{ "Event": { "published": true, "date": "2023-03-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-07", "timestamp": 1678233781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "81aa06db-b97c-4e80-a91a-b14e82f63093", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26dabf1-bc87-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678152705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152705, "uuid": "99810308-7f61-44d8-bf60-0a84fb0158a2", "comment": "Malware payload (SnakeKeylogger)", "value": "a7817f08646dfa194d48b8668cbf7899", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152705, "uuid": "f3dbe6f0-5514-49da-9a30-685742486152", "comment": "Malware payload (SnakeKeylogger)", "value": "003c4e0689d365f3b424498a5ce34b2c622555eb52c3f04f36f163920971c542", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152705, "uuid": "79da59a0-0f5a-4479-af29-197aee538803", "comment": "Malware payload (SnakeKeylogger)", "value": "cbc53a5fc545c921692d9ef7dff06a8f450a1998", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152705, "uuid": "b5cb1927-fb7b-4b75-867e-629919da44fa", "comment": "Malware payload (SnakeKeylogger)", "value": "41bb642675d4dcc4e24c4226d3d83858bdc03259c8001aee4bf8214844fa137b9f1884f637ba6ceb42f4073736080dec", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152705, "uuid": "d64361b8-cfe9-4739-ba44-917433f809f3", "value": "T1C952C3010B8DA8F1E265A1738275811E0DBEA16B34971AEC78CEE8E133BC60D5DF95B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152705, "uuid": "2f322615-7698-453b-bb04-fb45ae518c36", "value": "384:Io9fzvhr0xo2I1dzz1AAwXK6cJvQuPYZOJqZ:Iefjhrz1dNxFpYoJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678152705, "uuid": "7c9c043a-2a25-48a1-b1a2-2c2843aad88f", "value": 13913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678152705, "uuid": "5f9c3b3a-f509-4417-87df-3fff89509d07", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152705, "uuid": "ac6707ac-d537-49ef-861c-f400851f4565", "value": "a7817f08646dfa194d48b8668cbf7899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf4f995-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231671, "uuid": "234e37b9-8609-41a1-94ae-520aac3581a8", "comment": "Malware payload", "value": "ac60b254396937b09c61dfd30ff6c435", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231671, "uuid": "e231d039-f220-42d9-967e-75e1c3c2c0ec", "comment": "Malware payload", "value": "0041991dcda116ce88a70770c690683ac6d86ad5df7e08119f00e7b7e22145d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231671, "uuid": "17a852a9-ad31-4a35-a34f-515fcd718022", "comment": "Malware payload", "value": "b176b69e33f5f752630e4665f5774bc49112d99b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231671, "uuid": "6241d72e-0cbd-48fc-b139-7684933e60de", "comment": "Malware payload", "value": "61e8a6aa1b8395ebb7c1ddd04b402e71443ff0424f9d1efdc80618f59e9dc9cae20bdc4d4ebef866a382e1a8299de051", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231671, "uuid": "b6def989-aaec-4986-9cbd-a396e041a473", "value": "T183235B636C654073D7CA40305596DB3BED7A6B502FE414C387F388A36D66EA0762B20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231671, "uuid": "c5ad737a-8252-48f2-9004-dd0f6ffbfbe4", "value": "79b797185d880d3b599ef4a3d683677b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231671, "uuid": "d637e74f-a759-4dd1-a280-5918e72cb6ce", "value": "768:5gPtymHglT9xTKmvOdFtnRW0onvm7IEobOD:5QtyNxxTKzjlbonvmVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231671, "uuid": "870c1b92-febe-41ad-b2bf-c3265761d85f", "value": 48552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231671, "uuid": "2e5599ef-29a8-47cd-afe5-6252924897ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231671, "uuid": "fa796a63-bd6b-4827-a939-291ac1a5155c", "value": "SecuriteInfo.com.Win32.Ramnit-CY.3627.16563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486d76d4-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191987, "uuid": "8ebead70-e936-415e-b20a-1d213a4a8e34", "comment": "Malware payload (SnakeKeylogger)", "value": "9e63951ed814f70be42bd8b835770a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191987, "uuid": "a8442d71-1c47-4f73-8f12-8e12a57a084b", "comment": "Malware payload (SnakeKeylogger)", "value": "00c0d03307a35807609f84f1a8bac83a28be4ce382216a3ce0e8295e66843083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191987, "uuid": "676f543d-97d2-48f2-af5a-c406e0ebed99", "comment": "Malware payload (SnakeKeylogger)", "value": "8c19f633c8e8c99aba519c38129882892610ad79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191987, "uuid": "9133dd8e-cef0-4bd9-a6e1-30c36f164b9e", "comment": "Malware payload (SnakeKeylogger)", "value": "d82bbc4be84be23b7d75634a5a9b014f69112eac633c7ac9d3c6d878e63f09aba2367a5226d7989d2bbe8de03eee6f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191987, "uuid": "924cf20e-c241-4c90-bbf6-cc0f117ff814", "value": "T1B924014A2FAB531DEAC28B73E7BF7F4410A08C15CA4A976F5A5C300F2F13E59EA95045", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191987, "uuid": "d4dee906-853d-4f44-8d0e-f658e85577c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191987, "uuid": "923fa8ea-95f9-4bba-a294-f1f5c101e6c7", "value": "6144:MsL+yUybP5iKUXxuaBatFarcivi5QQxtFe:jBb5iYaBat0r7iyQxDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191987, "uuid": "439d98ba-55ba-49ca-a2a8-5e62006ce15c", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191987, "uuid": "136e3b10-0844-4351-9db3-2cdecc669400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191987, "uuid": "f171c355-a1cc-4617-9cbb-45cde101cddc", "value": "EXW By sea 1x20GP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cb1af4-bd0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678209025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209025, "uuid": "739fff58-9b72-4b8a-b647-9376fa657d8b", "comment": "Malware payload (AsyncRAT)", "value": "02f7467c0a07153c0c9fec745a96f819", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209025, "uuid": "233e9509-36a4-4d9c-9765-ce93848d733a", "comment": "Malware payload (AsyncRAT)", "value": "00c4b01417f71763724949ffb123875e62fb8e79ce17ae1ab224acb9261221c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209025, "uuid": "8341ecf3-92ab-435b-bef0-49d229fe99e9", "comment": "Malware payload (AsyncRAT)", "value": "1f3b662f4597a97182134c542718a09ac14dbe53", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209025, "uuid": "46911ea1-4d18-41b9-ae51-c006e9af3d9e", "comment": "Malware payload (AsyncRAT)", "value": "725a785d2c32a72987403fde5042e4276cb9a390ae2d7bbf84560c8eea5d76718826f2d61fa3f6866b7bba6fd6de02aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209025, "uuid": "2b83594f-353f-4040-b4d0-ebec29366ad6", "value": "T139747B1377A4E93BD1FD173AE43205005BF0D886B716E38B5A6856BCAC123868E917F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209025, "uuid": "8e389012-d27f-4535-99c2-8c0c00e44d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209025, "uuid": "522de96c-8e83-4611-9de8-4e0083006381", "value": "6144:T7L+PQIshf4BnYow5U7b7rSMauoLQF1I89lA:3issWUnShLQF1I89lA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209025, "uuid": "ee165663-7e37-4d82-b2cf-db569837be7d", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209025, "uuid": "2ba28a20-2f09-4bfc-a8ef-962a6a749f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209025, "uuid": "7dcadc36-20b6-46d3-a1cf-f2d923e4ac29", "value": "02f7467c0a07153c0c9fec745a96f819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd0445c-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678195511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195511, "uuid": "ee7356a4-692a-492f-b6ce-ea4f8638cb4d", "comment": "Malware payload (AgentTesla)", "value": "c3ad30b05eb683e350f0cfcacb1b8842", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195511, "uuid": "cf3e03df-c7b2-43a2-b342-b76b1290e7c4", "comment": "Malware payload (AgentTesla)", "value": "00e650a14e07a2520bb4ecabd6a265a7070e85923971781e373d8d1b26e4efc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195511, "uuid": "71d21d55-317a-459a-91c5-204f67ce1e07", "comment": "Malware payload (AgentTesla)", "value": "96f8117a8ed816cf6f13dd35f8b2f5caee3eb818", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195511, "uuid": "a820d508-147b-407f-ab07-a9a9fe5412d4", "comment": "Malware payload (AgentTesla)", "value": "1222b49d3f9e6f42f7ca71916c88908df444aae09bce4cda381df7203e42f00434eb58d392a4c5fb570ec30f80eb44f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195511, "uuid": "40c38df1-a0ce-4e99-8958-21a488e27e73", "value": "T17135BEA56F09A257E7C1A1F31804D7B6EBACBD4D2416C0883ED13D8FB1B9D6C1112EAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195511, "uuid": "3a220f7f-9686-41d4-82ba-5aee68fe1046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195511, "uuid": "91eb0b21-536e-44df-ae52-79bfdd975bc5", "value": "12288:70X3rBVmNUc3DtGgbTdRA1100GQX0CuNuTDnnuQEINNeBVlRMqB5lhVj6DW5OqBo:q1YNUcdo11eCx//0B5llhVeC5OqBpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195511, "uuid": "5c665da6-2aa9-469c-9ab3-c8e2a63cafbb", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195511, "uuid": "3843875d-c9f9-435f-88af-7029b8ef3885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195511, "uuid": "373d4eed-7a64-40d9-b360-04cab4f5e7f3", "value": "fattura 22109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880b4d33-bcd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678184792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184792, "uuid": "d97e6eea-4ce2-4afb-8493-1ca399fda86a", "comment": "Malware payload (SnakeKeylogger)", "value": "27734b51105e9e22ae20f6f9784fe001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184792, "uuid": "97d00c10-3443-4e83-ace5-0092df5d4e35", "comment": "Malware payload (SnakeKeylogger)", "value": "0143b411f3c0c02a845fa45cca9fd02df3da4334ad748fd119759f877c1e7ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184792, "uuid": "df7c4d3b-8784-4fe9-ace7-00bc82cfd49c", "comment": "Malware payload (SnakeKeylogger)", "value": "a1cb7ee104fd4e431b23f4466d47525faa5ebf6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184792, "uuid": "a127ab0c-a8ac-405f-a93e-78c1798b879a", "comment": "Malware payload (SnakeKeylogger)", "value": "d32bc3b58ce1ade6cb21f8cdac60c2dc4b74d7cc4ad66bb7e21a24c1e0782073966561c5e4e36f7eea2e544a4fdfd055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184792, "uuid": "25f4fc60-47ab-47a8-8f83-3c2f9a6db47f", "value": "T1EE05370B642ED002F49D21B51B16272FBE78D66D1E67E6F63685546BD00AE233FC2B34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184792, "uuid": "7e4796b2-09a5-46ed-af58-f83594847179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184792, "uuid": "1426666e-5ed4-4ed5-8701-a29cabfa1297", "value": "24576:H6CCF1W6ZesX2vB9OLmncRaoBO3arkG2T0piGK0FG2U:H6CCF1W6ZesX2vB9OLmcLO3aIG2o40Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678184792, "uuid": "324233ec-960e-40c6-8c73-234ec1464c5e", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678184792, "uuid": "36de28d0-163c-4740-a4c2-081b031ad27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184792, "uuid": "e77e2c69-b10a-41f9-b4b9-baf7ff7cb3a3", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1796d1b-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192137, "uuid": "ff4612fb-62ec-455f-99fe-e0e7bd2965a7", "comment": "Malware payload (AgentTesla)", "value": "56147741a28e6e2a82a865534a9c57c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192137, "uuid": "4f90cbf0-6b01-45de-9442-8d465e729153", "comment": "Malware payload (AgentTesla)", "value": "02876cdedf9481c017eb1ccb1b594bcfe7e791a6b9095752730c77705c47fcb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192137, "uuid": "ef49cc76-b96d-4a3a-b016-e4574139ada6", "comment": "Malware payload (AgentTesla)", "value": "b4f7587cbff54ef935673adccc394803557c822f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192137, "uuid": "3f322492-bb50-4245-8c98-3af7902acc27", "comment": "Malware payload (AgentTesla)", "value": "49c88859768992b299c94f591a03bbf305f1a22c4d4ff966cdb7e92132fecbab389b4094a7af45f693ec0c6ab2721bca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192137, "uuid": "d1aadb17-b92c-4403-b2a4-8eae6769cf8c", "value": "T19D442393641F13C0653FC992DEC5AB7DA62750FC7C9ED105EF4E421690AD822D0AEE2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192137, "uuid": "d3cc39f6-14e9-43f7-a0b3-49a4b4fcad55", "value": "6144:hStI4bbHGlkmmgiGeGhG+D2KwHKoI4vMzrkVFzZ2caRhcM57I2fg:MtVDSeHnKwxMrAFzyRh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192137, "uuid": "aa7aaa38-f8b4-47e3-9437-6580112d0f49", "value": 260216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192137, "uuid": "8f19ba35-9d33-4c52-b1b0-b2b6cbec36a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192137, "uuid": "79266e0e-dcb8-4972-8f73-68d0cd2ea2dc", "value": "QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d5b361-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678198667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198667, "uuid": "3fdc2d81-9f18-44e1-a71c-ccc95e8c3a48", "comment": "Malware payload (Formbook)", "value": "dcb7eaa1fd51e975b67a3ed92509167a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198667, "uuid": "80eaf4a4-b0fc-41f4-9051-32377ff36d22", "comment": "Malware payload (Formbook)", "value": "030d9daf754e7d55b6690abc958386c7bd69c539b50a971b2a61b0d14210a498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198667, "uuid": "ff31117f-ee50-4915-8e10-bc570da66e16", "comment": "Malware payload (Formbook)", "value": "528c5a4837a195707581724d408c809433f14a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198667, "uuid": "65fe1788-1466-4df3-a095-9e6913476449", "comment": "Malware payload (Formbook)", "value": "8cbafb5944930a72b2d28555c5660903de4d93f02923ac7a251c8389f70f5e43518166bc1e5f8c4f638cd557ec4dce1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198667, "uuid": "7f9aa40e-a189-4fe9-b2c6-43a6d4a70ff6", "value": "T1D9A4020C52713B6EF8B45BB46C6A0AC53BA8AC192753DD0B986B05F32518B878F53F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198667, "uuid": "c2b8cd1c-6b57-4458-8e54-f955fabea966", "value": "6144:WG0tEl7ERlzVxn5zLTjgpjdGXq7IOVf4c0Lu8nuyqvM30vakSNMmoYqTVXwIuODf:BCFzbF3g1kXqZf4czAVMmlq5pTlEv1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198667, "uuid": "aeaf130c-3ca4-4202-bbef-f3063b07a523", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198667, "uuid": "1d6f38cb-7d30-4297-b9c3-01c2d7a8ce7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198667, "uuid": "bdb759a2-f71e-4dc4-8c34-2c1e70ee7f0a", "value": "030d9daf754e7d55b6690abc958386c7bd69c539b50a971b2a61b0d14210a498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72857b36-bcdb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678188622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188622, "uuid": "d8889112-5fd8-45c2-9e75-caa355968f8e", "comment": "Malware payload (AsyncRAT)", "value": "fb748732bfd0f4f2d1c6e4e6df949591", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188622, "uuid": "3dc39fc8-960c-4a1f-9e98-898937271d9c", "comment": "Malware payload (AsyncRAT)", "value": "03507849f9ee5ca0a1722fdfd761d25e471050d228492f530ef0183d8a68aa7c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188622, "uuid": "98a664cc-0f07-43a3-8566-4f84e70e9d9c", "comment": "Malware payload (AsyncRAT)", "value": "b993ef483acac642371c6b419d56cd34d7dad73a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188622, "uuid": "9b49f654-74cc-4ec3-8883-a3241774d988", "comment": "Malware payload (AsyncRAT)", "value": "94fdc547e3f1774d39bcc68915df893507a804d709c24356d7a22238094fd36d8edd59be2dc6959d80f84199583904bd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188622, "uuid": "829f0e8e-0671-4fcc-804a-a4270270da29", "value": "T12845F14ABBD09B17F46E6B7A94322A00A5B0E0837743F36B589D68250ED63DC5D037E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188622, "uuid": "c63f08e2-12b3-4ec3-b215-4aa21c2a5303", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188622, "uuid": "d162c123-af3d-43e3-85d4-23439c3b0cbd", "value": "24576:gV5w4U/a+m+Xtu9eaH6xdk5Vd1iDsBfRyERLvJqlZlJla60kT:gHFUl09ePxyUOjJEZlJ060", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678188622, "uuid": "b8bef5f5-b32f-43ee-a41d-288f87e4cc8d", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678188622, "uuid": "2768b57b-ba0b-47ad-956f-069a60183f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188622, "uuid": "548ecac4-a289-4acd-9aa1-e342986a8725", "value": "fb748732bfd0f4f2d1c6e4e6df949591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa558819-bd14-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678213331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213331, "uuid": "1958863d-4651-4e04-9a8f-d0554a00abad", "comment": "Malware payload (RedLineStealer)", "value": "845708fe8e574bb4ae832556c0598a40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213331, "uuid": "9e123288-4af3-4a52-83a7-d52343472f28", "comment": "Malware payload (RedLineStealer)", "value": "03d64d5b343e6d39c98916b02fcaf9a90bf0eef42e35e3b9d6dcb1ad735ec639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213331, "uuid": "e2ea17e5-5e46-4168-8282-e6f08db67a2f", "comment": "Malware payload (RedLineStealer)", "value": "9c85ea1653e0a6cd465356bba04ea0b5b106a7e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213331, "uuid": "3696ab75-36b2-4e59-bdd7-787bc8694a21", "comment": "Malware payload (RedLineStealer)", "value": "c785853294ced03bcf647a702e8c08772e99e2faae0651ca152c20e85c30f77cf57865aaae6a35b0b76975b1fe24f62c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213331, "uuid": "4b9df77a-f1b4-49e9-b805-4ae6b88d678b", "value": "T1EE84F121FFD1C072E5AB11705562EA946EBEB87257A8C58B332C87AE1D302C19776337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213331, "uuid": "4b86e0d5-5413-4d78-907a-6e5fbf9e529e", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213331, "uuid": "26427e9a-7129-40e8-a113-e457af87e153", "value": "6144:YDyLvynJ4RHDXpQQU5eMhu1TdUdlGTsD5QXzoSYULKQVt/4eZu:YDyjyeDXpjU5Ju15UpD5QXMLUL9VlZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213331, "uuid": "d1958aed-757d-4da3-8496-65569819d692", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213331, "uuid": "4f02e215-1108-47e0-b8ae-4c9f6f4c2f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213331, "uuid": "d238b221-6d2f-4e9d-86a3-6f6313db6d3c", "value": "845708fe8e574bb4ae832556c0598a40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad15684-bcc9-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1678180878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180878, "uuid": "c56acb3b-d01c-4984-b441-13449732d460", "comment": "Malware payload (CobaltStrike)", "value": "d438f4f0cd9de5f51b8ff401e51d7fae", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180878, "uuid": "20915fd4-842b-4240-9f6e-48cee16762ac", "comment": "Malware payload (CobaltStrike)", "value": "04193e2b9a24c7c63914d71bbff1ca8612b089750a5645caa6c143fc0a1c376d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180878, "uuid": "8f9f3a52-c44f-48e2-8cb6-6267f73ff577", "comment": "Malware payload (CobaltStrike)", "value": "fa92e51cace0da018119a3f95e0648e6e33f288e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180878, "uuid": "4a864498-56aa-4a9b-b9bb-99f0dcd3fb1d", "comment": "Malware payload (CobaltStrike)", "value": "157097e63fc971ceba3ec5fad0dce5276827207ab5b2e13fabeea5b792f5531a7bdae8b8021af413060669fe19772fe6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180878, "uuid": "f2bf0d2e-3ac3-4843-a9bf-d7afe30a5d48", "value": "T18164396EDD240887F75A117B44092E9A89F864DC5989F913C9EEB89037244BF378F3E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180878, "uuid": "7abd8ca6-6c1d-4d93-9b67-b956bd494845", "value": "f97b1ab15a04571652800cccf367f73c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180878, "uuid": "f7b4d9ef-9aa2-4fd3-89e2-4262ed29b036", "value": "6144:6HwGL86EIUdKVy9Dwxdms4yAzFaFdtkBYYYYwYYYYYYYYYYYYYYYvPAYYzEKUo01:Cwv6NU3qopVYdm5t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678180878, "uuid": "5cf8d09f-eff0-4e78-aa20-849b1f0ddd91", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678180878, "uuid": "dd04e6fd-3e79-46f0-a4fb-db3f26fe239f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180878, "uuid": "2a093ad1-cd90-4600-a067-aac2094e2176", "value": "beacon_syscalls_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c96bae-bcfa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678202130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202130, "uuid": "8ad6d654-31cd-47aa-8d84-86d1afa74a74", "comment": "Malware