": "12288:m5r2iNZ1D8M4BoNDpachLqriqEyi/REovWM/eBzXgcPB7F1IpCgVQqgDA88/:mh1pD+2lpachWGZZEoOMWhggcpCg2xDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694444736, "uuid": "762f322f-6fb4-42b1-a279-dda8510f392a", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694444736, "uuid": "052166e2-cf1c-4632-b067-1a4618ea5b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444736, "uuid": "d482678c-15ff-4ab9-80f9-03bb8af97dfc", "value": "Nrb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5db816f-50b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694444730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444730, "uuid": "82e892b5-e978-4f0b-a452-dbb271e6829d", "comment": "Malware payload (AgentTesla)", "value": "774cfeaf6aed35dca1985f5b8d092c7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444730, "uuid": "367dcbe0-e76a-4b15-83d8-0eab204e8779", "comment": "Malware payload (AgentTesla)", "value": "d8f5077af987289051b2171cc862f5584adf7364f29c14d8c5ebde4e20be498c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444730, "uuid": "825ac939-d081-4eb4-8add-492c56945929", "comment": "Malware payload (AgentTesla)", "value": "8aefdad132324a07e539af31a7c20f4a18307faf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444730, "uuid": "8808561c-07fb-49f5-a4e7-e7e2764b2e64", "comment": "Malware payload (AgentTesla)", "value": "432942f3f724b9de99a63ea65e84decb44c2b3447a7bf00df77df35f71a6a7543e17017c3e7b6f7ccc20fe2c98a271fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444730, "uuid": "08e17c5c-dbb4-4b32-8774-dc986965e83a", "value": "T199D4239A98DC73E4F1D604884C36593E4F5BA1A3D76E5424A7B27C3F031A0DE348A6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444730, "uuid": "c8a36c42-2df3-466b-988c-6045e12bfe0b", "value": "12288:HOvtQ32tHk/+FZwCHf3r5kyO4ceV4tHgbFeEItwlqeRdnUi8Xr8:V0E/01P99QC4J0eEQwl9Uiy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694444730, "uuid": "b83da43e-fa53-44f7-9dfa-5239705fd7d7", "value": 611956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694444730, "uuid": "4609e449-f0f1-47ee-a99e-c7e2f7fe8ce4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444730, "uuid": "7755c11b-046b-4a4e-aec6-02c2f3509171", "value": "Nrb.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de29442d-50de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694462863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462863, "uuid": "22d0f5ca-0cbe-463f-a9b8-ff2eb291bf84", "comment": "Malware payload (njrat)", "value": "9328c2962f3452841d89aac41b741075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462863, "uuid": "b52d180c-931b-4f6e-b4c9-5899cf0e8a51", "comment": "Malware payload (njrat)", "value": "d91b29aef9739b6612085293e8951e9069e5663e0c5fbb1617b2d79fc3746050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462863, "uuid": "1e03dfcc-42cc-421f-b1ea-cee55d9af6c0", "comment": "Malware payload (njrat)", "value": "1ec854a24bea706ee32b64fc72a9780d30099508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694462863, "uuid": "13006825-5c89-4310-a83f-9f9a2c5eb7ee", "comment": "Malware payload (njrat)", "value": "69529a3048fef60aa12e4d4910ef8417a3efcec935450500b89528bea487faf286debe613faf791aa23e5aa2852c95c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462863, "uuid": "bf2c258f-25c1-4f2c-849d-0d0e310e5dbb", "value": "T117E218067BE98215D6BC5AFC8CB313214772E3438532EB6F9CDC88CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462863, "uuid": "f8885ad3-1674-4b16-b177-a18d53b36c47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462863, "uuid": "2bbd90e5-f5c7-44f9-9fff-1b5a47acc5e1", "value": "384:A0bUe5XB4e0X7OxLw0Q0mS03AWTxtTUFQqzFsRObbt:lT9BuCC55dP2bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694462863, "uuid": "274338a8-eadc-4360-aeda-3a7cabad4206", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694462863, "uuid": "ed7b9115-334c-4c0d-99cb-4ce866807d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694462863, "uuid": "19019174-5496-439e-8eac-8098042b5782", "value": "bPD6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1996a268-5067-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1694411423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411423, "uuid": "c5b4aeb8-2afe-4d15-bff7-ad871b8cf7a4", "comment": "Malware payload (TeamBot)", "value": "e95c469cac7a9b95ac8d07263475ef03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411423, "uuid": "179cfd34-a235-4b3f-b7e7-cfcf823d24b3", "comment": "Malware payload (TeamBot)", "value": "d9c29be527cf5b75bb3a4051bb781099859feb83d3cecab097bd3cfe1e87715f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411423, "uuid": "5eb243f0-898a-4f0f-a5db-53b36435bd0d", "comment": "Malware payload (TeamBot)", "value": "a2ab1d31b334af67b46f67e0a7287e11deb69fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411423, "uuid": "8aed5902-1025-4961-ba82-7481877707d8", "comment": "Malware payload (TeamBot)", "value": "dd34b867090a995e2797ea5b81de772537d61b5449b2859a7d121e31b5a2f74c28ec439eff164c8f5340e23e23cb4d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411423, "uuid": "09e34c5a-314a-4374-848a-4c48b9f30063", "value": "T109647EC393B06CB1E52346718E6AC6F42A1EB8605FD536EBE3546A1F09BC9E1F172305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411423, "uuid": "1c374c62-c557-4faf-9e20-1df1c9f78dd9", "value": "c0ea63f985a38ccc61e41516c5fe1f2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411423, "uuid": "d0b4e204-496c-4faa-9e3e-38c8367e6c2e", "value": "3072:Pn9VvVuWiJxdU4xsY0o7D+rGIdWAe1zASsjtRFR8R3FeUxBlEVS:n5iJxdU4xsBoGrG7jzxAAR0UxBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694411423, "uuid": "51d6914e-c62d-4589-aacb-98057e3264c9", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694411423, "uuid": "2306205f-d86d-4912-b9dd-efa6c7957b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411423, "uuid": "82ab2490-0e6a-4d46-9551-627205bbed3f", "value": "e95c469cac7a9b95ac8d07263475ef03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca34ebfc-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438778, "uuid": "1d92f92a-17a3-431a-8432-ee0e8cda5368", "comment": "Malware payload (AgentTesla)", "value": "2d9611fb5f988874ba607847c2b51355", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438778, "uuid": "f4776f0b-f21a-482b-b85c-f7a14d341add", "comment": "Malware payload (AgentTesla)", "value": "db2563ec78911e44a7ea7affc6fd4dfa7159b45c52e93b2bb30e9301ef26619d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438778, "uuid": "546f849b-f5e0-49dd-b993-89ea3ee2af08", "comment": "Malware payload (AgentTesla)", "value": "fad083261891e393da5020d097088699355fea65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438778, "uuid": "ea9008d0-6b58-4470-a81a-1b9957bb05e6", "comment": "Malware payload (AgentTesla)", "value": "10293b117d5a94ca2770f37ca08e854476204cf34a38b38d56221ec2e82bea5650cb9c1091c68ed7a9af05050c7cec29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438778, "uuid": "be97e851-5f75-4043-9cee-e4a071580bfe", "value": "T10A3572BCE211D8D1E13B0E2DEDD100ACD22461F9DDBF9153297F638C6CA2446A959FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438778, "uuid": "f2ef1768-8bee-4b38-a53a-380c5a301d74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438778, "uuid": "c68f2e0c-1043-4637-87e0-49e46f90818a", "value": "12288:/3Xe4wCp6qWip6qWC7YTVA4m8U7wFtT5KYk5QAkl6WmU7Scn468jjsZS:fXgCp9Wip9WCaVlvAwTDAKzmIh468j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438778, "uuid": "e356d93a-fd47-44da-a5f4-bc7d57c17ba9", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438778, "uuid": "24a9ef09-a584-4b21-bbe7-7ae8a0562235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438778, "uuid": "be6b8d64-9cb7-49d7-a656-4acd3b03d986", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32d09af-50d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694458040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694458040, "uuid": "25f6bc4f-1f6e-405e-aca6-f5af2f6c0622", "comment": "Malware payload (AgentTesla)", "value": "98bf6cea91892c0c88cc7e161d801fb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694458040, "uuid": "ca8801d9-7181-4e06-b865-eb7284c20e01", "comment": "Malware payload (AgentTesla)", "value": "ddb5cfb3ae65726fe4d012bd90a46426eea47c14af1296d6a5c5f74bb5a5c1c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694458040, "uuid": "02f740a6-3715-4748-a52c-276581316827", "comment": "Malware payload (AgentTesla)", "value": "c1594a69899f916e5c8a3b37fbc65b6abff1406d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694458040, "uuid": "ab885dca-4f72-4152-add1-48a50bbb4f23", "comment": "Malware payload (AgentTesla)", "value": "1150304f0b499652750abe03095faa3599afc7a5bf53a67d45f19233027a5e2eac661b40ca62dfdad677435788eaa7a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694458040, "uuid": "98069e2a-7ed6-49c0-8e2f-042381baca78", "value": "T109C41204B67D463FF90A67BE88E9C6987E7C8943C10AC78DFA45B4B83D14E2B95E05D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694458040, "uuid": "e8a81d9d-a3df-4c96-8442-cf0e48bffbaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694458040, "uuid": "591a42db-b171-412b-bab3-44e1e9ab4b07", "value": "12288:3nq967lDr2qjT8IkoSbBgozRAotls8GeyPrv3qxpdmbhU:3q9MlDr2bIkBbBgyyot28T+rv3qxpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694458040, "uuid": "7f057030-b53a-43ad-b4b7-89a598045ca7", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694458040, "uuid": "9c974475-9d1e-4407-aaf8-dbd42d8baacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694458040, "uuid": "d88be77d-0c7d-4316-b7d1-d14ed5aeb38a", "value": "hoho.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6682d2-50a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694437329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437329, "uuid": "dd62d91c-07e7-42cb-af31-a9012326f013", "comment": "Malware payload (AgentTesla)", "value": "a474a701080f627bcd9dc3e29fb81604", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437329, "uuid": "07ab0012-a99d-4381-9f35-b592f3f608cf", "comment": "Malware payload (AgentTesla)", "value": "de74104e75bbf713beee96aa5831a4dd2a94b106d5cfc9b43a598fe858f5aa56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437329, "uuid": "2cc91fe4-89ac-4253-92be-6eba36e8bd36", "comment": "Malware payload (AgentTesla)", "value": "443932fc6d735f4481c3a6761dd61daacc6b3c47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437329, "uuid": "b7a53f1a-1a91-4a5a-964f-981a84346ff3", "comment": "Malware payload (AgentTesla)", "value": "18030793abf2d4ea39059d9cb455542851967e22f9d430bc82652822eb65be1ac689a4fc6c0c25d5584081656b5350e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437329, "uuid": "c6e283ae-dd5e-482d-9643-2d41926cd640", "value": "T17A340D037E48EB11D6583D3B82EF6C6853F2A1D70673974BAF48AE6529412436D6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437329, "uuid": "39e4da10-9d70-4fb3-ac98-b879de9f7ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437329, "uuid": "c8d1b5b1-3298-4cb6-bbf1-428778a2908a", "value": "3072:GsCA9dRRJtRNwbdT7quhRjBQbc2MyP/cnRXSkdt:FNRrzY/quhRjubcZXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437329, "uuid": "68a2518f-bb83-4a3c-8a2b-bb5d9d8a53d6", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437329, "uuid": "8ad153a2-7189-487e-afa7-614c9b230e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437329, "uuid": "ac2e1a64-d48f-45dd-be70-e544e3f98278", "value": "Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b7c66a-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450560, "uuid": "2ba191bc-20eb-487d-a0ea-df4636c6a206", "comment": "Malware payload (Mirai)", "value": "7b86e1a5a16856b85447b90d62a669c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450560, "uuid": "d80c68c2-6e5a-471d-9f25-27dbeb8fbbc3", "comment": "Malware payload (Mirai)", "value": "de883fb217df507b1acb5bbe637d5e8d19ac989b9e78242f7c22bae58c0f408c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450560, "uuid": "58d3f52c-8c84-412f-96be-1d4f9e4ed541", "comment": "Malware payload (Mirai)", "value": "0c66e54a6bcdf012fb552bf583cfecc68cb60f82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450560, "uuid": "0bec07ef-1a95-42e7-8551-c2e3ecd25c34", "comment": "Malware payload (Mirai)", "value": "265f8ef2480abe8b706fb7ff9fdc814c4ae44342c8a12decf61f63e6fc76dbb51a775ea8fe883eaefe8efda7b9650fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450560, "uuid": "241699d2-0d24-494f-a7b4-55f7400c756e", "value": "T1B053179178D19A16C5E423BBFA6E40CD372563E8E1DF32178D216F4077C982F0DABA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450560, "uuid": "ad6b6734-18e7-47a0-b06c-5e9341e1fdf9", "value": "1536:9amD7RhzxhC4K+jbxEGh/VVzG+u/WhKXcQ7dfWl1d0:9aQDFphhVuuhY7df2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450560, "uuid": "81551c9b-521a-4830-a6f2-a55030f0fd59", "value": 64408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450560, "uuid": "f451c50a-445f-4ab4-98d2-c0441640b2f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450560, "uuid": "9ade7c45-52da-49ae-940a-0408357e706e", "value": "7b86e1a5a16856b85447b90d62a669c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cec87f-508c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694427364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427364, "uuid": "5cafbce9-c935-4092-991c-fa7c2fecbf7d", "comment": "Malware payload (AgentTesla)", "value": "1064aa38f07a52d59faa3a4131e8ce87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427364, "uuid": "2593d173-7bc5-4f0d-94f9-c3e0c97baddd", "comment": "Malware payload (AgentTesla)", "value": "dfa4ed974c1b0752099c6d765b388b6ec2847c383fa115d000791f34c175aa55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427364, "uuid": "616d70da-8885-4425-a3b9-c8ed35f2da8e", "comment": "Malware payload (AgentTesla)", "value": "eacb1f0b710b649cca09caee811940c23a5e5318", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427364, "uuid": "27e2ba27-4d8c-43b0-8510-7db3e13555ee", "comment": "Malware payload (AgentTesla)", "value": "8bfdddf3fa01eb77424a50ba6f3b1af1e55f67057e1a830145e229b145445a897b241f88331680f3f54b6d1ba628bad4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427364, "uuid": "07746505-26eb-4e25-9883-f983daed7fa9", "value": "T1BDE4E0F85466CBE2D7B493FF61AB95749D277C91207582CE737C38844EAAAC31852C32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427364, "uuid": "ed0ce847-d18d-4747-8a50-9d3ec2c2b093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427364, "uuid": "f9eda4c3-134c-4306-b834-fb178ff6cafb", "value": "12288:Z5fVsbR242673PWTmc1V+yWe9OU9yGG7/pNJ7Uhto:ZtO242AYVV+yWXPr7xNhUht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427364, "uuid": "070b9876-aa41-4c8a-b61d-4b326f5f5794", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427364, "uuid": "5d5ec86e-2b8e-4913-b51b-8e659aaef531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427364, "uuid": "3bd73b75-3d74-4cef-9e89-1ffcce8397a4", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb30502d-5066-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694411372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411372, "uuid": "a3c9dce1-785e-45f8-a385-7a621b784dfa", "comment": "Malware payload (Smoke Loader)", "value": "b13b6990ce7e43b2d7c150ecf944108f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411372, "uuid": "ced6101d-6d53-4b0c-a9ab-b891f9458571", "comment": "Malware payload (Smoke Loader)", "value": "dfd36cc557c5cfa9ca6c36ebf1640f927e9cbe7383b4aaa87d78c66eda26994c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411372, "uuid": "85b1e633-9c0a-4151-9f51-4193d30849e3", "comment": "Malware payload (Smoke Loader)", "value": "405f1b3a31daf331a70907b738493747ffd729cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694411372, "uuid": "a8ba794a-81c8-467e-9101-a559bfd72701", "comment": "Malware payload (Smoke Loader)", "value": "79dac7262cf0e57181e4ebcf47bc3041f5c55e751954771f17d42b342be6a5dcd0c630f196744efb9bdd79fe4978dced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411372, "uuid": "a08d1ee9-502b-48e1-92a1-e7bb6a446f4e", "value": "T156646CD352D0A8A1E7224633AE19C6F46A1EB86C8F157BBBE7446E1F097C1E1D172307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411372, "uuid": "cca4cae8-8611-4ba0-ade1-1bea2402f063", "value": "c0ea63f985a38ccc61e41516c5fe1f2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411372, "uuid": "6d7b28a7-65ec-4edd-94fb-876724fbffa0", "value": "6144:B2iNvSjj4xsSWtwgumdQQa2Dqa3ZnmKSwwZVVHK:FNav8Wtw5sa2qa9CwwZHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694411372, "uuid": "4b162ea6-d102-4e65-be6f-abfc54db56d1", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694411372, "uuid": "0209b59e-3a8b-46a5-83e4-ef051703c5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694411372, "uuid": "7129a6ee-c82f-43ba-a708-abf3ce0d97b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda2e705-50b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694443562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443562, "uuid": "58f70e68-16ec-41e0-bec9-c586376ced4c", "comment": "Malware payload (AveMariaRAT)", "value": "9c758ffac47b04cc73f1e3c34540f173", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443562, "uuid": "6114c660-7c88-48b0-b6da-588ff293497d", "comment": "Malware payload (AveMariaRAT)", "value": "e093691ccf2472f498f2531d59f46c8081c8d086b4c4f71c874572778768565b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443562, "uuid": "b9253028-ebb4-418e-9809-34b77b872f86", "comment": "Malware payload (AveMariaRAT)", "value": "e261d0a34612f5e076993f540c04c09b19135315", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443562, "uuid": "4214fca6-2651-48fb-9ee0-4f2a4d1d88cb", "comment": "Malware payload (AveMariaRAT)", "value": "7a6498858225d6009906cc2aa5e7a0d2dc7edfbcbd22799cb251d3e1afa7be216f03e2197e362475ed702237a18fc73b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443562, "uuid": "a4a66ce4-540e-413a-bd6c-448348994089", "value": "T107054A027655CF21C51F2776C8A689F40363AE41ED52DBCB36CABF9938B33A66D81143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443562, "uuid": "f291b0ec-e3fe-411d-b713-f1fa39237e9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443562, "uuid": "73c5fa85-b5ba-4184-b981-a2c46420d346", "value": "12288:i3Wy80hFqyCIoL+Y2BBL7ovQHInqXLS+M:i37DCI+WHcoHUWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694443562, "uuid": "1551352f-bb86-4e6e-8a1e-0669d4c7b48b", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694443562, "uuid": "e8f3d18e-0645-4451-88ca-348cb6d0a35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443562, "uuid": "1fe4eb75-69bb-4e52-9ab0-690653455426", "value": "QUOTATION_SEPT9FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2bf97a-5051-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694402118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402118, "uuid": "eaf909da-1920-4944-9966-2f7b3464f5db", "comment": "Malware payload (Amadey)", "value": "7ee2b64edafc640880186e3bde6d1f36", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402118, "uuid": "3985002d-33ff-40a5-9580-579117fd8c5a", "comment": "Malware payload (Amadey)", "value": "e15b6c9df062b8d22134a8ea4fd9775511ccdaa9c73071fcbc9721fec0778b8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402118, "uuid": "d604f2dd-7770-44ef-935f-912f6d14797d", "comment": "Malware payload (Amadey)", "value": "779b092e8800662776be859c1c70c2b0cd517a5a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694402118, "uuid": "a607cb3b-8a25-4dde-83ec-732d3ac73f55", "comment": "Malware payload (Amadey)", "value": "58565fcd8c81b6ead837f54de7a148177554ce5d2c4a4da9d79377adada110a111ea1119fff72ad34f01437c5ecfcb62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402118, "uuid": "8f23357e-a30f-40cd-99e6-c747e8751f04", "value": "T1C3651212B4D44C72F972383649F0AB765A79F8908A23CDEB77E50B7A8B312C19E71711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402118, "uuid": "06e1b0dd-13cc-4507-8415-40e447b505ad", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402118, "uuid": "2ea2a52b-1658-4dee-98f9-86152ffdbd36", "value": "24576:PtqCJmTOA3+qOjPRW/Gb1iuoPHlPwUWpg2UH02u+mq1PqB1eHGZjGUu1Hg:FqCJmatqOjPM/Gb1iuAJApLUINqZJHGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694402118, "uuid": "b96f48a1-8bd1-4a4b-bb0d-dcbaba82669b", "value": 1471352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694402118, "uuid": "9a88148d-ad58-4014-b3a9-39afd8d7424b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694402118, "uuid": "55661354-1919-4def-a00d-3612ec9a1f91", "value": "7ee2b64edafc640880186e3bde6d1f36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cd4f5d-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450226, "uuid": "03d7bdd7-0d0d-433d-99a7-bf8c41c8cca0", "comment": "Malware payload (Mirai)", "value": "5e08747dc76772827f50a94b7599bca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450226, "uuid": "303d9da5-5d18-404c-ae53-b2a5c5fdf9e4", "comment": "Malware payload (Mirai)", "value": "e1f494149eaf997ebb51aec72f463b8fe64181bfac68c3702251442a7d55ca10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450226, "uuid": "7b1491fe-b5d7-415a-90dd-c58691e73e96", "comment": "Malware payload (Mirai)", "value": "e48dd548659faccfebc6a531dad583b568e915f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450226, "uuid": "3863cc5a-80d4-4cb9-9318-25dd3dea8253", "comment": "Malware payload (Mirai)", "value": "7fef12a6f2f5ce8fe1c334171fc9b023ce3d3fcf099acb212671480b9e38392cfd468e93576bcad3147a6df7a37d575a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450226, "uuid": "4d23596a-3de5-4130-bc30-8ea508528cc4", "value": "T162C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450226, "uuid": "2427e6fb-8cdb-41f8-b4f9-3aa5ea810e65", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPeL7ymm/QMurB1nKGNb:SMQplVeamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450226, "uuid": "e04e167d-6ba8-4401-b1ed-d7290aca05d4", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450226, "uuid": "639192bb-2848-4147-b05f-9f0e1197b9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450226, "uuid": "effdd98f-524f-41e7-ae0e-a051bb6deaaa", "value": "5e08747dc76772827f50a94b7599bca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be8fa4f-50fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694475932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694475932, "uuid": "a6e0c3aa-677c-4aff-8be2-b5fdef3cf40e", "comment": "Malware payload", "value": "41bdf3bbb8d27902f5f22e9b5a88a25b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694475932, "uuid": "e0e65ba5-296b-4123-9365-82cb0a01850b", "comment": "Malware payload", "value": "e2622b67c87d3e730dbd1312d1160faac1ef9bd98f00041e15c00f347d47a949", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694475932, "uuid": "a2e8c76e-2572-416f-bd5f-7453bd04d2fc", "comment": "Malware payload", "value": "715db0885a5929a8978bdd25269134719c26f6f0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694475932, "uuid": "8ca38617-bb82-48e9-8a08-7dc984e44eeb", "comment": "Malware payload", "value": "d687b7ee9679b8cb50f46d6e1c90abbbd365febe72b398a51d2b315a0c50ac3eec2dbdc966fe9e4fe9ba1586a518d214", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694475932, "uuid": "1259d2b1-aed2-4f2e-b142-57979e7cd0eb", "value": "T10F54AE4577A814F8F1738278CC414A46E6B2B81A0B61E69F03E5477A9F237D0AD3EB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694475932, "uuid": "c74a597c-3191-45c0-a0a9-f6540aaf2fe9", "value": "8a8dbe6ecfacdaceac22d14c24917858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694475932, "uuid": "ee4c01c1-f0d5-4647-86fa-a76d44e6ec21", "value": "6144:8V+4tt25MIRakGNhYPu2p3QZn1igT+fY6s7:y25MIkkGNwPWZ1VqAN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694475932, "uuid": "ef318267-1630-4c14-9a18-526985f12826", "value": 289208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694475932, "uuid": "aa22ae18-0fb6-46dd-8358-ad9bc2511e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694475932, "uuid": "deddcc34-faa5-478e-b419-157bb64bfe34", "value": "41bdf3bbb8d27902f5f22e9b5a88a25b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2652daac-504b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694399419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399419, "uuid": "7616d98b-cc75-4a38-aa16-707f8c06ff86", "comment": "Malware payload (Amadey)", "value": "36c7076b6ba28964a6e13563a5c01f67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399419, "uuid": "b5e52e7f-c087-4cbd-bea5-65704d59be45", "comment": "Malware payload (Amadey)", "value": "e28de02461c37e831d3dd3c47f1e53eaa892d46723fee43a53abafd615072a35", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399419, "uuid": "5d07e613-3575-4301-a3b8-d9d8af233a00", "comment": "Malware payload (Amadey)", "value": "573b2515f5c9add384c6a71156c048f7bd29ee8d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694399419, "uuid": "f8d0dd74-a752-4f2b-94ca-bbc8b58aca22", "comment": "Malware payload (Amadey)", "value": "0cc44a2cf026cd43e005b9b4a36096067467cd061304f334a83d52c9b7356652deae7fd34275b2b569f4c4c09e4fad6c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399419, "uuid": "e475c12e-91c9-4595-a0fb-f42a36b9c117", "value": "T14D6512D079918932CA623133D9E0FEA54D7EFC604A6118ABA7A41F6F4F312D1B83D527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399419, "uuid": "d7935e7c-2f24-4681-b7fb-c2280ad72a98", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399419, "uuid": "9aaf883e-125c-4dfa-9dcb-87ce03617e3c", "value": "24576:LfFCJ0dqK0lZfMg+0utiYBFUUrm79Q0U5qcwqQHtGb/lYc+OVRu1Hg:TFCJcqHlZh+0oiMqIG9Q5wtNGuNOVc1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694399419, "uuid": "f6571aec-1d14-4670-824f-28284aff5de9", "value": 1541496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694399419, "uuid": "8cb3ef84-d6d2-4dc5-bca6-c313952d4355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694399419, "uuid": "734db2de-47e3-4021-86ab-6aad5d68bff7", "value": "36c7076b6ba28964a6e13563a5c01f67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7422ac1-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694450423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450423, "uuid": "1fdf62f4-77f1-49af-98bc-4a565b7cfa4f", "comment": "Malware payload", "value": "f2232f356bfae50ae8a2a61505ca1041", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450423, "uuid": "5d085c4a-c99c-4636-acd6-fd11c4b6e54f", "comment": "Malware payload", "value": "e2b74ed355d68bed2e7242baecccd7eb6eb480212d6cc54526bc4ff7e6f57629", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450423, "uuid": "ac66e23d-5a37-443e-90af-d86f71417344", "comment": "Malware payload", "value": "5aee3c957056a8640041abc108d0b8a3d7a02ebd", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450423, "uuid": "881d9121-d29a-4893-a217-514d4cba12d0", "comment": "Malware payload", "value": "22519167a60d17decdf161cc888812f04b0c56f238a7b9061806eda9945773ffec9ea03601ff9a6328ff914675ac349d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450423, "uuid": "1053101f-5a05-449f-bdeb-e2600713f2e6", "value": "T1B6947C213852C031D1A151B11E79EBA284ADBA345B6045DFB7D45F79AE212F23A32F3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450423, "uuid": "344269f2-8b1b-4d39-9bc5-405810ae3049", "value": "040d4d14a09117ca89a621f19d5ec050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450423, "uuid": "74adfe0c-0c5f-422f-aaa0-ff6aea94e733", "value": "12288:DFza2Iw6olBrAldJo31zLao8KNkOhstU3e8cQEkYstNzN:I2PfSw8KeOhsWDEpsLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450423, "uuid": "74fa4015-743b-424c-80e3-66b6c4c3020c", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450423, "uuid": "7fc5eaa1-1c0e-4a56-9473-f7cdeb265e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450423, "uuid": "a6028707-3d3a-4c6e-8c7f-b64cd37e226a", "value": "rundll64.ZZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd76a6c-5075-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694417416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417416, "uuid": "533b6f42-05c6-40eb-8173-fa3f63d6d608", "comment": "Malware payload (AsyncRAT)", "value": "c9a2e54e8501a2f6dd57255225999b40", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417416, "uuid": "788ac11d-ff9f-4efc-a9a3-de719efd6719", "comment": "Malware payload (AsyncRAT)", "value": "e2b8091be64890dacb851ae14b76723cff23b48048ec29c7eb5754ed2c89d5c4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417416, "uuid": "d78cd039-065e-4fc6-a7b6-5fe8517824ef", "comment": "Malware payload (AsyncRAT)", "value": "b8643d991e3079b1db6a3322c68f7c3624c9e2a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417416, "uuid": "bb13fd6c-1551-4a99-829a-7e4bd735744e", "comment": "Malware payload (AsyncRAT)", "value": "822316144f18ecba969a7eb33e4a66e04a51d571b33a0b1143a259433b2cad556817b41be5efb9e722bbf7cf5d6d245f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417416, "uuid": "bf939bb6-b7de-4cb8-8764-5fdb0ccdbed4", "value": "T1FD55338D9CE1D28CEA0D8DB7AA545C190E136304375A89FFACA4E1A4DB6FC135FC942D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417416, "uuid": "a94e0598-dbf8-4691-b9aa-55a35e40be1b", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417416, "uuid": "30463e7f-c0e1-40c1-9a93-e0368e97d859", "value": "24576:eCcJMTx/DszjipRnGKKfiqTJ7WGorsWTnkKRzjIKue1kJIBfFRVzv:UJAx/Dsz2NAi4wbpL3lfueW2FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417416, "uuid": "6d44db5c-6165-4e9d-9478-2dbf38e391e9", "value": 1348608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417416, "uuid": "5f28d723-f43a-455a-a437-bbc9f2e8bcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417416, "uuid": "3175550a-eb0c-4a39-8720-290861042911", "value": "c9a2e54e8501a2f6dd57255225999b40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793d6bf0-50ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694455822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455822, "uuid": "dd7569b7-69c4-4932-9752-d1449415d811", "comment": "Malware payload", "value": "7fec6776e809f8bde63d4b1956dd1349", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455822, "uuid": "7b98a544-6827-4235-a12d-2db20a1b3889", "comment": "Malware payload", "value": "e3b1eefac82008d35e60b8f75341a8f272c0becb6fefd69d2119571a41bb0c37", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455822, "uuid": "68cce1ea-877f-4f76-9e72-11645ee8079a", "comment": "Malware payload", "value": "187972df2e59e181b4385d054c4e3f85a8f0209f", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694455822, "uuid": "3e06a041-f285-43f9-a799-86c14c146f92", "comment": "Malware payload", "value": "acda859b031c6496a0cf5619339c39a9be58be485c68c6b0ad512da67b6e02ab500b3286960b3d449b1ad58d37a44902", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455822, "uuid": "98b6753e-2685-45f4-83ab-4c9df1d30859", "value": "T18CF533665F090F71C9BD997C8C65CA44EF3A66B1653DB72A37E8AA100F15ECA07F0834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455822, "uuid": "85eeedbd-0974-43da-8dae-c349d4a279e5", "value": "98304:f3uWCWrRxRPt6h8L7XKCGDFTTUEsqntU2Je4of7:2iRPw07aCGDmutUAel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694455822, "uuid": "340bc638-fb28-4742-bed2-e2bedd967b28", "value": 3618815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694455822, "uuid": "1fd3ec9d-e527-49b9-aed4-401828ae1c22", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694455822, "uuid": "ddb40cfa-ce54-45ba-8a5b-1ec4545f8c00", "value": "newV(105-3-2123).