payload (Heodo)", "value": "fe1097b9754d8e3c54c7f54c68c4dabd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202130, "uuid": "d61071d4-2959-45f8-a50a-04fc452ac941", "comment": "Malware payload (Heodo)", "value": "0442c122d6e81814ff1393a1cf430a4173acdf1b9df8228fe7bd3fc32455a9cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202130, "uuid": "bdd56a9c-8143-4f0c-8b38-ab026f7f007f", "comment": "Malware payload (Heodo)", "value": "d8c67642d40723028219c6948ef893b691f5c57e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202130, "uuid": "718beeef-a343-41da-b2ea-726e26b3c226", "comment": "Malware payload (Heodo)", "value": "5d261665a5e00315404740832220b4fed776c8d71716937ba322d7e6d0b38866e840ab4dafa286265f103f2f1b4afe36", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202130, "uuid": "30489625-1728-42d0-b034-09621a8c4a27", "value": "T10DD47C0761F1E5B8C205C134468EF4329732B9CD1422EA9F26E1D6712FEA6B21F7E56C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202130, "uuid": "7c0cefae-4f8a-4e46-81e1-040a3d97b06b", "value": "cc3581383698e8ac046128bd4d34bc22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202130, "uuid": "48cc483c-2e92-43c0-bb7e-aad78961263f", "value": "12288:nbHoJMjhwwvAQ4c3wSlnJTrmONFV7iDpSpyNlTgibIUdzhnQawN/JsjHz:nbHoJMjx4c3wcFZSSpyNlcixzNQa0/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678202130, "uuid": "70fe965e-8855-4c15-98fe-4a33f96bcae5", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678202130, "uuid": "4f98c3f7-ddfe-4e02-94e7-8820b670a6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202130, "uuid": "4e0cfe3f-a6be-457c-af7a-71888d94002b", "value": "pzOEfyaZPW1OyO690Z19HEU7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1ae786-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1678175699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175699, "uuid": "0c1e5ce2-d59d-46fb-9b78-01eb9cd6c0d6", "comment": "Malware payload (NetWire)", "value": "cf4a7094acb7f0d2a002f5bbb6b5db9a", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175699, "uuid": "49932714-66a6-4062-954c-224e874ccb1f", "comment": "Malware payload (NetWire)", "value": "046bf1870416a2ea4108d3809fcdfda514663aa9fabd74b88f78c7e332eb397d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175699, "uuid": "cb5d2c07-d32a-4500-9fb0-d65f3201d5d9", "comment": "Malware payload (NetWire)", "value": "fb2c29986c75820aba0d45605fc6a225da8b0bfa", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175699, "uuid": "4cfbac1b-4fb9-49ed-ac58-75bbee3a16c5", "comment": "Malware payload (NetWire)", "value": "f9dba1e74872c559acd1a6f98367251c4f9eb22bcda2bf223fb4914aec9508e7bcc121141b3a025d6cd3260f96264a93", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175699, "uuid": "184af5a4-58ea-4a37-81f6-43fd33a6033f", "value": "T15965BFE42F5D6263F786E1F328042BA7DBACBA5D2517C0181ED6118FC2CDD6C5112EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175699, "uuid": "8abe219c-ec95-4b0f-9768-ac5f1bfb0a5b", "value": "24576:7g7gUMoMnm9cU9VHb5Z763rs7u8BeV67s7nCrt8dB:xWMnGcU95nAsyTKug+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175699, "uuid": "ffa55bd5-bb13-4f1e-9027-a90896208aad", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175699, "uuid": "40522943-4b34-4d5f-b861-77f19cab63fc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175699, "uuid": "fe56c9fc-867e-4c1d-809f-3cb9482b5c6d", "value": "894680380-ALVACO ORDER 2023.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e00fc12-bcf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678200962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200962, "uuid": "21ac3e2b-8515-4366-aa8d-067c7cc0d70c", "comment": "Malware payload (Loki)", "value": "4885682f23a3e4d30f36031e374829a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200962, "uuid": "ad11df11-c87e-4c7c-b1c3-250fa74dc29a", "comment": "Malware payload (Loki)", "value": "04806bf0d8bf3a0aeebceff61c565d2da8c2883a23098a2de284154d671f69eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200962, "uuid": "aea03641-780f-444b-9dbf-80460425cabc", "comment": "Malware payload (Loki)", "value": "ae8221abf269868bfb9a46a14269081ccdb01a72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200962, "uuid": "ff8f173c-d6a2-4822-9046-9be5ee81cdee", "comment": "Malware payload (Loki)", "value": "72dac4a47c0a089ab17bec7d3b86f12efb6bf79486375b33a07bd274d04adfac208cc8fa2336feff2c6a0d34743d7eb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200962, "uuid": "de774757-8728-4c53-9af9-361aed496d2d", "value": "T1AC158DA56F196253E7C5A1B31804E7B6EBACBD4C6427C0883EE13D8FB1B9D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200962, "uuid": "a59f7479-5513-4b0d-93db-0b11f63d0560", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200962, "uuid": "4fcf9512-bce6-41d1-861c-9e36c8179fc9", "value": "24576:3wYNUfqBpsQ1GeA5bfyzjqLVHPLuRczV:/NH6nVD0yV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678200962, "uuid": "507cd417-6507-42b3-bde9-5f9ed78cf402", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678200962, "uuid": "de9ef625-6b3d-483a-8935-1a9014f9f557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200962, "uuid": "60aa695e-5c71-4ef3-8a0d-9ba08c8da53d", "value": "4885682f23a3e4d30f36031e374829a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7bd2b9-bcfc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678202894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202894, "uuid": "bea87007-42e4-467c-b745-c3dad39742ff", "comment": "Malware payload", "value": "66d10732365703a35d8f4f34f0322023", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202894, "uuid": "cb911347-ebd3-4a98-a0d2-078045055c4c", "comment": "Malware payload", "value": "053877cae27e1b2cb0aac24b5a562736be62d2756dc9897eca8e72e39ff385f9", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202894, "uuid": "bd55ebd2-b245-4ec2-bd01-08f83a175f90", "comment": "Malware payload", "value": "9f867fb31d6487ac79bedccce579380e20ace469", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202894, "uuid": "bf84e10e-31c4-4c47-bdab-23c4a882875f", "comment": "Malware payload", "value": "7885f7b91f6941fed1a3a370d7b35fad6d5b1e99c9c951a3c416f9ccb4adce1ff8594d5c9908f987d689eb13ac40b7f2", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202894, "uuid": "1208c7c5-dd4d-4fdf-a89b-f45c03a07c70", "value": "T16DB6333C3DD5B59371743A884F07E9BA396DB0E06A6B88E5BEE174E31D6C24DD442A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202894, "uuid": "7487b386-831a-4561-be45-7fb12f97d950", "value": "196608:7wfYNumid+M9pJkm2U8/Zr97FGu6q47TvLQmpdVcqIa7B6hjo:BudJOPN/ZjG64fvsLqz1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678202894, "uuid": "3c314a41-7b5f-4b48-ba8e-d494d3539981", "value": 10502995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678202894, "uuid": "ec252a0a-2721-479b-a524-a0d5750c985f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202894, "uuid": "90379570-49bc-4289-8998-3dad794b960b", "value": "Chat_GPT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aabec36-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175643, "uuid": "7ee4ecf8-e264-4e49-8a1d-914d50256378", "comment": "Malware payload (Mirai)", "value": "5f13fae32fec1f62453564aff7a4dc5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175643, "uuid": "ead50f49-5748-4aa4-8874-66ab389289c8", "comment": "Malware payload (Mirai)", "value": "058733970971bdab18e251ab28d4eaa56e7e306025fa21a394100e15e6240ed4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175643, "uuid": "6cb9b2aa-91c3-445f-b502-9cbaa3678711", "comment": "Malware payload (Mirai)", "value": "431ea0700d84660f134c504a7be2f938a497f7f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175643, "uuid": "332ec987-c7ba-467f-b5ba-107e381ca7be", "comment": "Malware payload (Mirai)", "value": "8121027d99c1daacf8cf47dec968fe72b302c6ce869e62d85855ecf6549b71520a8b66c262d27f4b33044c9e6fd74710", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175643, "uuid": "7fb96149-5c02-4c1a-a003-bc56d37827ed", "value": "T12ED35C42EA408E03C4D51775BAAF428A3322A755F3DF73068E189FB43F86B5E4E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175643, "uuid": "494bb696-f8b4-455d-94b2-6ba2ae327b5f", "value": "3072:SU5jGVmyqyuKwTxWHLIS1mPzr/qROYTraGUpM/9QKTw:tMVm/KwT+kS1mPzrCR9aGyM/9BTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175643, "uuid": "843d3fbf-a772-46ed-84cd-59a0314ad99e", "value": 138317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175643, "uuid": "77c47edf-8213-4cf0-9cdf-1959a4d991c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175643, "uuid": "a0207ed4-1602-42b4-8327-38fe6fe04b5a", "value": "5f13fae32fec1f62453564aff7a4dc5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d04bb2-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678196197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196197, "uuid": "b9c5cdbc-c892-4456-9e4d-9ff34839943f", "comment": "Malware payload (Mirai)", "value": "7cbe1d86eb35bccba5974fb0e0b98421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196197, "uuid": "9c26520e-fec6-4b68-a372-33b5f3bc8f16", "comment": "Malware payload (Mirai)", "value": "0608a12ed3f50e1ccb219309c24371d88e13715818b3ba738c4695481b1c63ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196197, "uuid": "e541fa0f-e00d-4e5b-b9bd-b0e4115573fc", "comment": "Malware payload (Mirai)", "value": "f9e98e0d30b08781e92af5b84a122128b4393351", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196197, "uuid": "e682dded-55f5-4d52-99b8-cf8988cef757", "comment": "Malware payload (Mirai)", "value": "2bf07f85f647daa0c3808cb7548f205ea0d826df807a70562c4f33b0aef9532736f9d2d33b42a45d4a95ce6874abeefd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196197, "uuid": "e288d81a-46bc-4438-8a63-f6b638ed20fc", "value": "T15DD2E18976D253FBCC8DC97DB21E403630AA34E9B6B29323B305D4530776181E686D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196197, "uuid": "e0084beb-bae5-40f8-99d2-e6df6fd5b1d0", "value": "384:MJd/PxEDLd2TwMWzB6lowYcE6qs+9OC450LQixBfE4jdlz0lewZ90BKhANTUA4N+:+lxKd29WcxEHs+V6IHE4RlY9902mTfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196197, "uuid": "da685c29-8345-429b-9c73-140de1700207", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196197, "uuid": "deddaba0-8153-4344-b85c-e8977ef4fb6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196197, "uuid": "5745b3e3-30a6-4e40-8825-dcd8ff1a8231", "value": "7cbe1d86eb35bccba5974fb0e0b98421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f0e055-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678198583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198583, "uuid": "4636d870-55d2-4c58-b7b8-924557c65141", "comment": "Malware