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5785f9ec-503c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694393059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393059, "uuid": "e048a81b-2a4f-481c-9878-7c02b5afc98f", "comment": "Malware payload", "value": "391298d133c097bc3ab942651550ea6d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393059, "uuid": "4e1e99bf-5e37-428f-93df-01665c3a701f", "comment": "Malware payload", "value": "e3d9f8ba97638457de7a931a527421bd4390c055d302968b1e17fb998dc08937", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393059, "uuid": "d8c410c2-73e7-4fe1-95fb-a10f2131729d", "comment": "Malware payload", "value": "2b5f651e5830cbda30cbff223966ff48f9f57866", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694393059, "uuid": "5d613344-79c1-41f3-ac44-90f37037e410", "comment": "Malware payload", "value": "913b6bf2205b6333dadd25a26ac99d07f0bd49ecf8721cbbfdb07e5b7efe4cca9a1d607b7ba238672b29ae3487421bbc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393059, "uuid": "d5ee2576-3167-4ea3-9c09-234bec850578", "value": "T11EC40243BD54A9C0DAEDB2B0FD297056D4FE1136D0B683D81D4F0CEA58E3A82624DC9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393059, "uuid": "71298735-2e9e-412c-a5b8-2ccec66fe2e2", "value": "12288:yjmo62eo0K0bLZeOfhBfkYbj1Gf/mnCfmm8N39XbGtkRg40F:yjmo62hb0/ZeOcRVuZDRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694393059, "uuid": "b09eada0-9873-464a-8533-6c17e3c83dcb", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694393059, "uuid": "69918bbe-4a0a-42e1-8c75-c8e05cf74a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694393059, "uuid": "a6004f7f-aacd-4428-a276-79a4f3953413", "value": "391298d133c097bc3ab942651550ea6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f48ef2a-50ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694441202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "d4fad767-58b9-4f1e-a0e2-7cb921d175e9", "comment": "Malware payload (AgentTesla)", "value": "90a7a6f5055c72be73c8fafd81fadd6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "c0d2bf15-1c47-4d03-afa0-fdfce47c924b", "comment": "Malware payload (AgentTesla)", "value": "e40506111adf97f7a4f55f4340edd6c6a658ab500dc56d502b19198a16dfc8e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "d724e7bc-a5a7-48db-8828-4bdf09cba2ca", "comment": "Malware payload (AgentTesla)", "value": "1f3c6d02fbef83ccade1a680057c7a19c83d3930", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441202, "uuid": "10897e88-322a-4cf1-903f-4d112d6ad299", "comment": "Malware payload (AgentTesla)", "value": "da87e3060fdbd482b21a4c82b37648a9989e1c648b9ee130f23fbbd8585b820541987044a4eb2f000b1c0f6ed1b81085", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441202, "uuid": "a41134c3-608e-4ca5-8675-81157a13e103", "value": "T12AF46A153384EF62C25F11B5D4A382F45337AE00EC829BE776CCBE69B9B229D59512C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441202, "uuid": "0111209f-d34e-4259-a230-d98a78812cbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441202, "uuid": "31fae594-e7ec-49ce-9361-1655bacc1696", "value": "6144:ZruoX8PReYOoRwVTxQSzd9OErBexi/uIOuOSifjlAQI3SxQV/zzB634FP:wVf6tDr0xETOpVrWQAbV7zay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694441202, "uuid": "b54ea17f-25c1-4bb7-a557-605dc71bef97", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694441202, "uuid": "5f3da2cc-5161-4140-823f-fbec759a202b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441202, "uuid": "86868f3d-349b-46f1-9f2b-b01534dffeef", "value": "rQUOTATION_SEPT9FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f7f118-50aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694440227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440227, "uuid": "e391dc85-09e7-4909-bfa1-4a4f4d4daf13", "comment": "Malware payload (RedLineStealer)", "value": "b4013992181b3adc5a30306bcee4a3c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440227, "uuid": "dff154cd-fe37-478d-9b92-f979a1b9aa40", "comment": "Malware payload (RedLineStealer)", "value": "e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440227, "uuid": "0115b048-66c8-413c-bfd8-04cfdd8cfbfc", "comment": "Malware payload (RedLineStealer)", "value": "20050cf3d49b3a005afb3d1612c5cedb6247dad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694440227, "uuid": "665cc1df-d418-4894-a69e-774035bf0557", "comment": "Malware payload (RedLineStealer)", "value": "0ce0c1929aeeddee2362379a0775670f600f34459a6f73a899ada678019539b7c304ab5c7560e1e685b4e945f9c26ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440227, "uuid": "8c543ce3-42d3-4956-90fb-15a16584295e", "value": "T17E651201B1D2503BD5626736090892B69E7D68300B75B6EF63D81F7F8E323C3BA76925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440227, "uuid": "593f1a52-6b60-4bc6-b778-c079816a5793", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440227, "uuid": "d6eb3e0b-1269-4411-99b9-d17fb186a8f4", "value": "24576:oXSiH2vNZFofU/QD4CprDoBrwh0Nho+wqR4PEfaW1tYhFR+0volAnLqTmh+s52:FibU/ErDoBshIg6p1tUF/vdGMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694440227, "uuid": "8d853a0c-cbdf-4f47-b1cb-6c423dd728ea", "value": 1513472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694440227, "uuid": "86c14d4e-28d6-4af4-ae81-2e070cf8d14f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694440227, "uuid": "ecd6d516-679e-4974-af03-a0023fd0211f", "value": "b4013992181b3adc5a30306bcee4a3c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdccb229-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438757, "uuid": "e8f641a6-83fd-4b72-ba28-6bc9ebc1fc74", "comment": "Malware payload (AgentTesla)", "value": "178db0528331d0926dbf8857d6d9117d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438757, "uuid": "1a6fd70e-49a0-48e2-8d06-4d8b951dc3a9", "comment": "Malware payload (AgentTesla)", "value": "e42d9f9310abac0d0db25c944a343ecf1c6ad5f62b84fe03d7174ac116a18340", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438757, "uuid": "317e8dc4-3174-42d4-b002-aba202604f3f", "comment": "Malware payload (AgentTesla)", "value": "d190327dc6d5decf4eff4301d59187f1e0d31860", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438757, "uuid": "690f8156-a565-4c69-8f9d-829910a36a8e", "comment": "Malware payload (AgentTesla)", "value": "bdf4534a6a6a9e7192934dfcc6f8aff0b1b36cc25294f496348661e5c0af07857829c67e03253d800ce8df0774ac2e3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438757, "uuid": "26ec1c0b-4eb8-4939-afef-1a37e29a6f5c", "value": "T14034FF027E48EB15D6983D37C2DF6CA413F2A0C70673A64BAF48AE6529413476D6E37C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438757, "uuid": "e96e3203-841d-4399-8fec-258816f9beff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438757, "uuid": "29500023-f3ff-4e0b-a6a7-8a90ddb24914", "value": "3072:mt6SFBF9Bhu2zYqfbVd6rUQB2btitFioKx3k:mt6SFT9Bhu2xbjsBKi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438757, "uuid": "8e029d6b-574c-4fe2-986b-6ceffd1ce43e", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438757, "uuid": "793fba38-89ca-4752-b398-229e54375f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438757, "uuid": "b68c73e3-68fc-41d6-90bd-65ad206c1373", "value": "e42d9f9310abac0d0db25c944a343ecf1c6ad5f62b84fe03d7174ac116a18340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cb8c59-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694450449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450449, "uuid": "09927c3c-c8ba-46f1-942e-52ae084ec159", "comment": "Malware payload", "value": "339e9c2c73f211608130a35a0c498522", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450449, "uuid": "8c3fc6f9-23dc-4b50-90c5-bdeef9b3997d", "comment": "Malware payload", "value": "e5ee874bd59bb2a6dec700686544e7914312abff166a7390b34f7cb29993267a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450449, "uuid": "228f20e3-0f63-4358-bcaa-f7894f9f7550", "comment": "Malware payload", "value": "098b9a6ce722311553e1d8ac5849ba1dc5834c52", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450449, "uuid": "cf3929b4-cba2-490e-a36a-9e7321d35397", "comment": "Malware payload", "value": "e77c62a53fdacfcc15abaaf220a4bb9fe6c064db229f0ea20d25423873992d38be8b8c2a683490bfe253ed3a4ac1f120", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT35", "colour": "#DF9392", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sponsor", "colour": "#FA19D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450449, "uuid": "df48235d-c013-4888-9e1f-55df0f77dfc5", "value": "T1EA948C117856C032E56055B11E7AFBA185BEB9348B7145DF77C40F3AAE202E27A31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450449, "uuid": "e30afa02-ce9c-405c-a110-f93edad1bf13", "value": "99622c602eea6a22e11d0c5884f7ca59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450449, "uuid": "a37be80a-ad6a-4cdf-aafb-fc75b8f7d42c", "value": "12288:3eSJGtRRq12K9DvnxwwiaRaBNZY6OdW6A9rZu0IY6luGSVS:ZdTZ5DINZYBxChMpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450449, "uuid": "1133d366-c43a-436f-9df2-553cd6b03d34", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450449, "uuid": "3ba57108-2da4-461a-83bc-6b1da886983c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450449, "uuid": "29e57075-ff34-452f-bdca-d2c804650a9d", "value": "systemnetwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c3251f-50b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1694443840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443840, "uuid": "ee4896ea-a167-42ea-a612-f9c4b324b8d3", "comment": "Malware payload (NanoCore)", "value": "8cd95ee6d335088255f79db2579e8a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443840, "uuid": "a1d50efa-2146-44d9-bdb0-f2f58fc650a4", "comment": "Malware payload (NanoCore)", "value": "e635ebc10abe8c2491474b6f96430958c2d7d5c4702b395e4695b37582d1670c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443840, "uuid": "692fb2c9-1e8e-415d-8285-d4498759eeb6", "comment": "Malware payload (NanoCore)", "value": "2b40c885ba8997c5523e2997190e5e92f49ecee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694443840, "uuid": "216ea3e8-7f4f-4ecd-b632-c29f8baa4d34", "comment": "Malware payload (NanoCore)", "value": "2fbed135e06d0d592ce15a128b7c165795cc6a69756d7e0aa7c5f7b0fadfa6870dd3f8fab92a06ebf94f36a82f55ce89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443840, "uuid": "26420e64-1f68-4eaf-b034-10f7568da699", "value": "T1802531B4A2DCDF11A038CD1DADD100A487235791D5BFA371E96EEF8528B205A6DCD3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443840, "uuid": "ab5bcb7e-4ab4-4e8f-81e1-f4949b09df4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443840, "uuid": "02d56ad2-fd6b-403e-b1a5-75895a31c333", "value": "24576:jxwANWdqNWdHqbk1wVzQ18abKwnHmRhNDfoFCKBW:6HdZdKbkOB8pbKwGBQCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694443840, "uuid": "eed993ad-4a77-47b9-8f12-8121f37c355c", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694443840, "uuid": "c87ee395-c06d-45b6-93a3-f19fdb37c37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694443840, "uuid": "ae04a865-c7e0-4531-8e85-9a5f0fbade8c", "value": "CI and BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a616e0-5075-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694417612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417612, "uuid": "e541965e-ff6d-4f9c-b951-f1c1aa839f2d", "comment": "Malware payload (AgentTesla)", "value": "213dfbf675d022ee6fd166e33ca49109", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417612, "uuid": "245051bf-44de-40a1-a494-f0713c717833", "comment": "Malware payload (AgentTesla)", "value": "e665c078835904e48daa2a64c901b5c9a22c3ba292f80d4e718e3fc88b26a2fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417612, "uuid": "1adb3731-c823-4a7a-9c9d-1b405f4f024c", "comment": "Malware payload (AgentTesla)", "value": "e0ceeeeac7904c2f634972962aca1c46182ae574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417612, "uuid": "0d605a5a-f412-48ef-8061-28c81a8bb43c", "comment": "Malware payload (AgentTesla)", "value": "b52c4619f84b518314ee9b8ee42f4885cdd9be387a5181d23e8efb86b0de05314d72a3e8aa9804344c16b4a631616aff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417612, "uuid": "66a446da-8dd0-4966-a1cd-6e2fe15135e6", "value": "T169E4120AB6FD5712C57B27F024D1159147BA7916A572EB4C8DC330CB24B2BA60F82FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417612, "uuid": "45fea775-cb6c-4d63-a631-350ce741ee2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417612, "uuid": "05bca5bc-9ada-4c78-9ff2-894520d77361", "value": "12288:f3U2iNHkDwMD8fjWkq9EkgxY0VTj9DxH8v7CzKIb2IMKMvxLEGG:f3U1RkDV8rWk97hjHW7Ky4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417612, "uuid": "65d483f7-8a66-4232-a94a-ab442ddc9a13", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417612, "uuid": "86927a78-67c6-4206-b573-8174acf886bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417612, "uuid": "8e844a44-fab6-48e2-b24c-4cb34a106177", "value": "Credit Alert.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699e5f24-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450212, "uuid": "c5a7d1ed-32ca-4e7c-877b-9d62c8e4f475", "comment": "Malware payload (Mirai)", "value": "568ed885f0f82c1553119c823f31945d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450212, "uuid": "3fab4795-17f3-45b1-b67e-722f8e87fc47", "comment": "Malware payload (Mirai)", "value": "e68731ddc147c72f8f14627e9e18951a04e88b49bc965fa5fa1b5450920bd704", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450212, "uuid": "136096bc-858f-4fb3-8034-1ec74502838e", "comment": "Malware payload (Mirai)", "value": "08589926008634e9730c8192dcace0c1cfe7cef2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450212, "uuid": "d09cdfce-33b1-4117-ae99-e7f02d229dc0", "comment": "Malware payload (Mirai)", "value": "629d6ef0c42ca5ab70770f7717e3335266dec1912b4f1020c640b484dcdc3c6dde4e1eba7cf861b982af80f71e4ebfff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450212, "uuid": "ac5a2d4e-0368-478f-8c54-d5183206028c", "value": "T1ACA3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450212, "uuid": "04ab8dc2-6b9e-44b2-bf48-cdbe5eddaaf9", "value": "3072:wW8FUmgujld6Mkxm6AJ+4f5HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f5HmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450212, "uuid": "ebd9f6c9-e357-4300-a1fd-f89e4e0587a9", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450212, "uuid": "a6448b3c-7b44-4dcc-82c1-69da4a3e2e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450212, "uuid": "32fea49b-b44f-44c2-9d25-43d4b1bc1323", "value": "568ed885f0f82c1553119c823f31945d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb113b6-50f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694472952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472952, "uuid": "f34217af-8c24-4796-91a4-d2d053fed743", "comment": "Malware payload (Tofsee)", "value": "a31209f3aebdab46c93c08cf18ec2ef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472952, "uuid": "421137dd-99e6-4cf5-9fd1-9f51f4c4f8d6", "comment": "Malware payload (Tofsee)", "value": "e6cbc93d3d96f32c0533c52a5259fcfeaa1e5fc93ce8316d9cd3d5162b45433f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472952, "uuid": "7d50647d-dcbc-49a9-a8be-cdb0acd36d83", "comment": "Malware payload (Tofsee)", "value": "e5f528af4a4388eabd33ac561ae2f91687a5beb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694472952, "uuid": "2d8c0986-e8c8-41c2-bab1-0a4bd47c10ba", "comment": "Malware payload (Tofsee)", "value": "20739f4b611336f4590b4098874999e92b330e7f4e69a5a5ee8e981d1055393b2e3237b26879b168f5d71c9144906a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472952, "uuid": "6c7138a5-9ca5-4e82-ac13-ec0a252a3514", "value": "T128544C7392A17C60E51EDA329E2E86F4371EB560CF1977AB22586A2F07B11F2C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472952, "uuid": "6f05b9e9-61ec-40bf-b623-2de4c76c3a6d", "value": "fd6dfb11bfd672e911229df79ae69bc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472952, "uuid": "d37b9fce-6c46-45cc-9fa1-d9ee1a513528", "value": "3072:4gUmjPAoIUJ9zI4H6AX5wWB10EbaXvIPy2yXcBzUtnUmJ21WgUqF:5H0oIUJ1I6w01QXsyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694472952, "uuid": "2ba9535a-b120-4406-b8d7-967ea5902960", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694472952, "uuid": "88242ee9-e33a-42f4-8ece-32d8e7ed8a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694472952, "uuid": "4e1ffb98-fd7b-44cc-93dc-4b83ff2864d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9351a9ef-5076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694418070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418070, "uuid": "ad045552-2335-4d1d-ac5e-7eb59699fab8", "comment": "Malware payload (Loki)", "value": "b77aa2bc69878f46a5a1d1e2db34ed77", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418070, "uuid": "80e7223e-7736-4f62-904e-e28e4acd5370", "comment": "Malware