payload (Formbook)", "value": "4ab43d402b20f8277d8182b67c0147d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198583, "uuid": "b2f0ef46-f090-48cf-ba3a-c7ddc5267c8e", "comment": "Malware payload (Formbook)", "value": "07a32665c106d4c5fab2625bda4d52f6c40b8137728f2ded016b90cad95a8545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198583, "uuid": "99d855bd-c1ef-4420-ac8e-af66dcf32a9e", "comment": "Malware payload (Formbook)", "value": "c552321e3d53e9fd9a2fbb52bd77991112c86bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198583, "uuid": "301f50fb-a9e7-4861-b8cd-2aaf166cf114", "comment": "Malware payload (Formbook)", "value": "7b6887821d8f28eee6d609122ee09dfc89f475f745529a6aeb53558f217c99234cc9d708cd675124702780f7a60d57dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198583, "uuid": "035b2196-7b76-42f2-aac5-79aeac1bf406", "value": "T1E2441260BFF4E177D0AE0A709A3B26A2AFBB8E1611B0079B1750254CF953395F90E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198583, "uuid": "5676242c-2d25-4b2a-acc1-cdcfabf060ad", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198583, "uuid": "7ae084ac-c39b-403d-8c55-84575eb2cc64", "value": "6144:NYa672bt5A6DWUhcAHwvrpzmKW7hP2XCpG8:NYNctW6aUXHOrpzRwcS08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198583, "uuid": "64e11e06-1a00-41f4-9370-d5f9b8b66378", "value": 259365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198583, "uuid": "73cc2dc1-138b-4a92-b720-3dadb09ab253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198583, "uuid": "10e3fe2c-e76b-469b-bae2-6d80e5e31c48", "value": "hesaphareketi-01.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81daa366-bcfa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678201962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201962, "uuid": "1a78ed1a-7945-4ce2-a48a-e132b28de324", "comment": "Malware payload (Heodo)", "value": "0adcf412bfc4fcb5d87415738938b3f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201962, "uuid": "1d92d2dc-153b-421e-81fa-699c69b7b32b", "comment": "Malware payload (Heodo)", "value": "08467a897695c14e4f4ec7c389de6d2031c54e9c2a7dbbce0b8aaccae3d647c2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201962, "uuid": "24e4bd55-1584-4181-9d26-79edeeab08c0", "comment": "Malware payload (Heodo)", "value": "994a84b8d2ab14a899b8416e9b11b5af4ae291ab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201962, "uuid": "12932329-4472-41ac-acd7-b511b4a194e3", "comment": "Malware payload (Heodo)", "value": "14404871fcae7e7346701a6f1f6cccf826fe2278280ba564010ec1517a9a29b9f02fc37bfa6f94a8f4e079a305270455", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201962, "uuid": "1c6c3a76-9fd0-4263-8932-6bb8e741e11d", "value": "T1541523F8FEB5E497F489E03149468B47C28CF9C6C6D9D9C612B8467D9043FEB0B09946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201962, "uuid": "f94472bc-d2ee-404c-b363-6ce94b2fa8cb", "value": "6144:8s929TDSYLJY3lhXf0cJzkHFliEo6BMTJgw+b2S4oMUCIkaAWr92GoKO33Eq:8VHSYLJY3l5zzkH3L6gjt4R5+tr9vYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678201962, "uuid": "a3f895fe-ce39-45a7-bfd4-918d98b3eb04", "value": 914704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678201962, "uuid": "6cac093b-d4fa-42fa-b9d0-8d99292b372e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201962, "uuid": "6a48ae51-1b9e-4d8c-88f8-0a3694e5732c", "value": "ZkQQi7We6Y.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e10ecac-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175649, "uuid": "9f094e25-ba1d-4a8b-b7e5-9f53ca87ab44", "comment": "Malware payload (Mirai)", "value": "14ec632635a970ae1c0686c175fd492d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175649, "uuid": "f7cfacc5-f680-46f1-9385-c558a56790d0", "comment": "Malware payload (Mirai)", "value": "086f3861f234b0eb89643113a0df7f88d830b7d2627ecaab4067650ec9f7174f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175649, "uuid": "15d7c848-ef09-4ad9-9e37-a6cd52cdbddc", "comment": "Malware payload (Mirai)", "value": "030975e8d7081d59e1707ae69f039268356cde02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175649, "uuid": "7dd3eabf-81ba-4e9f-b718-fabfa72a109e", "comment": "Malware payload (Mirai)", "value": "b57abdbac18911d763a426f037e48837bd2c12ab719ad73c74db214005567c20f618229a356cc905b91dd99dec1ef942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175649, "uuid": "168e126e-7f47-430c-bd41-3d6c5701fc5f", "value": "T1AB83544E6E318FBCFFAD863447B75B20924933A227D1C584D19CE9021E7464E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175649, "uuid": "7c64346c-3c2c-4b0c-a37b-0994e9ec7114", "value": "1536:0w2PRgheSlyxAACgDh66tbD6/kWnfDyeN+S/RCaXk8MF:7SRghejxAABI6tKkWnfDl+qHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175649, "uuid": "15311df3-a13e-4f6d-a6cb-bd43d29b7af6", "value": 88144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175649, "uuid": "ab4c0740-dc00-4c66-ba28-b9875dccf94b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175649, "uuid": "6bbb62a7-ed6f-4889-bbda-65ff227cf688", "value": "14ec632635a970ae1c0686c175fd492d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bc7c67-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191989, "uuid": "f4845c26-d67c-4f1e-9ed1-2aca2f5b9762", "comment": "Malware payload (SnakeKeylogger)", "value": "f086adf543e3402b89d92478eede241a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191989, "uuid": "5f4c6f5a-759d-46eb-88f7-35adc17df55c", "comment": "Malware payload (SnakeKeylogger)", "value": "08e04faa04ed269f7378476ccf3296ef3ed403817ca6ec26277a4d4fe82bce3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191989, "uuid": "03a556de-b703-46ae-b9e0-d15db9725c6e", "comment": "Malware payload (SnakeKeylogger)", "value": "c42105fbd2b820324d10b3d8cf0a62f9d41c755c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191989, "uuid": "b2878602-692b-4a5d-b919-c5f0e4f297ae", "comment": "Malware payload (SnakeKeylogger)", "value": "faef371b85d6d36c4577b349cffc390d3279485ebe65b2bb5dcc44bbe137c4c7272e01f3c9aff6223d93865fd060d2e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191989, "uuid": "854618fa-e08f-44d8-9729-bc49d5f8d2ce", "value": "T1DC059FE42F5D7263E786E1B3180526A7DBACB95D2527C0081EE210CFC1CDE7C5652EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191989, "uuid": "f9a1347c-5ab8-45d1-8287-df02539d9692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191989, "uuid": "5e0a3a91-fd5e-46c5-89c5-1e54a413105b", "value": "12288:TvTXpXhkZxXUWrgrgYQyMiIPWRQskY2OHwLsS:Tv7pGpgNQyMiIP1Y4oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191989, "uuid": "a32c81e3-cfe3-4e1e-980b-127723a3cc5f", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191989, "uuid": "0578ac58-91fc-4442-9eb3-7ccb702b3170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191989, "uuid": "3fc109e5-10e5-421a-ae75-b418295845e0", "value": "Shipping documents - CTM - Draft bl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf902102-bd2b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678223111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223111, "uuid": "05318a58-1a89-41f8-b50b-a437670d75b8", "comment": "Malware payload", "value": "9e4d5fb4a69f85b267e595e3ac2565e3", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223111, "uuid": "bf73d409-c55d-4288-abe9-569d2edd2e10", "comment": "Malware payload", "value": "08ed972fb6d88ef000b2825e2818810b282507ec90dcc406fa5999f507a71fc8", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223111, "uuid": "dfe9abaf-c865-4864-8dd3-b041f109ee28", "comment": "Malware payload", "value": "9be4c15d8acf57a1500099a0a92c2f1624878352", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223111, "uuid": "e0c4aca3-5601-4c25-8502-8481c0ca4e73", "comment": "Malware payload", "value": "5aac7b5a7d2516bcd8eda3ef22090add8c12f91d30893127547ce96e304916646bd0213bd8baa6ff84452afa46cbc9bc", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678223111, "uuid": "0480072b-b9d0-420a-9fa9-23f2df56b047", "value": "T11B84F13CBB4CAE61C2FE45BD98E265E05730D21B868BF70FACC9196818417DB4E8535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678223111, "uuid": "a110259a-3ef0-4376-b30b-7540d270bc3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678223111, "uuid": "5a55768a-756e-489b-8ddf-39b5d256193f", "value": "6144:m6tnAUKxBgwX2E6t/iNcoNXPpDRzC8LZvuu+LuFfLfev1/b3yWsOM2:m6NAvh2Zi1x8YpuuquFsfsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678223111, "uuid": "f15ea28f-0aa8-4b3f-8d01-444a665d0565", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678223111, "uuid": "4bcdebcc-417f-48c5-aa5c-25603d3c643e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678223111, "uuid": "90b10737-0942-4585-baa9-e89fa33eb96f", "value": "pureland.