payload (Loki)", "value": "e6f462db9f24f9257ab51ffbcf59f2ff4f0f184b0e891e58ecb1a23e31d05c5d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418070, "uuid": "d5780f11-8d3d-4f9c-9871-f4ef6eb1cf5c", "comment": "Malware payload (Loki)", "value": "b49c4a6768db8fb2640d8c41364caada4fdca421", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694418070, "uuid": "d9d91aea-330f-48ca-9c84-4ecd7190873c", "comment": "Malware payload (Loki)", "value": "f61cd151cab758794b40474bff163bc847c8fdb0fe571507cd7ff0c7548fcd0e757380cbd77c1665e3f3c1b8276ce2aa", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418070, "uuid": "14be6068-1cb5-4aed-a7ac-c8f61d36d278", "value": "T1C3B423C771C8F13679E85BF88039E84DEB394BD269F995C820DF7C6870E5150ACA2369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418070, "uuid": "e1be02c3-b85e-43b0-a8a8-f0d6356dd209", "value": "12288:XO7XEgw0gyCmJI4+CT9yVfd9EQyGauqnXjE/ipZY:gXE//yCmJr+09sy/GatEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694418070, "uuid": "f58d068d-be32-4dcf-8191-b1b5d1499ac4", "value": 504074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694418070, "uuid": "bf3843fc-9476-4786-903d-f92e34eab190", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694418070, "uuid": "68a51890-5f93-49c9-bf05-5f01804fd3b6", "value": "Proforma Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90a0d65-5097-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694432280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432280, "uuid": "b0c1bbee-6c06-44e6-afb1-a988b03eabbd", "comment": "Malware payload (AgentTesla)", "value": "237a449fc9ab80eeca727e42a2c8e40c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432280, "uuid": "8ee05427-97bd-4a5a-98d0-47c3d1b0eaf7", "comment": "Malware payload (AgentTesla)", "value": "e6f70865ccf42125c17b8b9224b87c0ddcf2559b2cacadd2ef915cdadaa4f552", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432280, "uuid": "22d6588b-4d05-4ed5-9d78-f48489db7b3b", "comment": "Malware payload (AgentTesla)", "value": "5f8968ea1468c37dd44416b25571fe9fb218d6e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432280, "uuid": "e3a3fe00-9192-47bf-8518-14ebbf36f314", "comment": "Malware payload (AgentTesla)", "value": "93f562388b7576fbb10a03ccd3acb82dfd20eeba37e5712cbbf7e4b4c63d47476f1b2d7f742976c681e12df155f8f9dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432280, "uuid": "ac149ad5-4b13-4236-90b0-7736de274ec7", "value": "T1C115E141338A46B2E83AD3335621E0034EAEAFD56BF1E51F1EC5368917B2A94C6C7717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432280, "uuid": "1c9c5dee-600b-4e90-8292-1cf3b4528cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432280, "uuid": "487b5851-109b-42da-8ccb-e97e766124ed", "value": "12288:oku7Tflg3wX4fBYrak58psw/psSSpZDbqUUuys+9kUxPWva5/wp5renVTSTgvxwr:ofi37p9n/psSeXqUUjj9kOOvaFc5SVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694432280, "uuid": "e45a54e0-95ff-41a4-b988-25f5f7b4e57b", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694432280, "uuid": "2fdd6364-1448-44e8-b4bf-1220a2f8cef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432280, "uuid": "a4054125-037b-4842-b66e-adee44b44d76", "value": "New Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fca6645-5075-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1694417473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417473, "uuid": "2270d4be-0f25-46d0-8627-d3cafee32df2", "comment": "Malware payload (SystemBC)", "value": "fcf0a421151e29d929ae50ebecc1e2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417473, "uuid": "849151d9-4663-4d3d-8b11-dadea7a99368", "comment": "Malware payload (SystemBC)", "value": "e6faafc43d70b4901c39f0f6f9668e613c52541608166726bafa011facbaa653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417473, "uuid": "b400501b-1984-4ced-a7d8-657ec368719d", "comment": "Malware payload (SystemBC)", "value": "a9a2569ca39c082c182c3f88644e770059039082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417473, "uuid": "313ab478-3c16-490b-934d-65f47dc5badd", "comment": "Malware payload (SystemBC)", "value": "02173241e0affc9fb6be8dbdd9e96618e47308b9ee3021c89dd3f2135ddc70f03306b0d2ca97d53b9e8e93d6fab150a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417473, "uuid": "4a70f9ab-015d-45aa-b4d5-7cfaf438f230", "value": "T12E74D02F4A862FB3C43C473B8452105517F1CA562663FB87AEC910F98BF7EAA4F41642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417473, "uuid": "0fab5c57-c5c8-4e9a-be97-e0c5f5ad22c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417473, "uuid": "6ad44839-339b-465c-a6d8-65e4ec5256cf", "value": "6144:y7toi32+SZV+x+Eo5iNUuLRacE9/DOBa2GhNoFDy1d:y7Cw2+SV+xFo5Q61ga2iNoFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417473, "uuid": "86b8a6a6-c1d4-445e-8891-e612e48574ae", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417473, "uuid": "97d7f612-2b77-448d-b224-8e6acd4f6120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417473, "uuid": "353c171d-ac2e-43f0-bc38-9579dd783daf", "value": "fcf0a421151e29d929ae50ebecc1e2a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa72f239-50a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694438429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438429, "uuid": "f119a6b9-4c8b-49b4-9cc0-3cbda6b02683", "comment": "Malware payload (Amadey)", "value": "213e4dac31023461bf99705827da3447", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438429, "uuid": "cae54c41-75ff-417d-ae11-07793748dd13", "comment": "Malware payload (Amadey)", "value": "e738064fe074cff62ccd60bb7ec588302f41a6b298e988d8d5183119ec9d2bf6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438429, "uuid": "8c367d17-484f-4733-99e5-00776c2d2b43", "comment": "Malware payload (Amadey)", "value": "633a107c31c53714669cbcf013b7e9f7b99b343b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438429, "uuid": "5f41b744-4b38-4e56-b9a9-00ae505dbf23", "comment": "Malware payload (Amadey)", "value": "4efc0bdc49ef69e2061a8823530f847cfb204358466410b3e8e30691a280a4d2af836c6dd7f24012317f9bb773f4d4f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438429, "uuid": "a4ce7728-1650-432f-b7fe-7bb8b9e5e016", "value": "T1C2647FD353D06871E52246BD8E2AC6FC2A1EB8604F5977EBE3546A2F297C1E3D132305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438429, "uuid": "edef5b63-118d-4c67-bdfb-6fcd28b79cf4", "value": "956d4bfad20bab24e49b479aaad17e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438429, "uuid": "163f26b8-ddd2-418a-82ea-341117b05749", "value": "6144:FH5JsLtwNdTNoTMULsshT5iaJZDLq/mdh:LJitwNdT0395ftqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438429, "uuid": "2eb80273-89cc-49a6-87f3-e5125da3c0ab", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438429, "uuid": "85f85f2a-4d3a-40e0-a03e-c6ca33d566b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438429, "uuid": "1b3c4b91-d152-4901-a6bc-d0cf300d0583", "value": "213e4dac31023461bf99705827da3447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c6746b-5091-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694429424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429424, "uuid": "c1b55435-12b8-4ad2-8e23-8c044f460c97", "comment": "Malware payload (Amadey)", "value": "c027af5a65d2c3a9a868c5fe8620e9c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429424, "uuid": "5ef453d1-0129-4378-9210-cb5d0bf11c63", "comment": "Malware payload (Amadey)", "value": "e751be9b16f356cf50de310450ce44304888686893b6f635f568b7883d8d986a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429424, "uuid": "7e297fcf-930d-4e20-abaa-8e751d1534a9", "comment": "Malware payload (Amadey)", "value": "8a92312c8f62b1a082adc386c4c080234803c257", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429424, "uuid": "3c7505ed-3599-4d31-8d71-5e25d164c810", "comment": "Malware payload (Amadey)", "value": "3181a2f2d7839cb1385b76ae812bbf0b0653d6282f549cdf5946d6068a00f042e342b68470d3d34cad7ddb21cb2ebd30", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429424, "uuid": "f7e643fb-ee59-435d-b506-56b0d1c452ed", "value": "T139349D1174D1843AD43215360DF0FBB65A3EB8600B615AEFA3E41F7E4F302C1AA75B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429424, "uuid": "040b1bec-3188-4e04-bea9-2e69e1b0cd36", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429424, "uuid": "1488988e-c2d9-4b6f-9f9c-a4d5c0977602", "value": "6144:7DoUjz6DCGbAR/VeDC1tAOCcCefkh6urBiIg:7xjzaC+UjJ1xurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429424, "uuid": "ba42775f-c2d0-433e-a39f-96da649c737b", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429424, "uuid": "5d3f4c8d-936c-4b55-a2a5-3fbacb27a257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429424, "uuid": "c4123920-c6de-439f-8aeb-d1af746e1418", "value": "c027af5a65d2c3a9a868c5fe8620e9c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008a77f4-5099-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694432856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432856, "uuid": "efeabfc3-c6e7-45a0-b53e-bb77d005d810", "comment": "Malware payload (AgentTesla)", "value": "5ba9dcee66ba1979e0bd2c44f3998979", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432856, "uuid": "a1ef27cc-afc4-414b-aa45-dc8d327d1e65", "comment": "Malware payload (AgentTesla)", "value": "e7d79400e90812164e273153b7977bbc98e03eaa281e0ea4130decf868af6983", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432856, "uuid": "13a25155-e204-49bf-bdb8-e8fa20e972f8", "comment": "Malware payload (AgentTesla)", "value": "ff4183e155b8fd79112d35cf088bf6ac9af27331", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694432856, "uuid": "2393e43f-65c3-498b-a799-34bd82f6ff0e", "comment": "Malware payload (AgentTesla)", "value": "79fb76c526f2117bfbaa43b21ebc981aa42c7c50ba0e4ffe27fd74a01b45082a4bf44bc4a729a46b5f2b1ffc90ecdf98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432856, "uuid": "27714985-8308-4cf0-8722-ebf209c351eb", "value": "T195D4335F3546A1A5DDAE3F1EC18E6FAEC5DC7FAB40881F315C0C106E3AB8CA585A4385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432856, "uuid": "a8c6901b-916c-4f63-9458-cb38c4be7d73", "value": "12288:78yF7Ytvci2LGZUmv+6ECQ8m5mkns18x9562WYNmZlr3jj9E08LvoLwp:75OcVLG/N4rsYHU3Xjb2Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694432856, "uuid": "6ab609b3-c243-4255-aa0e-ec3fd8cd05dd", "value": 616769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694432856, "uuid": "e00c502b-a283-4591-a3fd-3cdabdd1e7c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694432856, "uuid": "17c76a97-3e9d-4784-a010-96ac6879bd28", "value": "Order 4601207214.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f940acc9-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694416523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416523, "uuid": "4295f1b2-59b1-4085-a40d-2bb8ef5e24f3", "comment": "Malware payload (Loki)", "value": "281a2f7b196f06daa932a018b9c9b92f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416523, "uuid": "e986b665-eb81-47b4-b5e6-15fca276dc0c", "comment": "Malware payload (Loki)", "value": "e8109f29c5379545d283223b4c4a362e838804beb4a2e1c2facb0ad25b1a6735", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416523, "uuid": "5fa744a8-0fa7-4f84-9647-a3a55cb08162", "comment": "Malware payload (Loki)", "value": "6b24c8574891540cff7c937899ba2bef0905e6da", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416523, "uuid": "cd484351-47c0-4f48-a713-de68d7146ecd", "comment": "Malware payload (Loki)", "value": "82928eb91c43b6d905b2b94e7731c85db8e157366ce42bebad1b3a83ca16a5d35fe6e51d0e82d8552f2a1e11d8f957b7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416523, "uuid": "7bc5b257-0589-4d06-8826-5c6623556478", "value": "T17AC423D013E16B0E4A8F497DB29F9D12165A387239F446A04291C16EC24BB18FF3E7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416523, "uuid": "83c08d74-7aa5-43e4-98cc-5e85828f9681", "value": "12288:gz5JNiukIb9/O5VSEVShYhAb6Cs1+ODAQzNjaxVwtxe3QuOS:gzfcXtaYhrCb4xY2xe3QRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416523, "uuid": "ca2e44b3-e73b-4af5-a454-e9a66cd8ed10", "value": 570893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416523, "uuid": "ab7f33f4-5636-480a-813f-0b0d46fa9258", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416523, "uuid": "37f12fdc-2fcc-46e9-a7ab-9256962de3ee", "value": "Purchase Order (PO) PO 00197086.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ef7521-50a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694437829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437829, "uuid": "159be27f-a3cf-41a3-8b76-cae475b9932a", "comment": "Malware payload (AgentTesla)", "value": "6d9821bc1ca643a6f75057a97975db0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437829, "uuid": "bb36c256-d8da-49f5-8408-6dade316d6a9", "comment": "Malware payload (AgentTesla)", "value": "e84683ad3b1f9f2bf5fce7d0da4ea6e203da12420d2e1f9db5a8d888e9878ec3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437829, "uuid": "75e4c457-b684-4cb6-b840-d683767dbeac", "comment": "Malware payload (AgentTesla)", "value": "4eb387439fb611b0eebb86f27e346c9138dababb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694437829, "uuid": "5de61c3a-4c41-4bbc-8a3f-174cb8f64183", "comment": "Malware payload (AgentTesla)", "value": "94d8214bdc40407b11beda80279811ccfebd4a1981ed4aee79e73385518f56127facb0c0ab58f22a0c52930bf6522a30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437829, "uuid": "910237ff-4995-438a-849e-c8e02fc39ecf", "value": "T1B72523171E34ECA8C1F0173C7A2D2C275EB90FE5CA2A755E53B631EB96096C14D0B8AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437829, "uuid": "9fadf2fd-035b-47ce-86ff-208163f1f431", "value": "24576:SvrhwboCGbrIR0DCX3MNinTqkLd0gyen99lShK:SyknrIReCVTfzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694437829, "uuid": "9fb913f4-0e63-4295-9e13-7aede95cfb3d", "value": 1041113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694437829, "uuid": "ee475521-3fa5-4fd1-9453-17ba56e0b065", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694437829, "uuid": "4bf725af-dc5e-429a-b351-afdb11608c31", "value": "Documents and Details.