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd24ff5-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175595, "uuid": "67728b13-2421-42ad-90fe-f0d01715742c", "comment": "Malware payload (Mirai)", "value": "52903207cf39dba8fa7a206ff9921120", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175595, "uuid": "a7812cf2-d8bf-42f9-b78e-926dffa38d2d", "comment": "Malware payload (Mirai)", "value": "093ce9bde2a02c53a7a8dc8d044f20e8ca703e05c47251e1c924f32d612e724b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175595, "uuid": "906dbc43-f121-40cd-842b-c872c357745f", "comment": "Malware payload (Mirai)", "value": "7c7c362e4487d3662f079df029174eefcd2beab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175595, "uuid": "46833080-ea85-4a93-be6c-b7a0579cb974", "comment": "Malware payload (Mirai)", "value": "0d4299eca4f209cbd5a7ff2d6eebc90546552ed15a2a1807cf5f75ae7e7e2bf905fe363ee7669574d21381b9261a5ae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175595, "uuid": "d36b59ea-32f3-45ae-a817-9bacff25e503", "value": "T17BF229C18A43C5F5DC2256B5107FAB51BF76D4366A36EA5BE36B2A31AC03700970339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175595, "uuid": "8d21d47e-3dc7-4bcd-990c-45302a8df1a7", "value": "768:/71FdwgBFcBmUUiC03p1R3Li9eowhyyBGs/VDbn/bWmT5ch:z1FdwMPxw3p1ZLiU/B3VDb/bDT56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175595, "uuid": "367831ab-39bc-4b83-959d-90e521bbee50", "value": 37648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175595, "uuid": "f0047e7b-ecea-4a94-8b05-05e12693f78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175595, "uuid": "025119a5-412e-49cc-8ea3-3411ae7a2b64", "value": "52903207cf39dba8fa7a206ff9921120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eee8ace-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678209715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209715, "uuid": "ce83ed2d-a897-4fa1-9ec9-955d98e88f5c", "comment": "Malware payload (Gafgyt)", "value": "ce3db12bb8b72d9a81cf90d505eb3dcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209715, "uuid": "ed16cab2-6922-4b67-89a9-acfef0e7afac", "comment": "Malware payload (Gafgyt)", "value": "0a556897a6b882c9859d41ac0bd8f0eb91a7485acbfb2cdf786ea0d11a6ccb17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209715, "uuid": "6e67d892-8b8b-4d1d-be5c-d893f8c176aa", "comment": "Malware payload (Gafgyt)", "value": "f8a0ed25da070d36e24d747736853eb18a2f0432", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209715, "uuid": "6930cbec-3511-4e37-a433-ed0b47b46cdd", "comment": "Malware payload (Gafgyt)", "value": "3f3666504d923193306f1bfdd40937d8e048765de3ff12e976bec13e2288431a26df0268e414c051ce20289c3487cf3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209715, "uuid": "14503040-8d5a-4ffe-9466-4e42d75016a7", "value": "T120933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209715, "uuid": "2ee655e5-e563-413f-b19c-367df38078e7", "value": "1536:mmqmWTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2em1GMUNLe5um7WAgcVjmZIcBI:mms2UVUtBUI8GwPfHkk8rPeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209715, "uuid": "94a26918-3e35-4ddc-bb75-48023c6751a9", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209715, "uuid": "dbd7ba06-77ce-44de-b4fa-582161382c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209715, "uuid": "53d8cb3e-6fc0-4bae-ab78-3d875925dd30", "value": "ce3db12bb8b72d9a81cf90d505eb3dcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01245b1f-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678195733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195733, "uuid": "2aed3853-a6c8-463c-ac72-ce945d13bfc0", "comment": "Malware payload", "value": "cfc18196e82e090de3ed74a8143adda2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195733, "uuid": "886f2f64-7ee3-49ed-81ca-1f09d540baa1", "comment": "Malware payload", "value": "0a6da3921e147ab6decd74810e0f1574e22190608d7517fc033eb10e43afb6ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195733, "uuid": "a5053992-f6f1-4f7d-a8c3-3ebcebea5996", "comment": "Malware payload", "value": "5be449b2d01867c123173e287f60bda54a6de702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195733, "uuid": "a7be5bad-e1f8-47e1-9d78-c51662d4e90f", "comment": "Malware payload", "value": "6dce8bc5580550a5fcd57d1101a605d6e7a4a09ae44b4d17aefc06508e7214fb21b2e383d51f170b0c2c7eab36d4178f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195733, "uuid": "7e10238c-db41-471c-9258-40acbb819f12", "value": "T13734F94B150D0090D9FEE87CC9B26359CD7C35B1DE827ECF2A25397106E63EA662B247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195733, "uuid": "ee807149-5168-4ac4-8689-21add432e840", "value": "a2d4527ac8e082584c9e4702ebb035aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195733, "uuid": "65741510-791b-474b-8887-78db2b6f2d4b", "value": "6144:lmbC9N8INN70ZLPHABT6GXOLECD5kgOR6ryOl:lmbC91+HSCD5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195733, "uuid": "b7f4cc7c-113c-4f3b-9cf0-45faead7a8aa", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195733, "uuid": "dbe66411-c4ab-4a90-85a0-6f48b2e3efd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195733, "uuid": "018b815b-accc-44ff-8d32-6d62e6d8187c", "value": "cfc18196e82e090de3ed74a8143adda2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca30615-bce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678193685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193685, "uuid": "159fd496-edd2-492a-8ca4-1e12e436f62f", "comment": "Malware payload (AgentTesla)", "value": "76a0578346bf8654389a974a91308d5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193685, "uuid": "599b6108-db4d-4e9b-905a-600cd3e93e6e", "comment": "Malware payload (AgentTesla)", "value": "0ac587dbe7bc1c9d1947ac51603c009d3d862a71d3027cf0677da52fc534dd30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193685, "uuid": "1423bcda-5bfa-4977-a3a0-945efcda185a", "comment": "Malware payload (AgentTesla)", "value": "9a9b885f7aa74b53751cba0243fa0fc0d50f6c34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193685, "uuid": "718a4c70-7f39-4029-91a7-c843a8b170e0", "comment": "Malware payload (AgentTesla)", "value": "2fd4e30c82fca270ddee4930441ef019d667f21bc8d25365f122ecaf780f0081a93240980d0cf4d16dedafd39244be65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193685, "uuid": "10e232c1-5688-4c78-85b5-8e56f3a57e7d", "value": "T1AAF33A6C92C99E52D71D40F4C4A0315806B2A243461BFB9E4EB5ACF63E4A7D3362FC76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193685, "uuid": "3d79116c-e3b4-42e1-a61d-0a10eb7d44df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193685, "uuid": "45c8b2b8-05f4-43fd-8c85-8f44e28f2fea", "value": "3072:9jnPFXv0nntI1Yk2CamfM5RAfwZV29y5vORNWFE1zUu50XRpWA2:bv0ntiiCL0jBV29UpFEFxKTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193685, "uuid": "96b256a4-beeb-46c4-9680-01947491d434", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193685, "uuid": "0c6714f0-eefc-493d-a162-bd787406edfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193685, "uuid": "40e7c654-e79c-4a39-8c36-57203b9031b7", "value": "0ac587dbe7bc1c9d1947ac51603c009d3d862a71d3027cf0677da52fc534dd30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d092c8-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198553, "uuid": "45e08295-8929-46cd-9837-71597a93bf5a", "comment": "Malware payload", "value": "791f78299b068e26b702b1b0c54c0417", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198553, "uuid": "26f04ab6-d740-40e1-99b1-fa1abaaccbcd", "comment": "Malware payload", "value": "0b6c8776a31b8d3bea3c5b01e835974eab61a28ceef2661f375493620918c56f", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198553, "uuid": "14affc93-5c86-43a4-b588-9a1369166415", "comment": "Malware payload", "value": "461c4a70f8a083e3565816161eeaabd1bdaf6592", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198553, "uuid": "71237a3e-e28f-4268-9fef-8d225319bec1", "comment": "Malware payload", "value": "aa489298a617f0747a8c6436c30be3915e0bf74d17090f18f44397c44410d302bc1a7525fc5013a06324a51c51b460bf", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198553, "uuid": "2da291a8-e026-4d9a-9ab9-32fd26dc8dbc", "value": "T1AFE4495CAE172B05CD0E325A8FCE18D4496C8991DF22C0795EFB364A31F6FF9862A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198553, "uuid": "2117fa43-4c89-43af-98a4-e5f4a3fa851e", "value": "12288:zt9mMykiZo+FxNsUV7oBvwQzpBKtPN/B9AzZHDl:znutoxNTMx8zZHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198553, "uuid": "098f7cf6-af2b-44f7-845f-0e7f38bb2ea3", "value": 657941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198553, "uuid": "661fc947-5368-4b9e-b370-798f73421123", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198553, "uuid": "617cf67a-f103-46e6-8a72-348ba513e705", "value": "BBVA-Confirming Facturas Pagadas al Vencimiento.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dd7380-bd19-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678215206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215206, "uuid": "45a122dc-9a8a-42fa-bc87-49f25bd3ab28", "comment": "Malware payload (Gozi)", "value": "e300e7c359c3792e263a1de5dfeb6040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215206, "uuid": "685badb1-cff9-4f17-870b-124fb98ad633", "comment": "Malware payload (Gozi)", "value": "0c1d1a60a0fc143c9fc830be48c53d488b414921cf4d97d66466ff2a628d1b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215206, "uuid": "513b9d4b-e86e-49e3-b95a-51969582aa8a", "comment": "Malware payload (Gozi)", "value": "4951349e2d0112fdb7475ac9dfe9825096b972ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215206, "uuid": "1119a197-195b-4c9e-8a88-5a4de1723d95", "comment": "Malware payload (Gozi)", "value": "835bf3c5142e4119895f8aba14de84ccbc36044e9659674073c913c9fee897fef936c5ebaf9c0653b2d220794f786228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215206, "uuid": "4b2197b3-705b-4b3b-97a6-6e371f0cd467", "value": "T14144CE2272E1D0B2E6A7147068308BE95EBFB8F1E26DC55F3358476A1E303C19B66717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215206, "uuid": "b3e1e0e2-0f91-42ae-b9fd-0ee4f0148ce8", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215206, "uuid": "0ad8f444-6a2a-46c1-8e77-5c1b880e2643", "value": "3072:YiTkTkLBIs1teAyoa09He+O1OcNI9ZFFbzeAlWNwqBO8DdrFFtI4eZov:YhILvPenLb5NI9ZFFneK6/rFLI4eZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678215206, "uuid": "86b55e64-8579-48c7-bb6b-19813582b37b", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678215206, "uuid": "607c46e9-2d4c-421b-9764-89675e2b2a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215206, "uuid": "5986a268-a5ec-4ec5-aaf1-cb4da69a8c2a", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f035b760-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678195705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195705, "uuid": "53f33ea2-938a-49ef-82be-ad7fbb4c340a", "comment": "Malware payload (Mirai)", "value": "2be8878dcc24c06661cbc09762a64033", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195705, "uuid": "5155ffa5-ff01-4952-9ffe-2cbdc62daf79", "comment": "Malware payload (Mirai)", "value": "0c57427ffee4f0396b8f32a8ecd92206eac1e500fb260fb6b2a8b9453e16c64f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195705, "uuid": "faca27dc-e5ac-4846-b97d-bda1bb3ed80a", "comment": "Malware payload (Mirai)", "value": "56c1dfc483a4f47a1d8949dd42c26b0287e68c76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195705, "uuid": "30f32833-c321-451f-aa6b-2fd0e5e1c9d8", "comment": "Malware