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf9a254-5071-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694416044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416044, "uuid": "4552712e-6846-4b3e-bc52-fa79cdc6017b", "comment": "Malware payload", "value": "a523a20f9993d562a1e2761d930cc243", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416044, "uuid": "773d025e-2943-4a38-8f39-5d6042de44f9", "comment": "Malware payload", "value": "e8c944b9a94b79f2d5a2783d1c20a555d66e6912c077a8a47617da5f0c5caa78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416044, "uuid": "fd7b2bad-be92-4b9e-be1b-4a24c7478c86", "comment": "Malware payload", "value": "24ee7607316c11e285898d0b169f7b0c31f64589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416044, "uuid": "adf47521-4f84-4fea-8a88-a4ff108669b5", "comment": "Malware payload", "value": "672aff5eba17582a3116e8bc1d76aa2403eea47ec5f6201dcb4c5cd3c54c84dd90a2bf3b3c9370f0c44bcacbeffb62af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416044, "uuid": "a566d949-d3f1-4437-bf58-9aa697c5c30f", "value": "T1D30701617295842BE6B31A706A7C869A5538BF620FB194CFB3CC2D2D1B745C24732F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416044, "uuid": "7570d60d-f769-487b-963e-d139fd4ca151", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416044, "uuid": "ccb19122-78b9-4d71-81ad-8e6b5a2fb089", "value": "196608:0fl0kYa0SgYavcpMFYeBL/pbtc+swO+7moMVzMvWHpxh7HxMSKoTXKsKIwiTs1v1:mRY/0GrKI7moMV4vWMSKUCsog+wx+w23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416044, "uuid": "ef5288a6-2781-4d7b-8ff3-b6c34a6f95f5", "value": 17705296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416044, "uuid": "d959f7fb-5175-42a9-bd6b-cae8b6b16a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416044, "uuid": "bf731eac-5c5f-4e91-af6e-e40656f4ef31", "value": "a523a20f9993d562a1e2761d930cc243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af37ff37-509f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694435726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435726, "uuid": "70092cc5-5ee8-4e2b-bc90-314d33057cdc", "comment": "Malware payload (Amadey)", "value": "489fd33d12e4c14f442002591448aff1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435726, "uuid": "41b20709-1fd1-405e-81b7-7b1da4032488", "comment": "Malware payload (Amadey)", "value": "e8eeee82652dab54ef95447a334821fd471fa7bd37b07d62dbaa1e4106cc27a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435726, "uuid": "6d7d27e2-04c0-4e11-8422-ffc2c56b2d22", "comment": "Malware payload (Amadey)", "value": "aa03a49be7e162378b2e658e55c87a979062b7bf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435726, "uuid": "ff040813-46be-46c4-ae2e-2784d23a483e", "comment": "Malware payload (Amadey)", "value": "52996ed58e27e44b45fbba82d34f65b07dfba90bcf8ed05af2ec26529c1490aabae93fb131e0cf4421145ad75922381e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435726, "uuid": "1a838525-c5e8-437d-b405-79fa0b81a9c3", "value": "T1336512247193C072C03574355DF9D7F40AFA79600BBA3D9BABD40E5E0B63282E6749BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435726, "uuid": "b96d6eac-63b6-455a-881d-bb81a1f2a9e4", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435726, "uuid": "3a45710a-4c82-4f74-83c7-aec4e8466391", "value": "24576:ZlCCJjGvawYf7niMKNxZzWYBgbopuC928zaVzPGSFjGic3dpGf/tQ0Cou1Hg:vCCJjGjYGzBgspl2GSFKF3ra/Xm1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694435726, "uuid": "61ffee59-8029-4dab-97e3-854e8597382f", "value": 1471864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694435726, "uuid": "587cf337-2e27-42de-ad8a-397953f1d093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435726, "uuid": "0c89ac30-bc6d-45fd-9d57-11d3c5cb112c", "value": "489fd33d12e4c14f442002591448aff1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecee8be-50b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694444557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444557, "uuid": "16390a7b-83a7-4180-959a-4325c822899f", "comment": "Malware payload (AgentTesla)", "value": "506031ad975c35d25c7978894374f239", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444557, "uuid": "4a8e6ad2-55ce-44ac-a2a9-8732a1530c22", "comment": "Malware payload (AgentTesla)", "value": "ea3ab4eb7852c867c5f4f301e0523d5cf3557c9c73e3fb7f4b0b776cd1425e6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444557, "uuid": "c8392841-6aa0-4a40-82a0-6c4a1af38a10", "comment": "Malware payload (AgentTesla)", "value": "3b3c3c2b9954119463f3963c432f20dce1c4af53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694444557, "uuid": "e8042edd-d595-4ccd-abb0-3aba8f4da4bf", "comment": "Malware payload (AgentTesla)", "value": "3d98028a1648b63a93b9ab65378c307d83d8ba56ceb9a509b1cde73c128f38fc86156a0ccc1e6d7df60b318362fad13c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444557, "uuid": "71094833-8c93-4718-a054-b0ddc293a045", "value": "T14EE4125A37D84F24F5BC5B7E693050844BFAE8539B26DB1BBEC041C80BB2F905792A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444557, "uuid": "cf1b3d5c-3b2a-4c7b-b27e-b95c6065c747", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444557, "uuid": "346525c1-33bf-4cb4-a1af-aec54cff0899", "value": "12288:e7Cw2+SV+xFo5QN2iNMLnGnMvnyJPuBBS733wWapZHNg:1wxSM3N1aLGEnyJoBSL3YpxNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694444557, "uuid": "96a0c842-d247-4042-85b3-b41caa314f45", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694444557, "uuid": "72411190-fefc-4e93-b028-8b0030ec95b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694444557, "uuid": "42b68839-501a-4216-925a-68337b91b62f", "value": "Scan Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba6f66d-50a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694438914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438914, "uuid": "75cf0ad2-0ba7-4269-99df-d8749b058089", "comment": "Malware payload", "value": "86aec1d77c3b004c38d5ee246499728c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438914, "uuid": "3d3f9095-708e-400d-aa95-fb49641b4864", "comment": "Malware payload", "value": "eaa4f4d4e90b308f6cda183dcaef8be9b8fa85404aa2635e8457d0a36bf7e46d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438914, "uuid": "65ed3fae-d31d-4e8c-8581-2e59225ffc31", "comment": "Malware payload", "value": "0b6c07ea05e33ea59e906f4a07eeb3d6416dd655", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438914, "uuid": "2bf9150c-19ae-40e0-b27a-9f5cd4333048", "comment": "Malware payload", "value": "87ebb759d8046a0d50bc76d7fca9074a61d33bd29583d9223283ee7229d3987cb55f72b15e9aa8fda4621d34688d67a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438914, "uuid": "7d961ad7-e84b-4404-868b-472e135927ee", "value": "T1E4159E313CD18532EEE210BA47ECB931896DE0B40B3A4AF75EC857EE87246D16B355C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438914, "uuid": "3f1216e6-c538-43f6-8716-1b4f08a30968", "value": "33ede84b4cb0967ffb7b14e9a46c056b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438914, "uuid": "9e854ba8-ef79-4eab-81db-0c003acb8941", "value": "24576:BlG682grdGA/7+AVkIk3T06zFrZi7rDh:w2grdGAz+KkzBFqDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438914, "uuid": "ba7e0895-d163-46da-b7c9-8d6119314cd3", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438914, "uuid": "6923223b-4169-4f0b-a980-b6577248b42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438914, "uuid": "410ee05d-b42e-476f-a12d-646b7f43b03d", "value": "86aec1d77c3b004c38d5ee246499728c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73941f16-5091-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694429613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429613, "uuid": "34ef9b8c-1e63-4799-8d28-7c2c6fde77a5", "comment": "Malware payload (njrat)", "value": "4c25aee4ae25ae4a2401d14b69571cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429613, "uuid": "80dc86aa-99d5-4a89-8040-84455ff67ae1", "comment": "Malware payload (njrat)", "value": "eb9bb147bf400ed4f60c12c56651b2a1c4653196a408574e1fa636a6f47eb5c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429613, "uuid": "db5abfd1-d105-4d5e-8dbb-e0c5bab58567", "comment": "Malware payload (njrat)", "value": "c2630194485f474d0a55e17fd0e59e60bd86b204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694429613, "uuid": "6b805115-1af8-41a5-a083-751ce191ac59", "comment": "Malware payload (njrat)", "value": "ed1ff4d6b9095283ae49a86005288cac564b37e42c57da1c34ed5160f7e43b313d7a74eb036d5dcd206d669e5a722c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429613, "uuid": "c3e2bab9-0814-4556-8750-c1de68652ac5", "value": "T1F9C22A5D3BA08162C5DF6BB40AB2D72102F2D1075A27EB5F4CD844FA9B773C14E819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429613, "uuid": "cfdd5c68-5ba4-4739-ba9b-c22544e99c83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429613, "uuid": "ee07eb07-9728-4efa-b42f-1f1a6557260c", "value": "384:vLd6yKwDeBC8GetHzCYe/eBY2OzRLTm3yilqr63hbJtFvGH:DLnDecUT5e/csEdFvGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694429613, "uuid": "712e698c-c099-405e-a685-5c686b50877a", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694429613, "uuid": "7f06bb2a-8e0e-438e-9ce9-08a06e90dcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694429613, "uuid": "74e1d977-d3e9-4deb-b202-f6c60f76e97a", "value": "bPAl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2625102-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694423813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423813, "uuid": "1bd44299-d6ff-4ba1-9f66-6942625e55c2", "comment": "Malware payload (SnakeKeylogger)", "value": "0546b0f6bd73cfc3b7e1e48dcccee3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423813, "uuid": "a42bdef0-7c41-4dda-a634-a9450e808df2", "comment": "Malware payload (SnakeKeylogger)", "value": "ebd0f12995682c7dce98a9de8e7105f7762bfc30a297d46634c67f0c1e420f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423813, "uuid": "f80a618b-a031-43db-89f3-825ed8889bd8", "comment": "Malware payload (SnakeKeylogger)", "value": "8c3101649323ac640620d4c49f7b2e5851dbcef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423813, "uuid": "4be46f8c-428b-4f7f-907d-fc81a0194469", "comment": "Malware payload (SnakeKeylogger)", "value": "6a99a32faae3531611a143fb7186aaa54ed9fc909117838510a7c4b31102a5300f2f9ae91e2cb787748d46b4b93ee4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423813, "uuid": "c3329bf7-022d-4997-a14d-34cb5279844b", "value": "T1A8A329A44B843A2FCA5F4735F2228204DBB5DD606113E78A17AC30E965DF3F9964B4F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423813, "uuid": "d1d63aab-57da-4e3a-b0d6-4f64f77acd86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423813, "uuid": "87a13f6b-99da-447b-9fb0-88789303770a", "value": "1536:nDs0oUevr+qCEd05zed8pHgO98zYJvbUbFElCKoqA:nY3UevaqCEd05eoHh8MJvbWFpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423813, "uuid": "4fe62eeb-d56b-4e79-99b9-4b3844b9bf51", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423813, "uuid": "7363b9be-4bdb-4b12-92a2-40b60bc2bc21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423813, "uuid": "4143031c-0d2a-4fc8-877f-b0bd1978c7a3", "value": "Rzkomf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2671c628-5086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694424759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424759, "uuid": "0cc75f91-9ae8-4b23-b037-a609148b7f15", "comment": "Malware payload (Mirai)", "value": "45cdb79446b6724ac70ae3e164fd4a39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424759, "uuid": "b2f36055-e282-4cbe-8542-c2c89c77aca6", "comment": "Malware payload (Mirai)", "value": "ecfc3afd0d161dd607342a6080fad0d2568eb95a4a4c0ba3b4be58f7c3446a23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424759, "uuid": "175bdefd-8aa7-414f-aa64-1769b905697c", "comment": "Malware payload (Mirai)", "value": "eaeecf8e12c2ab6d6335caec8bc3ccd09704824a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424759, "uuid": "fcf56487-2a07-467a-9214-41a4855869b2", "comment": "Malware payload (Mirai)", "value": "26d4e2f8eb06844a89b2660aa88df744863124e4e33bfb31f9b8c755feed82220c612629bdd71c882bd53a3e823d9904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424759, "uuid": "d4d2deaa-9075-4f8f-89c9-dead236149e9", "value": "T115738D31AD7A2A67C2D0A03B42F74775B1F2078E29A8871E7D710D4DFF24A60652717B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424759, "uuid": "938e7aa4-883d-46f5-9b10-33c640074907", "value": "768:X73NUXyoumJjXxoy9z0PITL9+NWoijuO/cgDxB8Iien69J4SG9O+PVmVZJSG:rdUXyVmJjXxoyuwNxD/3xUe69QdmVZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424759, "uuid": "1f64cdc0-985a-4bed-b8f3-2df37c3a7766", "value": 74800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424759, "uuid": "65f6a617-3c3b-42dd-ba67-7f981510cdae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424759, "uuid": "57483d39-4483-4692-857d-bb975f303d53", "value": "45cdb79446b6724ac70ae3e164fd4a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99376001-508c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694427529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427529, "uuid": "32b973d9-e3dc-4f4b-9adb-09d5fcc2d0a1", "comment": "Malware payload", "value": "40b277d99a3708628f921f6a0028c8c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427529, "uuid": "639b2b06-451b-4c48-b6d3-bd719abc6600", "comment": "Malware payload", "value": "ed23c4d73b91b03b92c9ec664eda40aa5d8f9e33eaf306545d823e11d905f564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427529, "uuid": "7077beed-311f-4b6f-bf30-308ceb73867f", "comment": "Malware payload", "value": "4f218b979808c9034ee4774376fad4e5724802c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694427529, "uuid": "68cdef2f-d50a-4478-b9a4-d6c24431e139", "comment": "Malware payload", "value": "1cf3f7eab7ca20b979300f6490d8047aa2e2791b264fffb23806dab194a6bfa40f97a75b0f2467c989ae23734568d060", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427529, "uuid": "a4263cf6-2b74-4309-a360-22c6cef4fce6", "value": "T183167D13729CE13ED0661B3A48779214993FB6602A22EC4B6BF6C94C4E356F07D3A747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427529, "uuid": "21712a17-bc30-4b33-9020-9dae059b048c", "value": "93f5471884271daf59cfa5995eaf37b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427529, "uuid": "a5c46050-1f58-41a6-a0e7-a6358f5d8389", "value": "49152:eu+W9FB8j1LSZpSg4H62mes5+8rhzg7cRtBpPaaeIvcahf:eiijBS1estzg7iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694427529, "uuid": "24c6863b-f25c-40a6-a22d-022aa59ba5d2", "value": 4416000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694427529, "uuid": "ce5a9f0b-53ce-4985-b663-2dd9081fbc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694427529, "uuid": "4bccb608-2bd2-4406-8ced-d96c83dbc5ba", "value": "40b277d99a3708628f921f6a0028c8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466cfb79-5038-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694391312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694391312, "uuid": "ee03ae64-2ae3-4715-98eb-62fb5b909b29", "comment": "Malware payload (Amadey)", "value": "3c973dba3595055f0cf923fde6ab21d3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694391312, "uuid": "b36ebf0c-2ff9-469b-81c3-7de6dfed02dc", "comment": "Malware payload (Amadey)", "value": "edcade63346f48f03b9420c18c0b9c2246b72ea5ea29baf58abbb7fe8b8ce358", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694391312, "uuid": "9ea23f2f-513b-4390-b8e6-91ffa9fdeb15", "comment": "Malware payload (Amadey)", "value": "bea56bf3b1f6e9b5901faaa0d78fa7bbd0110e3b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694391312, "uuid": "2c424186-74ca-43cb-a7dc-e44c61d44801", "comment": "Malware payload (Amadey)", "value": "9fac0d7ac38564994e541599d638b9f3a8a9373a15a73b3b76253adec886d706acf6c621aa4250da7eff0ada78d8af08", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694391312, "uuid": "ef32d6f7-a043-41c1-95a6-46f9ace7383f", "value": "T125651247B4818476E47719320AF5EF75AA3EF96186920CEF93F90B1A4F30290F670667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694391312, "uuid": "2ee0461d-083a-4460-8b50-c38ce760019b", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694391312, "uuid": "d8b7abde-3e0e-407f-8f7b-76cf11bb1ca6", "value": "24576:iV1CJetCTObWf5Muu9IAxufpTy7XdJIymGlcwC9u+nOT6OZNxEC3gLRYjBo0pGBp:i1CJetQObWf5Muu9IAxufpT4JN/w99bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694391312, "uuid": "c7cf31fc-b1b4-4a0c-9ebf-13c9da328b9e", "value": 1472376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694391312, "uuid": "3d2b898e-bbd0-47af-a115-601f9515e617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694391312, "uuid": "a4d8852f-7f72-41fd-8cd1-ad9714f35b9d", "value": "3c973dba3595055f0cf923fde6ab21d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa077b01-5040-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694394915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394915, "uuid": "ccebc978-b5a2-403c-a43e-7882fb404f00", "comment": "Malware payload (Amadey)", "value": "b9774d61471214999cdcc5a8edde74a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394915, "uuid": "29a2a44e-0210-462a-8a2f-effcbe8df266", "comment": "Malware payload (Amadey)", "value": "ee74da6cbb63a8e1f33c490358537559fa15855ebaec6866888af4b2bf46cc9b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394915, "uuid": "1121a508-983f-4251-a4ce-2b5192406736", "comment": "Malware payload (Amadey)", "value": "cdc975d1ebb925739d0a624bfd1a19e4b17848cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694394915, "uuid": "d8e76395-75bd-4c20-9519-20bff7569d3e", "comment": "Malware payload (Amadey)", "value": "740632d08c76e51ff76c0c106edeff1055118cf519103a72679a3fd6863d817c60b6fd5981db899c9af09c3f7f95cc80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394915, "uuid": "18f821bc-9d35-4a3c-b7ae-a51adb3d7e69", "value": "T1F9651219F5D19475DA611E3109A7E7706B3979218BCB88FF63AC0A7A4F103C0B923B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394915, "uuid": "c19e7303-2d84-4929-93c9-3f6cc31ce374", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394915, "uuid": "a7c55a8e-0785-4c8b-ab04-5632f09cbc78", "value": "24576:ChACJLZVkmfc1ozB8gATdK2gPRTCHrWnTTXOfaHBcNVaoevGKCk1mJ76GRtzuebh:OACJLDkmfPzqgUdzSOHCOaWeS8mNjXmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694394915, "uuid": "d690caeb-6e1b-4be3-9af0-405ab9f77a25", "value": 1471352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694394915, "uuid": "2e5d7f74-5f23-45fa-b751-00632a5f27da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694394915, "uuid": "39cda1fd-d093-401f-ab41-ff6a75af4258", "value": "b9774d61471214999cdcc5a8edde74a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dcd975-50ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694441730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441730, "uuid": "ddddb96a-fe14-480d-a73a-a54a0c0c5d33", "comment": "Malware payload (Amadey)", "value": "c7b6b83c40c52e87c031b9e8cbabdb3e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441730, "uuid": "9a095d36-2804-4505-9425-ba6c4cba4bfa", "comment": "Malware payload (Amadey)", "value": "eede7db2d8a8809d1c41b0268b49c2a1ae3e098b7872aaf8618170e492207e80", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441730, "uuid": "1bedad99-622d-49a3-a9ed-8ebef8666b0f", "comment": "Malware payload (Amadey)", "value": "ebb060519b682cca8b66ac3180ce6a81bec626d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694441730, "uuid": "c1afd160-fb86-4c8d-aa12-f5de12f3899c", "comment": "Malware payload (Amadey)", "value": "458b5fc2dce044cad161baf4da4af80f4fd33fb55813e07ff6eedcf2e60ca75988d886551eabf20e5d85885a08fd1e4b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441730, "uuid": "6562d29f-f1e0-4497-a9ff-717ae8f3108c", "value": "T1CA549D11B0D1C032D572153709A4D7FADA7EB9310B658ADBA7E81F7ECF302C19A316A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441730, "uuid": "e3dafe85-9666-4853-9a24-d1b2c27f5bbe", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441730, "uuid": "c3c5fdb2-b729-42ad-ad57-1b8f5c7c9722", "value": "6144:maMa2/KMiCQy4bwSjQzL9ois436xMhAOzb7De1vU91JKl:m62SMiu4Ms436xMhxbSU91J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694441730, "uuid": "52923d86-2576-4a28-93fd-aa0cbf5ba817", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694441730, "uuid": "855e090c-ba5b-453c-9720-178b2d016515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694441730, "uuid": "cee70fc3-496b-4fb4-a123-a96ee02a17c4", "value": "c7b6b83c40c52e87c031b9e8cbabdb3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336ac234-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694445397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445397, "uuid": "0be2c2fd-3204-4c07-b023-552065c1845b", "comment": "Malware payload (AgentTesla)", "value": "66076589f4ef49ee41eb91cb7a97613f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445397, "uuid": "54c982cd-05a2-4e4d-9dbc-9f02a77de3a5", "comment": "Malware payload (AgentTesla)", "value": "f04af5f108218262a199e7819aea9b956c321ff1c6c419d37d7cd7d8360fe20c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445397, "uuid": "55d71594-90aa-4cdb-9b32-650d5a53e359", "comment": "Malware payload (AgentTesla)", "value": "96d72e990efece95934df3ef1587b60d726dde80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445397, "uuid": "2b194301-a4a8-435a-8130-0e004b7ada98", "comment": "Malware payload (AgentTesla)", "value": "c92dd77dd5c0235441762afd715fa9c0972ca163b39870c672310bbe95a635819e6e9c30130bcb09a0a820160b1c5ebe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445397, "uuid": "bda3be2b-7c7d-46ab-977a-6dc7231430df", "value": "T15163466CD34F01A9CF6662379B264A4546FCBB3EF28051B5306C437933EE82DA12667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445397, "uuid": "6fec1863-9e48-4296-9e57-d2594b1c6c37", "value": "1536:CwAlR4NsGpM5OtOXwolxa2AE/47ZOlufuLYX:CwAlSNsGpM5COXllxnAE/4tOEfuLYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445397, "uuid": "99ea42cd-94d9-4bfb-8795-b255ae1c7958", "value": 66921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445397, "uuid": "9f0c9f12-9acf-478e-aefc-cefc8b78a34a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445397, "uuid": "9fa88eb1-f41e-4b58-ae3c-6e7ddaab8304", "value": "66076589f4ef49ee41eb91cb7a97613f.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2469734-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694438764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438764, "uuid": "a5750375-6e7b-4d5f-9b43-fcb654f6695c", "comment": "Malware payload (AgentTesla)", "value": "60ac188461ee638a8601baed27d00569", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438764, "uuid": "1bda1f4d-8a52-4eef-952d-62c58116f70f", "comment": "Malware payload (AgentTesla)", "value": "f04e7186707e0c2172314c1540a463a21b2be705dae0e0d9e345160b344e11f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438764, "uuid": "43c8c3af-b392-480d-a352-6be1c0fd23a7", "comment": "Malware payload (AgentTesla)", "value": "d8a5a5583e9e90375631d02189a0bb311889ba37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438764, "uuid": "ae25326e-6945-433c-8532-57cd3089d696", "comment": "Malware payload (AgentTesla)", "value": "7d1d223d1e8e1822611180e60f7bd2be5e12af5c5a456654885206df245d58ae65295280d7dfa9d79460b283a387379d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438764, "uuid": "75629356-b181-4b8c-b2bf-f5988a1db6c0", "value": "T1D9E40240F2B8CF27EABEA7F6141414804BB7999B1572F7940DC7B1DB2690BE04A41B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438764, "uuid": "90f4306a-304a-4908-b1d3-b3ff06d65ec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438764, "uuid": "27e87e3a-ba39-4dc3-923d-011479810527", "value": "12288:OoeDmWW11W77P19szVFKQlb8Rgjt87X7ZqHxpmT99IVNEF8kDwMD8HJ:OoeDmT1O7rEvKMb8687rZqHOEkDV8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438764, "uuid": "c9f7d633-23ce-4c85-9827-4620ad2b21e6", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438764, "uuid": "69e01e43-301b-463d-8624-852f37be7c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438764, "uuid": "e45f6836-fb6f-4f1f-9155-0097a6abf555", "value": "MT$11200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6286dabd-506d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694414122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414122, "uuid": "c151548d-55a5-4d13-a4cb-6ac98b8e7848", "comment": "Malware payload (Amadey)", "value": "885cadcd9cc4a6068c0b7d8ca2c73ba6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414122, "uuid": "683afcfd-1ee9-4aa5-a6bd-e50057f89e55", "comment": "Malware payload (Amadey)", "value": "f09de3a92e06df03fe93985a0814c125e8b337eb757e9ccd38ef7904c45f09d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414122, "uuid": "f8683830-64cc-4e9a-afb8-100204534a69", "comment": "Malware payload (Amadey)", "value": "907f8ba37bd9b90354ad6fa80026f1a8b8c5db0f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414122, "uuid": "3a2a20ad-cb85-4d31-950a-b8163ab02d1f", "comment": "Malware payload (Amadey)", "value": "cb6ebd018a6b85325e816cd2f0955cb2019244e19fedca21491e47486962fb0f93ca4603206020e7909ee2ce909c92db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414122, "uuid": "8bb26f7c-a333-4874-b6c0-871b52a74280", "value": "T16E34AE1074D9C4F3D832153609F0EBB65A3DB9600B6199EFB7E40F7E4F202C1AA7566A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414122, "uuid": "89395fdd-9bf0-48be-a493-4ca48af8fe08", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414122, "uuid": "14d86a44-6cb4-46c7-a120-ad593092d49e", "value": "6144:twbUIz6DCGbAR/VeDC1tAOIcCjBfzv+TurBiIg:tXIzaC+UjbwBrvSurBiIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694414122, "uuid": "dbf24796-be62-4056-8bae-c36c4f48223b", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694414122, "uuid": "7449be38-e743-44d2-8473-8afb063733fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414122, "uuid": "26e5d717-2a17-400e-8644-b99f0d83da4c", "value": "885cadcd9cc4a6068c0b7d8ca2c73ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb170aec-5083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694423827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423827, "uuid": "6fca93e2-83f3-47ed-a8b6-d8096ccff54c", "comment": "Malware payload (GuLoader)", "value": "3dddfb9649f2d1d0eba991f70b725713", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423827, "uuid": "8cc4a696-8c10-4863-bc3c-e2377b529cb1", "comment": "Malware payload (GuLoader)", "value": "f0e02590da53e08dbce71b29113b368ff3cafff0bf9774ad9ecdac7f9aa978ef", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423827, "uuid": "01c1223d-a44b-4a5c-a356-3f6f062709aa", "comment": "Malware payload (GuLoader)", "value": "89f07eadc247bafea01240aa9d25540b5a38a8c3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694423827, "uuid": "420ac9ef-39cd-4911-9112-763bedf007fb", "comment": "Malware payload (GuLoader)", "value": "0d8a45959e5114ec20a7e70da4cce1b51b71748ef1c18f345b7b2c59f38f2639b8a49571b4e0b37e3fce800aa97a1013", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423827, "uuid": "1116fabb-9c96-4a43-8243-bdff4f1664d5", "value": "T179458DCF5C88BB42C71942B6AF13F5EC092BBE5DA78524D73071BB4A3D3255908F60A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423827, "uuid": "e740540a-60c0-4fa3-945c-336334579b83", "value": "24576:dWQmmav30xoZyAw6VAZyPw6V06NBm6NaQtKKRzmQ8T4ZaqHSwby:8QmmQ30wU6VyX6VtTTtRmjTzqyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694423827, "uuid": "9addbcba-a443-48f3-925c-dd530f4f39e1", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694423827, "uuid": "8f5a99d0-e67a-4939-b23d-7b0b45d06353", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694423827, "uuid": "ab41d768-6993-44b2-af09-42e33663b352", "value": "Order and Payment Schedule.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366c06ce-504f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694401164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401164, "uuid": "553f16ed-d325-451a-ab4a-9d47166ad295", "comment": "Malware payload (Mirai)", "value": "bcbe41e471c9a363242c5d27080a0cc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401164, "uuid": "5d59235d-766a-4d65-b1de-b10190ee808d", "comment": "Malware payload (Mirai)", "value": "f118d9dbbb94868fe6dbe32b49d1d51c32a8a9fc95e0a34dab33a10aed75735b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401164, "uuid": "994e9758-f810-4b0d-bcf4-5c9baef60e13", "comment": "Malware payload (Mirai)", "value": "a6324f6e3d20812f5ee91d98f561a2b5df9b27b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694401164, "uuid": "dc0eb870-e22d-4064-ae79-95ab8c11d825", "comment": "Malware payload (Mirai)", "value": "d4996240563039aca2e6e79302f2721db7d9f03393a0c3aaae22e4c2acd855890e1edbd46db4f22abea917f13dfd30d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401164, "uuid": "024bb05c-3c3f-4685-8d8e-a90ae4ec779c", "value": "T1AF434A80F8819623C6D1127BF66E428D3B2613E8E2DBB3179D225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401164, "uuid": "be5d7b3d-7955-4abe-b5ae-58e037675076", "value": "1536:tj7QgWzvkqAs5a/U+81yv+VzxiCsaXvWnC:tjgI/8IvWV9xWnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694401164, "uuid": "50e2de7b-8074-4d15-ae91-80322a011543", "value": 59644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694401164, "uuid": "10d07baf-fba5-4e26-94b2-5446b04951d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694401164, "uuid": "53ba6e31-6156-4cc5-91ba-1352d8dfad00", "value": "m.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeda2ea-50f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694474429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694474429, "uuid": "a2a9ea3d-3da2-4770-a738-131ee43d2f27", "comment": "Malware payload (AgentTesla)", "value": "83d972ce4cd511472f81f65f0f09d8c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694474429, "uuid": "7583655e-6645-41ec-a02f-1fcafa3a045e", "comment": "Malware payload (AgentTesla)", "value": "f18feeb5c75c4848990a31437d1b889d1ed0f48524cdecb29077459c7c267d42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694474429, "uuid": "62756e07-0158-4f1f-b093-b07aa4da38ef", "comment": "Malware payload (AgentTesla)", "value": "bf3dea7e9fb9628603bf5c86e4a10bb41aa94d89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694474429, "uuid": "3c05144f-1f8b-45b2-9b81-93718cc37339", "comment": "Malware payload (AgentTesla)", "value": "6649342045cc2c3bd0f37b08eb2858b175d3c2add980216f0ce2dcbd9d5181aab64abeb3581c426f0f04c6f0865da2d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694474429, "uuid": "8dd0e915-9fbf-4769-b5d6-ff350310f196", "value": "T19A34EC077E84EB11D6683D37C2DF6D2853F2B0C70673960BAF59AEA529412536C6E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694474429, "uuid": "dd3add1e-9909-47c2-bcc0-20b2ce0dad50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694474429, "uuid": "df48fc78-3cb2-4348-bf71-1231eef596ae", "value": "6144:bBT/4fQFzW/+p4WFu5QRiBlsU+uRXuNjk7qqyzp9GFE94I77t1gCpX7mxDpdv0p5:NT/jL47TRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694474429, "uuid": "da4ac21f-6bab-4be3-9286-a02632ab5487", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694474429, "uuid": "ea2e51c6-37d0-4c12-8f42-207deb994578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694474429, "uuid": "5c92282c-0101-4d21-a18e-6468ce27622c", "value": "16944744279782d6254fe43df31ffb0482e20b8ab974c213b1520a9bcaa56548eb33969d05762.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc9e2d6-50b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694445417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445417, "uuid": "880b4585-15c2-430d-b056-3cc52c2cbcab", "comment": "Malware payload (AgentTesla)", "value": "6081981c3de51df5452b1a1def5dc7c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445417, "uuid": "94f41526-2430-43c8-89a9-498f4876bab0", "comment": "Malware payload (AgentTesla)", "value": "f1f80492f0d615f3035dad03e91fa0d3ac20fa50d188a7ccbf7f99e6918f8fd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445417, "uuid": "ead613e3-26ce-4003-9ef9-8122e85cd008", "comment": "Malware payload (AgentTesla)", "value": "15b54aee6e85a2a64319be1ffdbf64a799933acf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694445417, "uuid": "a7a635ae-3300-4cd8-82b7-beebf1f4d9c4", "comment": "Malware payload (AgentTesla)", "value": "335fc3117080c8f3a06d08462afc745205f2530012d11a0dab842237c18ac4b900b7b6808bb11575387242e60cd21c22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445417, "uuid": "0359ac11-8292-4bdc-a625-fd3f4dede415", "value": "T10B931A06A2874791C85515B4C0F35B2507F6FB836733C7863F88325A4D623EA9D6AF8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445417, "uuid": "a30f1e85-1b01-42c0-8ef3-6637eeb02cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445417, "uuid": "4208a397-f111-4f71-8a50-6a3b8383e086", "value": "1536:gMg+MxvWSnmznKhreTHKmMlBBM3CEF/7GmqbMY7usiY9hkk:vScnbTDMC7GmCMY7pdkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694445417, "uuid": "4fefbf19-1bd0-4d60-aa2b-ca6c230f0189", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694445417, "uuid": "4966e7ac-026d-4070-adc2-0c06278cad4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694445417, "uuid": "32cbfdf1-58da-4b86-8821-d15190c522c5", "value": "DHL _ FACTURA _ EMBARQUE _ DOCUMENTO _ RECIBO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c16983-50a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694439529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439529, "uuid": "42980197-dad1-44cc-987d-0053336daed4", "comment": "Malware payload (GuLoader)", "value": "1ef0913b6f4b49c782ea2f6a98dfec2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439529, "uuid": "2ae309f4-ac9e-4c80-9d71-7ea8648146dc", "comment": "Malware payload (GuLoader)", "value": "f2402bdf2374f6e04baae8582308c887330cbe01107212ee3a17aff95ab9aac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439529, "uuid": "86579a4b-216e-4b39-8eb4-4a567b106e40", "comment": "Malware payload (GuLoader)", "value": "3d835248d0c023ebb3bdb464fe349e2f906993b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694439529, "uuid": "f19f56d0-f99a-478f-96c0-667aeaa0d49f", "comment": "Malware