payload (Mirai)", "value": "c6414fa7ad1be5667243bd367019d09b7476f816dc3a7e6682a110935490620531988cdf2ae6bee0c2b6ee2ff8468136", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195705, "uuid": "0c066bdb-c158-4300-bb5d-2170e2ab6037", "value": "T170539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195705, "uuid": "3fe5f11a-9d3f-4b92-a116-88a194843118", "value": "1536:PaAtVnz1/mUUNztiYmW6ShiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwNET0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195705, "uuid": "82bb09e2-e92c-46f9-b69b-0fe6516a9c5a", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195705, "uuid": "b39e10fd-c470-4ebb-93d1-f47fa64fe438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195705, "uuid": "8c50aef6-d6cc-4204-bb52-c921e4a9b1c1", "value": "2be8878dcc24c06661cbc09762a64033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b11e03-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175637, "uuid": "6ee4b99b-85fd-46ed-ab51-34b279e4616d", "comment": "Malware payload (Mirai)", "value": "6f22460b89d59dd41e0591a16ccddea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175637, "uuid": "94d0b11f-596b-4976-bf80-e621595f1ae3", "comment": "Malware payload (Mirai)", "value": "0c6aec536d29bfe64f2fae8f24b8621404dfc8ee78056e2998618c2201a8aa9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175637, "uuid": "f1f92332-a5f9-4982-b25b-a09f646c9a90", "comment": "Malware payload (Mirai)", "value": "935efe301caf2a0b92aa6142368f4d5906be5ab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175637, "uuid": "614b2c91-018e-4546-943c-a9a9b832fe10", "comment": "Malware payload (Mirai)", "value": "5c0d52f30085c1764cad8814665ecbc599775d24e90f362343c5d161a9650dd8f98c8d21a61a1e0e0ea12951f24dcb54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175637, "uuid": "58ef2235-863a-4762-b8ca-19689d456293", "value": "T12D432BC8E5C7EAF8EC090E303172FF32D676E13E242CD993D7A45572E981A42D5162AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175637, "uuid": "95234814-6bc5-4d7f-ae83-b7fc91a90d98", "value": "1536:P8oo1J0PxynAN+I+GwEtrxtWxXu2JjtDleDK0dGVfExr:Plo1J0PxyPxgtrmxXu2JjtReDP0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175637, "uuid": "e185cc0b-270c-47c1-b7ce-4321ca37e436", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175637, "uuid": "d996b0f2-7d16-4d00-b526-ef566e94d73a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175637, "uuid": "6391c0a2-0b33-4da3-b362-3d21276d3b7b", "value": "6f22460b89d59dd41e0591a16ccddea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a51937-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678198725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198725, "uuid": "bb89da1a-35e0-4cbf-b30a-c4847a643740", "comment": "Malware payload (Mirai)", "value": "1a6a5ca4a8e967bebe38347af9cc5f96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198725, "uuid": "ce9394c8-92e0-476d-8a65-4c5cf8ca74f2", "comment": "Malware payload (Mirai)", "value": "0d6cc3aada50b029bd4eee3b52845ce2c752c02e159138753c266a9fa5aaf7ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198725, "uuid": "29d92f4b-f727-4d17-9781-5507cecdd850", "comment": "Malware payload (Mirai)", "value": "2286fb54bb99b6a2e128f6c0f444750d37353626", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198725, "uuid": "926ba522-bf92-4759-a446-236f534dae0f", "comment": "Malware payload (Mirai)", "value": "c52a54ba12b237f0d1fa388645660e30ec79827f32c9b99df94b8774dd5175a6c6600fd0c8a5ba11249e714336fa3c95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198725, "uuid": "36715a32-0387-402b-a166-8b1bcbb7d8a0", "value": "T12D334A21BD792E17C4D4B5BE12F34725B3F2161E25A8CA2E7C720E4EFF04A40A557AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198725, "uuid": "ea3877f7-0b63-4e1d-a801-b9274f1c5dfb", "value": "768:Tno9k0+q9/b4Xlp8oCO9VMc+/pAGPkNTO+Swvex:Tnyk0+SD4Xlp8gvMcQ4nJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198725, "uuid": "4ceb8425-a96d-42bf-8e8f-f690a73ecbe6", "value": 52636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198725, "uuid": "91aedbbc-7097-445a-8361-281dde5fc69e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198725, "uuid": "30df248a-56df-433e-90f8-29ed85d45c3b", "value": "1a6a5ca4a8e967bebe38347af9cc5f96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25aa71ae-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191929, "uuid": "363c3857-6336-43b0-beb8-fe3cc27c704e", "comment": "Malware payload (SnakeKeylogger)", "value": "ef7e45ea82bffb4fbc3690a36fe1f7cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191929, "uuid": "c2df5476-c294-4fe6-a10d-64ebd1a35d70", "comment": "Malware payload (SnakeKeylogger)", "value": "0d7492d1fe1f2ccf93fd861f469ae978b2ca23c7bbc5b9ef7d0a64b87828739d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191929, "uuid": "a5e9fa42-5ff1-403c-88a7-e283e82db086", "comment": "Malware payload (SnakeKeylogger)", "value": "ca73c51632c1f89c7d561bf262a8b0ac5b7e3f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191929, "uuid": "d8f958b1-69c2-429f-bea0-b0794761f331", "comment": "Malware payload (SnakeKeylogger)", "value": "0c28b84aa5a29f3c5ab2a37abab56320fe2236362139a3635cf7e22b42e6bc03c34c42067f7e7e81bb04f7d76e848948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191929, "uuid": "487967f0-0586-4312-9f81-7d50923b369c", "value": "T180259DA56F196257E7C1A1B31804E7B7FBACBD4D2426C0883AE13D8FB1B9D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191929, "uuid": "29551438-f607-4885-97b5-ddfca51ba2f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191929, "uuid": "b8badf7b-0430-4cb3-8c2d-d8552946b69c", "value": "24576:5yYNUfqBpZmDnDERVcCqnacEBoJZgkALB:jNHkDD5naBoJGk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191929, "uuid": "d6329731-85f3-4c9d-91bb-1cdfbd2b0dc4", "value": 984576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191929, "uuid": "f048b95e-9ea8-4a33-8610-26a68204637a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191929, "uuid": "90347045-7984-4b3a-bede-022b8784349d", "value": "ef7e45ea82bffb4fbc3690a36fe1f7cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973c93e4-bce6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678193408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193408, "uuid": "399b44d1-dfb0-4329-bd51-c780df8425d8", "comment": "Malware payload (Mirai)", "value": "37d7c207c9884a92a443b9cac219326e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193408, "uuid": "e302167c-6892-4ecc-b2e8-69d3a3bf4c7c", "comment": "Malware payload (Mirai)", "value": "0e8280330c17ba59c2ca870784a08a26f65f80952bf372bbf21d7ee4e685a658", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193408, "uuid": "ad01d041-a5e3-4ce7-b6ac-e948f179737f", "comment": "Malware payload (Mirai)", "value": "c977fdcf7d4500bc87342714a820d711245fd024", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193408, "uuid": "1addb8f5-d21f-4ad6-a1b3-79a37555ba02", "comment": "Malware payload (Mirai)", "value": "70a70bba8409faada6ffb7783fffa972d60daaaeedf8837cc2900a032c34f1f501527cf6a5dcbd88d54c16f1a7120fbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193408, "uuid": "998b281a-6d17-47e8-b372-09baee9ab82d", "value": "T18DC2E0B0A6AF4C61D63004B2E2FC9A477BDF0F3CE4A538555084ABA4A741E0527FD9DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193408, "uuid": "b7811ef8-2384-4ea7-88fe-cbaee9afc665", "value": "384:Ejt/koxisa34beDtZwQDfhY/R/6DLDWjqaZcbaaUv6vuse0USLqjHcm1xA8hymdz:ERsoTAZxTm/oitjv6msPHm128s3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193408, "uuid": "c01e4e0b-48ad-44ff-8710-14eb821218fc", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193408, "uuid": "47670544-dce0-4221-8fe6-5cf7f45aa995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193408, "uuid": "831b5801-3ed2-400d-9b3f-a9e6c1e392ca", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e152bb-bce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678193815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193815, "uuid": "af62e8e3-3495-489c-a8a0-be3ff021f281", "comment": "Malware payload (GuLoader)", "value": "1faee5daa01f0fbd96b114a2cb58453e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193815, "uuid": "eb7ddce9-b3f7-4368-959e-eb4fd40b5bcf", "comment": "Malware payload (GuLoader)", "value": "0f945bda1dc511c69eaea4d385dd1d136df4c4188c1030144c016a8aa4d34173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193815, "uuid": "e20794fb-f09e-428a-a9b8-8b472538ca51", "comment": "Malware payload (GuLoader)", "value": "b69b96027162e16dc3da421ff4ff14bb6d99209c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193815, "uuid": "5da3a2a6-cb02-4280-8fd9-4bb3bb67d025", "comment": "Malware payload (GuLoader)", "value": "e02798dc0a42edd04c2d03a73eecd89579ee82cb833089f3b1d8d7f0a595c7421d656664448308979bf3fa5f13307cc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193815, "uuid": "ede93e47-b558-4940-b1fb-58ec4bfcba86", "value": "T1C154BC729670DF52C50F3930D8A796FA9A23CE41CD4147DF3664BE4A3936290F939A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193815, "uuid": "f7062ff9-f272-441b-8f05-8e4333349b17", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193815, "uuid": "b4252e5e-8dec-476c-b242-b348996aa53b", "value": "6144:CM236PSes3elyFYNbfB4LYOLKAEpdrA+UWpV:+KPrAbcbp4MqsrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193815, "uuid": "b5850865-0f02-4736-93b3-77317fd4266d", "value": 297776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193815, "uuid": "4c506881-7ef6-41d2-a2d4-ec2a60deb1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193815, "uuid": "c526e648-e809-4017-88ba-962451f2bf37", "value": "0f945bda1dc511c69eaea4d385dd1d136df4c4188c1030144c016a8aa4d34173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efef5457-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678196563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196563, "uuid": "79ec0601-17bb-4c5e-9d38-95c7203b2efd", "comment": "Malware payload (NanoCore)", "value": "9fd94ce43208dfc9fdaf3bb368c33253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196563, "uuid": "c387880a-d5c8-4e00-bb58-0c39d8586eea", "comment": "Malware payload (NanoCore)", "value": "107ff183d6828547a6f3e42d34a5bc32c139adfdde541e1f0a7b64f353116efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196563, "uuid": "880afd72-a116-4837-9c8a-dd86b1379675", "comment": "Malware payload (NanoCore)", "value": "8a1ec00ccba5ae7faf81c09a97962af91818d85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196563, "uuid": "022cfdf8-6583-4373-a56a-211120a99791", "comment": "Malware payload (NanoCore)", "value": "9b1a0a5bf6ec6bd310381ae809a19a811f91331be33e68ee2ff290b362ed7ef615171921bed940a74b962e8178f3b2ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196563, "uuid": "588d8a77-12aa-488a-b22f-3d7906333609", "value": "T1AA15AFE42F5D7263F7C6A1B3280426A7DBACBA5D6517C0181EE2108FC1CDD7C5252EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196563, "uuid": "341520df-d8f8-46fc-99ee-56ca52b9124b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196563, "uuid": "e697313c-fc47-4625-ba93-41419bf177d3", "value": "12288:YULXctnQM61q/xhseWukm8ct+EyQC1q/7NYkbJNKHjHvKy4SCJwh:YUTgmI/+ubDHm1e7uQcKRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196563, "uuid": "b2e78672-d6b9-4009-9db1-411274a2da42", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196563, "uuid": "66fd61d4-1bd0-4fc4-a846-45429e36ad10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196563, "uuid": "3aef487a-6795-4b19-8d27-b6c64089eb5c", "value": "\u8be2\u4ef7\u5230\u8ba2\u5355 Inquiry-to-Order-001030723 xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7d34b6-bca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phobos)", "timestamp": 1678164449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164449, "uuid": "9aad6d06-368b-45b4-9b8c-97471585fca9", "comment": "Malware payload (Phobos)", "value": "aaa058858261d7c0e73fa1b8264a9a3d", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164449, "uuid": "007cda02-2382-40b5-8646-fc78f056b1a8", "comment": "Malware payload (Phobos)", "value": "108cfca8867eb4f94082cddacf63fbdd8369b0991873a20afc3210f2d5e4ec61", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164449, "uuid": "c72657ed-9300-490c-bb42-04c5ce78047c", "comment": "Malware payload (Phobos)", "value": "1233af8c8377567b2b8ebf7642f0036c9797596b", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164449, "uuid": "04bac734-e712-4cac-9449-b5b30b809d6c", "comment": "Malware payload (Phobos)", "value": "48cdc86e80e5ed933dda649a60a731c2e86d7e3d8c37968e070ec8fbecdec0705b9f36f2d0545154433dbd3b35aef85d", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164449, "uuid": "3b64c87e-6cbf-4487-bb8d-1706182eb4dc", "value": "T187E60218FF8754F5EA135935855BE23F8B24AA048015FEB6EF0D3F4AFD33662241A216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164449, "uuid": "fcdf78dc-10e8-4383-abb5-56099c97cebb", "value": "f3de104ab04ca2d874306d1847be46db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164449, "uuid": "fe729c81-3c0b-49c5-b9d7-5371ab248781", "value": "196608:Unri5hStOZV3jIIZruRDm+09gJGzYvj/N2igdkC3qVa+Pa9k8qCgcr+7hQJ/RYyk:7lTLZD+YG8elEkna+iwCNrUhQHYM4Fdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678164449, "uuid": "a44b7b1d-be4a-4145-b22d-c3e137f36647", "value": 14819638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678164449, "uuid": "b003ff8d-ed71-4ff8-9dc8-9728b7a6fe2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164449, "uuid": "c125eb59-6012-4caa-a9bd-9d4348890a6d", "value": "108cfca8867eb4f94082cddacf63fbdd8369b0991873a20afc3210f2d5e4ec61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7864db18-bcfc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678202805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202805, "uuid": "6391ad20-d18c-4dc9-b10c-f4f7c7378dca", "comment": "Malware payload", "value": "4968cf5443b93de47b7987a34f4992f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202805, "uuid": "d6eb31e5-3f94-43d0-9dc6-113a4c0bbe3a", "comment": "Malware payload", "value": "10e175e5a28939fc31648772b53181b8ef59fdd051174e8da8a8a832420747de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202805, "uuid": "71be16cf-709b-41c1-ba1b-3be590c1c83c", "comment": "Malware payload", "value": "97428694148278531c9c98382aebecb37f4db380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678202805, "uuid": "a48ba4ec-cc0c-4d35-9d5c-8968c0d2222c", "comment": "Malware payload", "value": "ec5f059253f7ec2bbbf7fdbe5bc6f592343f3fd22cbc7d3f06bb91b62d2af0dd28c849104f796607de6cd64987c75283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202805, "uuid": "670098b7-3b93-4528-8914-0c45185802d3", "value": "T14D460983F54661E4C0EAD1349E6242927AB0B8A80F31B3D72B91E7AE1F357F49D78351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202805, "uuid": "034f98e0-f1c5-483a-a11d-48c4a3c999ee", "value": "50eee2113294a8b73eea8c0c4114117f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202805, "uuid": "88daa49e-cff8-4b3b-a199-1c15d4ca3a13", "value": "49152:34mV573SRtOUKcKmGC5hLUKhJA/gCEKyz9VQtYQT8IUjKRY0oFFidZMySDD1D5EC:V73SIC5m19sKR8ZjEnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678202805, "uuid": "4b8dbca4-63c7-4159-92b6-7c77dfb7201f", "value": 5605376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678202805, "uuid": "c19136fc-8588-4d88-a034-764ca6543500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678202805, "uuid": "235e4692-c685-4fef-8b65-c509a9775165", "value": "main.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f5536a-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678196145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196145, "uuid": "d45cb7cb-5def-4b35-88d3-c679fdeed1a5", "comment": "Malware payload (RedLineStealer)", "value": "445848ebcd727582d7365eba20812d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196145, "uuid": "7ca5e98a-6553-4d18-ab3f-07b0776b9aed", "comment": "Malware payload (RedLineStealer)", "value": "11035a6f9b2c940068b5b3a1af6ad00d30049086d7880c1b43b5a7079dfd699a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196145, "uuid": "018be1a7-04e9-47fd-81dd-d1698b230254", "comment": "Malware payload (RedLineStealer)", "value": "1f8ca54bad19db55ce4ad3859bb121cc9930ce37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196145, "uuid": "771e8f54-fa76-433f-8d9b-2ccb6c800588", "comment": "Malware payload (RedLineStealer)", "value": "6b30695c95694e8f67509069f7517c9a757a0dd108776d858ec08191435b90e24c0175cb2517aed48003605801090034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196145, "uuid": "20d382e1-43c0-4b8d-89f6-126b0064a0fe", "value": "T1AF94F02276E0C072E69715345974C7A66B3FF532663182CF3BA42B7E1E202D19E7631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196145, "uuid": "a1e5773a-429f-4d8e-be9a-eaf490f21c68", "value": "e0796fd4d2678f1ac0c3dc6d4697501b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196145, "uuid": "cc7e1583-4425-45f5-86b6-3c7e92958972", "value": "6144:O84aULA1+WBEERll/lNQ53aNw7cOv+hXnel9tuC3LdkTP:OzK+WBtlYKNw7cK+hXiXV3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196145, "uuid": "f9b7f5e5-5160-4c3e-9e79-78a2f414558e", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196145, "uuid": "f5557c8d-7e98-4608-8280-91fbd6ab080e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196145, "uuid": "52a6299a-2e18-4d25-82ce-d51cb8226521", "value": "445848ebcd727582d7365eba20812d11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9de8db-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192823, "uuid": "988785bb-ef0f-4ec8-a5c8-077c9bfb33c8", "comment": "Malware payload (AgentTesla)", "value": "b32f971b1b71fe9a69253065cdfab174", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192823, "uuid": "3023d5b2-43d1-4890-887e-c4a1966a8a37", "comment": "Malware payload (AgentTesla)", "value": "11113117a5262f41a4bbed276aec8faf760afaafbfd1c3c05e945aa1d3e911bd", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192823, "uuid": "1ac83a69-53cb-4f07-a95c-61ab2b3424bd", "comment": "Malware payload (AgentTesla)", "value": "d61a2d0581843cbb83313458a14f8488067d7817", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192823, "uuid": "37cdf26e-564d-4dbd-87fd-0e2856e34d4e", "comment": "Malware payload (AgentTesla)", "value": "212c6996850460a8b50dd551d0b0f01cf5493c822654b2bd1a4593b6f9bba5fcf4c32d529b3b7d5e4c92ea923f87bb1b", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192823, "uuid": "d2f79bec-cc87-4b04-8a66-99791778fe4d", "value": "T1D125ADA56F19A257E7C1A1F31804E7B6EBAC7D4D2416C0883EE13D8FB1B9D2C1112E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192823, "uuid": "859f97d4-372d-4042-82ce-971c4de26daf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192823, "uuid": "77062e0d-8678-4120-b46b-42e46c006935", "value": "24576:7xYNUfqBpTaahI+XgLnAS+mgJXkXWydrrS59:mNHqahDQLAS+mg5kXHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192823, "uuid": "6e5dc252-aba9-40b5-a82d-e9601b72ca3e", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192823, "uuid": "96e9bc78-6435-4759-914f-ebd8ac55c934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192823, "uuid": "a4905ad2-97cb-4625-9dc7-52884927dee0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966be82f-bce6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678193407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193407, "uuid": "4248d8b7-90f7-4246-8521-0fe0056daee4", "comment": "Malware payload (Mirai)", "value": "43ea5d08562a6f258c43f8ba6f08e882", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193407, "uuid": "d8b5c562-ce44-4866-a2de-422403f449ab", "comment": "Malware payload (Mirai)", "value": "11e1117e24db8524d585ea4dafa1acf7899b109b75e5ac5dfbd0498f0acd52d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193407, "uuid": "c87ed75f-7eb8-43bb-8d42-f5c29f5ed5ee", "comment": "Malware payload (Mirai)", "value": "ef9a6692dbca49b6142f69b524df10b2b5a617d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193407, "uuid": "760af698-821c-4598-8010-29598a431cea", "comment": "Malware payload (Mirai)", "value": "084108dc1b9419dbdff990cb61661dda4cacbb923aac1db96debd68e574c21d7428d4ebf97176ebdd09be64fa872b48b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193407, "uuid": "6af69d20-12fb-462b-af15-b8f6b907acb2", "value": "T1BA33F2936FB571A1C5D167F3FD31582A6B667D6D285A309C40BCB50A2687C03AEF13C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193407, "uuid": "88eec701-8634-4070-b2a6-d59f007732f4", "value": "768:NwqkrmTJaLf/oTf6XiZ5MGHR31AHdg9q3UELzQEkkBF+MauMBexo46hpKUa/v7L5:j9O/orua5ZR31KLcPqF1aBexo4opKZbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193407, "uuid": "7b34ba69-cce3-4e26-ab2a-411cef40d574", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193407, "uuid": "a771c6c7-aa5b-461f-9da6-6a5907daad60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193407, "uuid": "1b5dac71-5353-41df-9881-da2339efe8f3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd50a111-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198679, "uuid": "78b67978-482a-4aa2-a827-6e275f82633f", "comment": "Malware payload", "value": "b2a5ab79c3d56cfb476d09d1fe46bb07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198679, "uuid": "d12b1e7f-265d-4bed-afaa-e7cb2df6741b", "comment": "Malware payload", "value": "12a1637dad1d6e2326ed1421989f2700200bfb90186428fa1f151c7e21935ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198679, "uuid": "987998df-0a1d-49ab-9871-cc163ea6ba2d", "comment": "Malware payload", "value": "edf2109a563bb3ad818eaac0ad0b957cad572ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198679, "uuid": "21b47e7b-1f67-441e-a379-4f73dac51c86", "comment": "Malware payload", "value": "5297fca6ea61fc4bc48d7f680e97f975899241d7a413b03c16ea71ee1d9a3c7df0feae4124eb8b7bc4a7f126ae58bbc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198679, "uuid": "0af5f691-44c3-4746-973a-27194323451c", "value": "T14806239ED2CA00B8C2B550F05DBF2AF29076F02545105A1F6BCBEB7259E8D7439CBD68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198679, "uuid": "17799f46-28c8-4f83-9ad0-177134a2979d", "value": "49152:L2eYlEmMK/x4hc1RnCy6/6UaYfHBeyFqfZ4USdh0q0MAEwIwStgc4BO7bZF:L2zN1Rx0hpexfZKh0q0xEwst0BgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198679, "uuid": "49bf15f7-25f3-4c32-a74e-e654d04fb0c6", "value": 3686400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198679, "uuid": "2ac7052e-3d60-494c-a0f5-68979dfa786d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198679, "uuid": "a2f823a3-a8fa-4d6e-8a8d-8717ad5c355e", "value": "b2a5ab79c3d56cfb476d09d1fe46bb07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c9f897-bcee-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1678196655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196655, "uuid": "96df945b-6d1a-4ba5-9a50-b0d5b7015481", "comment": "Malware payload (OrcusRAT)", "value": "c7fdf7d3486fad12c07ac3a3da853fca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196655, "uuid": "26b5926d-c787-4a0f-a963-9fac43841401", "comment": "Malware payload (OrcusRAT)", "value": "131607fdc98a5a6005a3e2ed447a9a646a2b5fd37d0d69d19bc6ff446712d69e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196655, "uuid": "03b47568-9228-4443-8b90-ebb240b03aed", "comment": "Malware payload (OrcusRAT)", "value": "4f1239e364ba469d8252dd17c25fdfc2f096eb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196655, "uuid": "c3619fae-b0be-459b-964b-32dfa5fc65d0", "comment": "Malware payload (OrcusRAT)", "value": "c85f367b99e9bfcc386334c71885a8ccedd45df580a58ce6297d84359d5a38d29c9ba2240f4c482a9b5ee4c7d1375bfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196655, "uuid": "cd217bf2-931e-48ea-9392-07f17864204f", "value": "T1B715BF113FACBD07C1BE2AB8B6731AC81778E8066152FB4E185851AD1D9FB02FD153A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196655, "uuid": "290b6493-7dbc-4c2c-bfed-05bd7a27132f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196655, "uuid": "687971b0-1f7e-4dd8-a6cb-93f94aab4c29", "value": "24576:keu4MROxnFf3xsPekrZlI0AilFEvxHith4:ketMidsrZlI0AilFEvxHit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196655, "uuid": "82101020-ae88-4402-aefb-02d69c78661a", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196655, "uuid": "d61886b5-c1da-45ef-8d97-4a874d77f9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196655, "uuid": "4ec88dd6-74b4-4724-b733-8a6658692d48", "value": "c7fdf7d3486fad12c07ac3a3da853fca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d604cdf3-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176333, "uuid": "aab16618-b192-45b0-b32f-442e5fa9a443", "comment": "Malware payload (Mirai)", "value": "f4ba6f08b02c0dda4a7104b8ca462d19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176333, "uuid": "89e8822f-d81f-4c64-ade4-b5b146bde5bd", "comment": "Malware payload (Mirai)", "value": "1325c6555355070dfe5b6a897902fad78d72de341593d36870297af4f326b9ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176333, "uuid": "ba1c6861-4347-4663-86ad-66a575e6749b", "comment": "Malware payload (Mirai)", "value": "99d816944bf5aecbb54a76a1ea3ef0a4dcacf450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176333, "uuid": "8cf01f04-c45d-4701-b42f-c765a5f152eb", "comment": "Malware payload (Mirai)", "value": "d7dcfec908e41da39c6a76a524d4902ebca37813a64d1b44e8559ffdb5962781e900351bd0c4a8358b82ae1a2d0d5753", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176333, "uuid": "f0f5ea46-f6d6-4286-a2c6-9ae92a2282f0", "value": "T1BD031892B3180547C5B62EB0353F1BE0D7ABFA9221F4E289350FA749C1B1E379906D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176333, "uuid": "2faf3619-29b5-4393-95cd-ed198f0f28af", "value": "768:rZapAOoDABiNdX9dz3L2Gal1o0uKhfLPArz+Ahi:rZJBr4lNuKNbArz+oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176333, "uuid": "00ccc7df-ac53-4573-85e5-892b9090ee32", "value": 39760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176333, "uuid": "4ee34f38-a6f7-43f1-85f7-58e731ebefdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176333, "uuid": "dce4e7e4-ff19-4c96-a6ad-3ffeaa4b6acc", "value": "f4ba6f08b02c0dda4a7104b8ca462d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1667b65-bc8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678156112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156112, "uuid": "f6fdcf19-ddc7-454e-acd3-e7a57e86bec1", "comment": "Malware payload (Mirai)", "value": "b73d182a30ee720b1ceabbc5396f3fc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156112, "uuid": "c8b50ee9-6f70-4d7a-b22d-a5bbf3884734", "comment": "Malware payload (Mirai)", "value": "13a1107a06cdfbc538e1e0a2f8d658b2267d1d2df0208e388d47554e2cd7b17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156112, "uuid": "2f1b88be-4e31-438c-94c6-20ad70a6a9c2", "comment": "Malware payload (Mirai)", "value": "5d39f5a845fc583c60acfdffddcfe9066b0c9aea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156112, "uuid": "ab720d74-d255-41d5-a95a-9969ca21dfed", "comment": "Malware payload (Mirai)", "value": "02a6dc5dec0b5a8d2f0e1d96d4fddd2ea5948a1a258f694dd5defe89a2a705032dd7772ae7871d1c4b99b2e1ab3e37a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678156112, "uuid": "1ed7d3e3-4efb-4c34-af34-1e4cdb8f007d", "value": "T192E2D042D1C54F84D17EF23B1A6D7A1909606F3DB69C54227F9433B7C6A1B68EF09243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678156112, "uuid": "884e3f06-a25d-4224-b606-3ff07a3e071d", "value": "768:8g6LtvV8f5oRVp3ItWI3AFFpS4Z8eRolP1cndcnbcuyD7UiyqYb:8PI5oRcWI684LRwcnGnouy8Zqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678156112, "uuid": "52eccdc3-f5fe-4031-8f8d-9afcd99fd41c", "value": 32720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678156112, "uuid": "0ca172c1-6aa7-4b4b-bb2a-a6addd74e4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678156112, "uuid": "de2e1af6-a2da-4818-80b3-c360f54de06d", "value": "b73d182a30ee720b1ceabbc5396f3fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dcf4b5-bce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678190659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190659, "uuid": "6bbe7048-7ddd-467c-9e9d-eeec640ae339", "comment": "Malware payload (Loki)", "value": "2deecc2f9a20dea7f7c7242f4a8f2309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190659, "uuid": "ad5cdbcc-0349-4ba7-b804-5f947010f3c8", "comment": "Malware payload (Loki)", "value": "13e85a56084b5afcf6030fbaee89e2c49b5616eb8f7f5da934f11547b2df2d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190659, "uuid": "1efc6d31-feef-4a8a-9955-028ddeeef2b3", "comment": "Malware payload (Loki)", "value": "1406b022ea5a7175af939be9b842886634357124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190659, "uuid": "ba007281-706f-428b-a8cf-44add09567f4", "comment": "Malware payload (Loki)", "value": "19768f94c6af32ed17fa8b2f0eaf27398c97f676c9155832b115676e66da671c87f7c3f40984a7d5c31da2a73ec1e64e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190659, "uuid": "0aa5398c-f012-4a64-943d-d4e030f4f994", "value": "T1F284DF64621B6B5DF96C25F5BBD0CCD38690FE86C68A8C726CEB16B8F03778440A1D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190659, "uuid": "906c3bbf-0eed-407a-a2cd-a87718225e8c", "value": "6144:Nc+5yStpENUqhs4bqIcKd3F6gd0G2aYZubGExK4FP/pGehQUjl26SOmB5KXpL1Tt:N9z3EN+Yoq3FDdOaYEzxDnpGesmVXpLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190659, "uuid": "b94dd6ba-486b-4e03-92e2-39afb15e5d3c", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190659, "uuid": "73c64ff3-f60a-4d7b-8797-c0a3a53cfffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190659, "uuid": "7bc9b92f-af42-480b-ae63-1749e266e790", "value": "z20CART__OCNPJCESBE_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fe3dae-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678209806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209806, "uuid": "b1556cb3-73c5-42fb-bd25-c8ccb94713cd", "comment": "Malware payload (Rhadamanthys)", "value": "1d088aaaf6a1c54c642d7f1fbf820276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209806, "uuid": "75ee36f8-7cbd-48c0-9d8b-83fc6b15bfc5", "comment": "Malware payload (Rhadamanthys)", "value": "155598b67a1707e34f610855d93cd781e1f02e9dd23c54187befb0c51d6528d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209806, "uuid": "1b76b671-910b-458b-8365-b12ec25e8006", "comment": "Malware payload (Rhadamanthys)", "value": "556de2407ab9d2986de5559bdc8a3dd2bd12610e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209806, "uuid": "bd751781-9565-4424-b9e2-16d2221e99c0", "comment": "Malware payload (Rhadamanthys)", "value": "e7f543c0c4d411af660134c4f3ae7a2ac1bd9219fcda27e8f3cf733593503b1c8e644c9197dd2d67c6fa7d8bf92e30e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209806, "uuid": "4b08e12f-810b-4212-beab-babe078a6b6f", "value": "T14E64E161B6E1C07AD2AB05B05974DBE46EBFB8331674