payload (GuLoader)", "value": "e819df8f39addaf9856ec585fb4536af8c7ffc7ae3edba39b1cf32f4b1684ea4d593fdd6f5d2bd601b3d85b16a3f7ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439529, "uuid": "688095ef-6406-4310-9abe-96b0c53f69e3", "value": "T1D994C0D3A2D55B8BED830B3410E69FA6347BBE6CA733A65F4B94706A5DB33C00718185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439529, "uuid": "5c01a828-5062-4637-9145-6843e5f5c9ad", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439529, "uuid": "c1690b0d-6653-404f-bd70-34fcebd4493f", "value": "6144:lapc5j92fgJopoO+Ooypm4L1ZqlBiJua5NFTaVOoavc:fx92fg3bO/x7UgNBwkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694439529, "uuid": "4a2cc49c-35de-4be3-8b97-3704d03688ed", "value": 428824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694439529, "uuid": "3388ba1f-8f10-4483-a4c4-abe921aedeb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694439529, "uuid": "fd2535ec-8671-48b5-bf50-c0c4f7e0cc76", "value": "IMG-WAA2643324244758578488472842428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d25838-50ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694447407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694447407, "uuid": "5b8ea1fa-48e3-41c0-ac25-14ef86d2c800", "comment": "Malware payload (Amadey)", "value": "2e02d69b243ca36673df03800963433d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694447407, "uuid": "2bbcd86a-4e8c-4afb-b824-ff9138d293f7", "comment": "Malware payload (Amadey)", "value": "f279e23308e3d5f1a8b40722f199b6fb4deb543b3f6774d47ca3cd3b39653c1b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694447407, "uuid": "c48f2625-a8f0-4743-84ca-82890aa99c31", "comment": "Malware payload (Amadey)", "value": "54ec20c1d389c2e0fd1981f5c026dfc64b1f260c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694447407, "uuid": "71ebb9ca-13d6-4996-b39a-ee1d892211ca", "comment": "Malware payload (Amadey)", "value": "4b5e39311beef46cd148d28d7554d0f5c6cda5f3c62f81ef39fcd7a0e158cb827b2a33241cf1acee8fabf68b749a858f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694447407, "uuid": "085c9468-0578-48fb-b6bb-5d9e45d01457", "value": "T168545BC392A0BCA5E5264E329E2E86E4361DF5504F1B77A6E2189A2F05BF1F1D1F3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694447407, "uuid": "20b411b4-9270-443a-9bb5-27a5a3234d8e", "value": "9510dea81cc5ce11a4de430720afcd42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694447407, "uuid": "27a0ae8f-1eba-4597-8378-12a149504661", "value": "3072:xHszGQroot1AnZQenpi5Pkl4lPckXUGIuuOW/R+WiAGd0Y0EdkSVPR:OCFot1AZQnklqXQRtiAs0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694447407, "uuid": "ed5b60a7-d153-40fe-8e86-54d6d74c6159", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694447407, "uuid": "ac4c4232-90a9-4cfd-abf3-297960719441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694447407, "uuid": "4166a56f-ab9e-40ce-aa6e-517e82db9744", "value": "2e02d69b243ca36673df03800963433d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7553958-50a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694438773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438773, "uuid": "55bd1e21-1649-4004-b818-4368c9ee0c09", "comment": "Malware payload (Formbook)", "value": "50c38994b92c77d8acdf4a03e7054fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438773, "uuid": "404fc535-c7d7-4462-80bc-6a2e336e8e3b", "comment": "Malware payload (Formbook)", "value": "f34df19c8ef0a99d69ce58e740874e72b5b7d6f9588088fbc8a9fffd237cc229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438773, "uuid": "83dace71-7060-43bb-881a-6d65a13f5e4e", "comment": "Malware payload (Formbook)", "value": "8f11f8b38ebc9fbd5064b8933de0af0c89802a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694438773, "uuid": "5b71942c-6db2-4305-abe9-69a629e9bc90", "comment": "Malware payload (Formbook)", "value": "0551192ac5f3b625e8b61264ecc8e3024f09a913e9bb430e64f7ed1b034f909cee95cac01bdea138b7637abee3e759ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438773, "uuid": "9edbd950-cbdd-46df-8610-a4a6d3a02fdd", "value": "T12F74225163B2C077F83B02755D75169B6F6AA05B29345B0F1BA0AF2C38D678AD80F34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438773, "uuid": "a7f2b1da-5d6d-41d1-9db7-61521e6981f3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438773, "uuid": "1f096c95-57e8-48ac-adf9-d3212ca45fdf", "value": "6144:PYa6uG4+mx9FdOZi8t8hycmosntY+XMFiLdCI9gU+9F:PY4/dO9t8Qcm/cFiLdCIoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694438773, "uuid": "e42a2125-e15e-4d8e-a32b-8995f1ca446f", "value": 364339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694438773, "uuid": "0d9f311b-ec3a-47a3-8a76-911cc87902cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694438773, "uuid": "007f4a39-5698-491a-b481-efe2765ae2d2", "value": "rock990ro0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ff2dd9-5060-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694408711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408711, "uuid": "842a1136-339e-42ed-b539-88e38dd5d5cb", "comment": "Malware payload (Tofsee)", "value": "4f0651dfda793134bd14534458d2d3a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408711, "uuid": "ec3d5aed-9bfd-4bb8-b471-741e378c819e", "comment": "Malware payload (Tofsee)", "value": "f5401128f157b71ae2afcf5729f32c04cfb87443dc1f37d19cf5520549920ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408711, "uuid": "ff31bdf5-0fb7-4213-97e6-6eaeee596aa1", "comment": "Malware payload (Tofsee)", "value": "1f046159256ac698e390954a13828a6bd54c7d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694408711, "uuid": "6df7e150-8031-4eb3-9ce2-9a6fa2a3373c", "comment": "Malware payload (Tofsee)", "value": "1c24e9d4396a0cc7ef2efb63a14811c69c92369368c9dea0c5a031d02b6e8f427c334d692d38443965a0bfcea7d509e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408711, "uuid": "ff22f5c0-43a3-40dd-ab43-8af90d94df17", "value": "T10D249C136AE0BC65E95747354F2DDADC3B2FB8726E64871A36643E1E0C312B1C627782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408711, "uuid": "caee50d6-d14f-439c-a2f8-8aceb10575df", "value": "f815858bb8146375fb6d659cf6f7de7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408711, "uuid": "1cdc42cb-bf9c-4b6e-8083-f8da52c242ab", "value": "3072:DcraL7WjSg3M/PLCLJi0szWqzHAlXHBYo5AwetmxZ:XLMFe+8WqOAweO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694408711, "uuid": "139ead4a-52e7-4aa8-b992-ac4db5604745", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694408711, "uuid": "3613a094-09cb-44af-9602-e3a63acbe6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694408711, "uuid": "e4801df7-ee20-4ee3-9681-6f7fb1a7b0e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13696df9-50a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694435894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435894, "uuid": "1ee75f2c-43ff-4f44-afed-c3f8e02a9d4d", "comment": "Malware payload", "value": "73b9941c16422baa9899544d289de653", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435894, "uuid": "8437ef8a-5f8b-40ce-9957-c5bd7ac3ecc5", "comment": "Malware payload", "value": "f559d7166c775514d4f79744e6d590c5eb7c75ea4e7bb52339dd7a9b92ab6b58", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435894, "uuid": "097e6f50-f466-4f63-9690-b6fab9b9cc99", "comment": "Malware payload", "value": "c90767124a3a17910761d1a90be9def7a9c8f1d6", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694435894, "uuid": "b459c4f1-bda4-466d-9c0d-cd4becd4834f", "comment": "Malware payload", "value": "8b7b70e7a47ae6392267c27d10802668db523ce32eeef28f4f54962b377b82b8343e334d42e9c60208d72475fda0dc68", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435894, "uuid": "ba6037c9-c2e4-4855-a3bf-5ea32d8b6876", "value": "T128F31295F213C95F0AA6F09D7EADD89E6876E1B584A42B35427EF6CC00039A3CB76580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435894, "uuid": "09de62b9-373e-450c-9d11-02ee3143cf3f", "value": "3072:id5cBaS+k1WO0NADW/S8mluFb++XvWIPzbAvoM9hvGbMQTdH:iLjSx4j6qjWIYvo4+HdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694435894, "uuid": "a7f33eea-73a4-49d0-af21-0a11c1b1fa5f", "value": 161900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694435894, "uuid": "8b20a4f8-d533-48ab-87de-894ea36d101a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694435894, "uuid": "0672c302-353b-4fc9-8b2b-ee055ed4f1a0", "value": "SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d45823d-50af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694442326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442326, "uuid": "e8a996c3-9d9c-4483-8765-b731c0f50c98", "comment": "Malware payload (RedLineStealer)", "value": "0672b0ee00d516f82c5a8613985b28b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442326, "uuid": "c7ec546d-1e9b-45de-a066-28a231585ebc", "comment": "Malware payload (RedLineStealer)", "value": "f58a41be919def193aef522bbc727be2a218a2e7b435695c2427e7dc576be977", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442326, "uuid": "ad9ad514-a171-43bd-a273-e7dede3e36f1", "comment": "Malware payload (RedLineStealer)", "value": "25dd683d0223c4e97a6b3e63f0e016c0352173ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694442326, "uuid": "3fe6c571-8957-4d55-986e-3993d5eb9371", "comment": "Malware payload (RedLineStealer)", "value": "df3464c5fa66a180e9ebde9611587bf74e695001859c07bb79f93fd9cb45b042ff840d20cc085f694267d50d725ad3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442326, "uuid": "f7ca6046-7d5a-465f-9914-f8cefbcb8b28", "value": "T11865125C748C44BAD2A2563A4E74D7FA5BBCBD210B6155FFE3A81B6ECE702C18B30125", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442326, "uuid": "cda1f1f0-948f-4edc-9ea4-687fcf9c7df7", "value": "1f21c4dae1d8bdc5f5b4dc1d200a0bc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442326, "uuid": "00a54093-f434-48ea-9148-6d0f3e7ea252", "value": "24576:ceSiHRUNdfGwf0DpEi2z9cdqKQ6jZ/GOhNKpgtrkqQNtJoTypbI:8iGJ0tz29cd1xjXKmtwITyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694442326, "uuid": "f593b841-cf63-4cd3-b978-4b03da0aa178", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694442326, "uuid": "25b9f175-4c6e-4144-a883-d9ea0e0aaa10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694442326, "uuid": "a6549cbc-db85-4c8c-9f0e-9d2d036f1b6a", "value": "0672b0ee00d516f82c5a8613985b28b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb1558c-5058-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694405043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405043, "uuid": "7753e73b-cc36-45fa-b12e-187b64e47439", "comment": "Malware payload (Mirai)", "value": "7456542286cfd1294b327c2e4cc97de9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405043, "uuid": "8078f616-66c7-45ca-b251-e84c6a394caf", "comment": "Malware payload (Mirai)", "value": "f5d0596d0b666a2b5e7834b7fe30320d660423474285aad3d81904dd7e0d91f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405043, "uuid": "bab9d0d7-289d-42f1-8475-2862a9a8275e", "comment": "Malware payload (Mirai)", "value": "cf59695a60eb7d199005660d74d03875dbb6661b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694405043, "uuid": "e2e2c626-9ec2-4322-a959-34ce8e8f2ead", "comment": "Malware payload (Mirai)", "value": "9acbdfee3078d0320bd6ab351faa1ef2b98aa83a35ceb2ea5b867432d3a7c0ed45ce9f5a17296d749c0f25a47a19fa6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405043, "uuid": "06a7c80a-c71c-4607-893e-8a605a7dddfb", "value": "T156434A02B31C0E47C0A31A70263F1BD097BEE9D022E4F689352E979A9671E375586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405043, "uuid": "76a37a1c-9c1e-46c7-aa5f-7005e4b8402b", "value": "768:EbpJYxjEJf68CRZGRloQUEqde5POkdUWV96mCq2Rj5GMIgglGcFRxtafS+wneIa:q/mqzqQPJ286+2qMIgg4AxgfGne1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694405043, "uuid": "dccdb87a-90e3-443b-b56e-cf86255cc6d6", "value": 55160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694405043, "uuid": "ef009ecc-577b-4b82-9685-55fc88e38cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694405043, "uuid": "f42edc8c-9b12-4c61-ab9a-6f75fce541a2", "value": "7456542286cfd1294b327c2e4cc97de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66897c18-5074-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694417136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417136, "uuid": "52375eb4-9898-4709-a15d-17bc748d946f", "comment": "Malware payload (AgentTesla)", "value": "8d5ecbb69bdddc98c77de1ea3fb4efab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417136, "uuid": "b83701f7-0475-4102-a5ee-ed38767100b2", "comment": "Malware payload (AgentTesla)", "value": "f6c834aacc322afa8507f56d7b5883c96f1f220b6a10c6d2f656e49dc0e83e18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417136, "uuid": "113eddfe-83f7-4e96-a60c-114f69688a89", "comment": "Malware payload (AgentTesla)", "value": "3e44542d5af8374fcec4c8de81c03e7daa96b513", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694417136, "uuid": "79546fac-ca0f-4677-acb9-c76cbfe50df0", "comment": "Malware payload (AgentTesla)", "value": "b4681a03ba1f21057be0a0e3381f2dfe1031852848bcdd54762c4637a90e124c415e46461d979a432316b0f8ce0c291a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417136, "uuid": "75dc215f-3206-41e0-b3e1-f70a97aa4d42", "value": "T1DAE4230383A4B4FE25ACF5568D0BC5F794A618DF3C1CA98127DAE0AD531D4742E7CEA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417136, "uuid": "f23002f3-7c72-425b-aa8e-a08d5afae30b", "value": "12288:Ufpxx5GgYXVtjLsX/tjFB6xTU0s4/X5ZeM9VlNawCGkZ6oun7qxV4Mnf3rPof/9n:upH5JYXrsBo40/A0LNj4Z6D7yNrPodGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694417136, "uuid": "40281469-d231-4c07-9b07-b0237bacf7c8", "value": 664646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694417136, "uuid": "c5c059bc-58c9-4501-9058-f05d1b675cb0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694417136, "uuid": "9e9ad429-a773-4764-8d08-08c02f4d6761", "value": "Transfer Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9fded7-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694416263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416263, "uuid": "7c912baa-6f41-4213-821d-0b656d23d7e2", "comment": "Malware payload (AgentTesla)", "value": "eaf25ba217e18c943a09c2d534ca4efe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416263, "uuid": "1d318cfd-c943-49d5-8e85-9483c8233d9b", "comment": "Malware payload (AgentTesla)", "value": "f6ceb475c843b5339bdd85afc176eba77bf0d7a133afa4e092e3cd9e93889a7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416263, "uuid": "29e43040-136f-4e84-ab4d-ba8a55af9b85", "comment": "Malware payload (AgentTesla)", "value": "1bfccd6fe9b46f43c9056b21c8c1ef4ceb4108e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416263, "uuid": "c279ba6a-13da-4065-bf4b-1a3e5f003669", "comment": "Malware payload (AgentTesla)", "value": "051a5ae92f4a6a214073cff54598b5ca13efaabf9814841f8f0703ed2fdeead835f00edf82ac811958867b21c4e46d9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416263, "uuid": "0f13e0ef-4f95-48fb-993f-3b14b48f7db4", "value": "T1F6D41286B3BC1F1AC53A2BF05895505807B67A26A172CB5D1DC370DA24B2FB30B52F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416263, "uuid": "b8b74b56-6897-4bcb-bb21-d13d46d1fb60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416263, "uuid": "7d0be9a4-8d2d-4b4b-b566-2d2f780ff781", "value": "12288:A3t2iNHkDwMD8DYQ8r83sTyQoTOWE95IY9RdmrdL4u:A3t1RkDV8DYQa2fQoTOldm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416263, "uuid": "3664e4cd-2bbb-45ff-b0ce-8ad8888d237a", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416263, "uuid": "4db6b633-6bbe-47bf-a7eb-1b3c87de6022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416263, "uuid": "07124c83-bb1a-4095-8334-b6394e12c721", "value": "Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65192708-506f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694414986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414986, "uuid": "8cefc2c0-ab84-4a9e-9a58-88b1d0a0cd7f", "comment": "Malware payload (Formbook)", "value": "e99e9e9e9e864b38fc75f29b54771c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414986, "uuid": "ab13f495-eb54-4d18-aab0-fa4f6bd1790c", "comment": "Malware payload (Formbook)", "value": "f6f14e614582f94e97f29dc96c69fa61767fd2f6bf5798ad96a7e3c34f189db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414986, "uuid": "49a7fa29-2e49-4d3e-ac41-a4ac20d3d161", "comment": "Malware payload (Formbook)", "value": "b04de030979ebd1e8f9e07803cf3afb89f9c4dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694414986, "uuid": "d1547b3c-3af7-4b1a-990f-fad90d9c9c09", "comment": "Malware payload (Formbook)", "value": "77037944a3505ed1d0bbb6186890e08d7790b1a16401230e2547760589b9fdcb5e7a259c150d1610fe1ec2bcbf3930d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414986, "uuid": "4ac4f31b-6e91-4239-a452-e211efe85a15", "value": "T1627413D03FF1C12BE8320B314A76556A5BF7A72445A1830A37615B29FB725C3DA0EB72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414986, "uuid": "767e7893-6601-478d-872c-1b22620ccb3e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414986, "uuid": "2ba18eeb-a317-43a8-9763-aeb4378d68f6", "value": "6144:/Ya6LnWEpx6RA6WMbDBBITWgu1I9Nt2M1KGJbsp8Yv5scXsT4Yr/M3/Nvbnpn:/YRf/KDsTWggI9Ntf1KPys2Fedjpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694414986, "uuid": "bc73248d-7655-4b5b-bd8b-c286687e278f", "value": 348068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694414986, "uuid": "1c591d6b-9a5f-4d9d-9e12-839559ff0473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694414986, "uuid": "a75e96f3-1fe0-4737-b6de-05ff69811178", "value": "Outstanding Balance Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6ef049-5081-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694422808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422808, "uuid": "2ea79825-8ffc-42e4-8907-7720db2ad163", "comment": "Malware payload (RemcosRAT)", "value": "689ee64af0f87c642c62b88a3f97feca", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422808, "uuid": "f7f55d24-d6ab-4f7c-8ca0-6c9ad27ca706", "comment": "Malware payload (RemcosRAT)", "value": "f7547fb772b530d9072dc339b99b169cb512455c2031ae5c6956b8e483ba68b9", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422808, "uuid": "48d9dd78-5306-4b2b-ae1e-8ccee846b4b7", "comment": "Malware payload (RemcosRAT)", "value": "a74815e0ddbc0cf7414efd3aa7c6d0c0623a36d9", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694422808, "uuid": "dc0e99c6-1204-420b-bfd7-ce3d09d7cf40", "comment": "Malware payload (RemcosRAT)", "value": "97cefac9b56d5a742189614b692d24441f838b9515777cbd7307422735eca4e04679fb86d9cc1d5f51de466f7a20a199", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422808, "uuid": "c4af9534-9068-409d-aa02-63d4f106e28b", "value": "T104C34A65EF98991BC26E6B72A0F353659770F1C93016E78F1A8400EC2DA37C94E463F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422808, "uuid": "b5db96b6-25e7-41af-ba00-e92c3bb9155c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422808, "uuid": "0dcc662b-3af1-4ccc-a2a5-62dfa53b4320", "value": "1536:R9MUqIZ4ckNIPDmwK6E5g7sOa2CVZbOlHSqSMUoHB3lWsFwin8ymq0Q:R9MbIZ4ciIw6GcsXb7oHB3lWs+inX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694422808, "uuid": "9dd1d808-a8bb-4d3d-9f14-e592713b937a", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694422808, "uuid": "b7009d4f-3917-4823-b552-dfc833ce5c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694422808, "uuid": "df67b9e8-689a-4226-835e-5fdb5976b3c9", "value": "1694422806f132ec32d7b9ec4a11374f7334b69c1a2736bdb3601744fbf9378c2a86485f6c596.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bde8c1b-5099-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694433090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433090, "uuid": "861a190c-90e1-43d9-b19a-0d26bab06948", "comment": "Malware payload (AgentTesla)", "value": "56faa2c7c8efd31f3f0caaf63a5f7342", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433090, "uuid": "cfd9c7f3-43e4-46f7-9601-0a2300eeb6ec", "comment": "Malware payload (AgentTesla)", "value": "f88bac1ff82ccc11355c02fd997df1e19931ed1804d21db9c799fce696eb1ada", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433090, "uuid": "8616ec70-824e-445c-ad59-52dafd17ffb6", "comment": "Malware payload (AgentTesla)", "value": "66560e8e738bd605bac68203084ade626818f9a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694433090, "uuid": "44175eb2-12fb-4ff1-87de-68bec1e9c6a4", "comment": "Malware payload (AgentTesla)", "value": "1b7e5c893b2b0417a0add8746e7100e5ad98678d4dcb6e42b15b72e97d1e6113ac394e222ead6a72ac36761ff0b9bb61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433090, "uuid": "c4a0c41d-f2ab-4827-8fad-93f622bce205", "value": "T1F3F46A153388CF39C15F05B5C8A382F89337AE04EC42ABC776CDBE6975B62A958516C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433090, "uuid": "ffee01b2-5f8b-437f-a310-33819d919b92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433090, "uuid": "bbc84fdb-6b38-48ef-b0ed-5e725f6a5d5c", "value": "12288:FLQhXYr1+5KPH6KoLYSult0HVU6Mw0JDDz+:VQhXw+4P5oMSultwVUW08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694433090, "uuid": "01e272b3-d624-4769-ad7a-9c910ff40602", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694433090, "uuid": "5caad29d-7183-48a8-a683-05acda4e095b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694433090, "uuid": "17faba5b-1bc4-4d42-9e55-5bf9b961a4c4", "value": "rQUOTATION_SEPT9FIBA00541__PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd607d9-5085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424372, "uuid": "7fe0de18-2914-4c10-94c4-e9ba24c72c94", "comment": "Malware payload (AgentTesla)", "value": "6d977e4c4b4481009f981f7f4b1c29af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424372, "uuid": "9d803944-f76f-4faf-af5b-888509ae9e11", "comment": "Malware payload (AgentTesla)", "value": "fa355d795ebffe4120aaf97fdb4f1fc6e856b07a2ddffa2555b185a7043e2280", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424372, "uuid": "a9c407e3-b59e-4d0a-a8f8-46fc8833b95a", "comment": "Malware payload (AgentTesla)", "value": "65d11ec2e7bf4c52ed81917e963dbdd771cbc06d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424372, "uuid": "092b0249-b3c5-494b-934e-9c099963eea5", "comment": "Malware payload (AgentTesla)", "value": "e3c3c4706e813f8ac146c57d0faa840d3431388441a0035bdaf10149c286be4601eb1478e49cd7a7fc01a58e0a89fc33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424372, "uuid": "444109a9-d021-489c-a6ca-627a3497e892", "value": "T1C2D4230BF3278B24EA199FF72E131F41167AD48FA5B4DF7E4B8D85272A763194010B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424372, "uuid": "4b1ed04e-ba21-489d-be51-d090508bc140", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424372, "uuid": "23987f9c-60f6-49e3-a3ff-9081ae8ebe6b", "value": "12288:b2iNZ1DlGH+qbj61XSRQR8bZUwjrPxVhGXgjGKJ/WNG:b1pDwdbW0pbZFXsWGKJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424372, "uuid": "9c824e1f-cd29-4ac7-b51f-1d8bf2b6e47d", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424372, "uuid": "d8ae79d6-79f7-4efc-b3f8-5f8042a56155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424372, "uuid": "3371046e-7fbf-4506-8e92-181913297906", "value": "DHL AWB 4500028900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fb3178-50c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450553, "uuid": "2e02a9ca-9bfd-42a0-93a4-56992d91aff2", "comment": "Malware payload (Mirai)", "value": "f4bb9f72a9ef67ba746f27d4dfa590e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450553, "uuid": "274289f1-5916-4fc1-b2dc-7610e8e2964b", "comment": "Malware payload (Mirai)", "value": "fa6aa20e75f0aea080e3664e62f7001e789c0353bc496c3e6ac0d47b1b9d5373", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450553, "uuid": "a678d609-caa0-48aa-9969-c533605c5ea4", "comment": "Malware payload (Mirai)", "value": "fe8e184533ef7d1024bb2bbf8f1ac987fd0753e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450553, "uuid": "15afcd1c-639a-433c-8e1c-4b532ac6938a", "comment": "Malware payload (Mirai)", "value": "ba66d5c2ab53380d559927032a50cc374c388775ed2ad3bd6ed06157cb7462e79a69858064fa5d577d0df58db88e94ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450553, "uuid": "35b23cc3-e0e3-4420-8d13-090dfeb6449f", "value": "T1C8535DD9B8019D3CF84FE6BE80220A09FA31735151930F2BABABFDD36D721646D16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450553, "uuid": "0d2f2d7e-0549-4c68-a5f1-3a3da8d3b002", "value": "1536:q8AeFryZALOoddghYWfKyI68WhS89q+daesQ:7hFryZ8OoduYWCf4g+wzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450553, "uuid": "89a5a25b-160b-455d-9409-26ae8ae6672c", "value": 60812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450553, "uuid": "8cf87b0d-400e-428d-b77b-3fa011580b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450553, "uuid": "fe4a6a87-671d-4c6b-8088-3980566de62b", "value": "f4bb9f72a9ef67ba746f27d4dfa590e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1fa7ac-50c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694450163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450163, "uuid": "8aafcba9-9357-46dd-bb87-7baac882cb3c", "comment": "Malware payload (Mirai)", "value": "76ef6d94604a9f040de47856d7b07a5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450163, "uuid": "45e3cf1e-995b-4651-91fd-f477301e1018", "comment": "Malware payload (Mirai)", "value": "fa91239d8832c119891ee7f6628d7a5cd5b3940e8d5e3c3bf7a5bad6bb5e6b1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450163, "uuid": "3544c09e-328b-492a-b623-7f524590b1d1", "comment": "Malware payload (Mirai)", "value": "f288ce55dd1df09a9714cb0ac27e676cc3e0e7ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694450163, "uuid": "70dae39a-2d39-4684-9cb6-c017aa09a6ab", "comment": "Malware payload (Mirai)", "value": "eed4557b427a3851574191f4f2a737b6d493556d8fd9c8a977c511b10ba27b58477cb96ea34249e6c46b4132d9493d67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450163, "uuid": "40babe27-5c79-48fe-835d-d46ca84bf96d", "value": "T123C3F831E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450163, "uuid": "01766cdf-f7df-4b69-8374-f4f2ddc7558b", "value": "3072:6jVlyaL5JCrIpv04s7bttiEiTmP46aQyfPlfKsNb:yoCJCN4s7bHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694450163, "uuid": "b5c4974c-7f0a-4b17-8917-db7a71316c15", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694450163, "uuid": "ce1e2220-e085-4934-9012-678a1f78fcf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694450163, "uuid": "45029cdd-cb2c-4c72-9af7-01272c305a52", "value": "76ef6d94604a9f040de47856d7b07a5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9697f3db-509d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694434826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434826, "uuid": "281c9ac3-1e52-4c29-9944-21c9ac9cfc90", "comment": "Malware payload (Amadey)", "value": "071a4396b7a1b3e5f72bb248a7a8a060", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434826, "uuid": "97a3ee2b-1d48-4732-a6f8-830708279545", "comment": "Malware payload (Amadey)", "value": "fcd30e9418ee580b92c4c4632eac6b39538d5a0efba13235126f165bbc8f4d36", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434826, "uuid": "7397d5cf-195e-4d1d-a416-e7e87473bc89", "comment": "Malware payload (Amadey)", "value": "a92727f2bf3f6ebc1835cf41f90323eea431718c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694434826, "uuid": "01d726d0-6901-495a-9355-31b35136fbf9", "comment": "Malware payload (Amadey)", "value": "77546958981952dc67d5e196d4d5bce62df0826ae5ada29b376f2276505b7fa8f4502b678fd2f5b53161f79341b78baa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434826, "uuid": "778477e6-3341-4fa0-9aba-50d1783bea6d", "value": "T1C165120178F4C0B2D73A1B3206F69D79193DB43C2B6599FB83A50B7F4A152D3A326876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434826, "uuid": "36b7c594-aa58-43b2-87d5-d1a6d86e4e04", "value": "42a9a04d093acea5d87d09e3defddcb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434826, "uuid": "8df2e312-c654-414e-8611-20fbebb09aae", "value": "24576:UjPCJ89IOREmwdQnP3KFj1PlRWMD/lSx+fd8L2q6WtGzNr+TGdZsCvVuju1Hg:OPCJaIOKxISIMTlSsfd1q6cGzcT+ZsCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694434826, "uuid": "bdf69b20-0769-49ca-a5d6-4927a482c55b", "value": 1470328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694434826, "uuid": "5d740738-443c-4ef6-b958-9ca7b9e6eb93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694434826, "uuid": "a39704ce-7916-4b04-92b4-f5761f12c748", "value": "071a4396b7a1b3e5f72bb248a7a8a060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0f08bd-5072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694416256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416256, "uuid": "9fee534b-82d4-45ed-b28a-a64b68bee261", "comment": "Malware payload (AgentTesla)", "value": "e5fbaa055285fc0a7519e44c45ecb9a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416256, "uuid": "db8b0ab2-94bf-4940-8408-e62cc101ca15", "comment": "Malware payload (AgentTesla)", "value": "fe278c3a90fec27d75fbbadb5f0d1b782d51bf7dd269a0ef60fe3848a6760965", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416256, "uuid": "2d2a992d-c188-4abc-8bdc-0447e95bdd99", "comment": "Malware payload (AgentTesla)", "value": "11320b1ba29323710b3445038bbb63b90a5d6956", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694416256, "uuid": "a0f1ecd9-2edd-4d05-8641-04f5ecf6297d", "comment": "Malware payload (AgentTesla)", "value": "fb3d0dd2a7a09412d234201c9a3ce58af682baf7b88141187dd6927aaea369e817c9a09a2f95c78c4b0b48db4d3cc92b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416256, "uuid": "19f9426d-c0bb-48d5-bf96-a405edde6afa", "value": "T11CC42339A6830750AE2E58D91404FF653FF8ED73029E65710C826CB12FDA95F9132CEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416256, "uuid": "20f5667f-77e2-4942-af0c-27fcacf4913c", "value": "12288:SWjxx/5juks59oB9crIVxdfgyjPbWlRcdCfCYhsHB7xwQvQcqBSFRHfyZ:Scx55ak69Yer0bbWvcMC1xABc/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694416256, "uuid": "47a69df6-60e7-4ae6-8c37-3f65fc727d8c", "value": 575455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694416256, "uuid": "c2a6baf0-adbb-4a02-afc2-8fcbe0f93111", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694416256, "uuid": "e3b9299a-e2f3-48b5-8994-800a32e0b327", "value": "Invoice.pdf.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e377005a-5084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694424217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424217, "uuid": "06ff2501-238a-4d53-b442-e6f40bedb0e4", "comment": "Malware payload (AgentTesla)", "value": "319c838f4c7eff50319e9ef55494359b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424217, "uuid": "3a3eabd4-9a56-4b72-ac98-27d78abea345", "comment": "Malware payload (AgentTesla)", "value": "fe79fe3caf74c3fc5cbb618b9a0e9015edf85cdc8cc86f0f4ca7c9e8301ba18d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424217, "uuid": "ade41b3d-44a7-4aeb-8f45-09d2060d015e", "comment": "Malware payload (AgentTesla)", "value": "6757f118cf9ece75e9223d068d7b380dadb1199c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694424217, "uuid": "7862e4c6-37ae-43ef-97bc-656403c095b9", "comment": "Malware payload (AgentTesla)", "value": "aef48b370b22db5dc63a8899108b0d0ded2a212e55e094cc5d7aa7269b6c0f23493cedfb203a837c9b0cf1e7dfb6a627", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424217, "uuid": "88268af8-2180-4421-ad77-c715bb827960", "value": "T168D42329FAA205D8D25323B5EEF750470BF23B484DF3975F6A70998A436F910D9A6F00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424217, "uuid": "03014155-9389-4b69-b9fa-49a99f487965", "value": "12288:s+nWn3YNnO4CGMAGsInkxOpVQOm8b3wEPS4GSfxnssIdVuwfjXB:/T5CGMAhKkxO7DJfLGSpnssIjr7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694424217, "uuid": "a8628182-d8a0-45ce-b595-8119a3e03f06", "value": 619342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694424217, "uuid": "7313a6ad-3ad9-4c5d-b2dd-44108f4f653c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694424217, "uuid": "b60edfe6-5f39-4cc2-b8d9-4cdf1076e304", "value": "REMITTANCE USD57.73K.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }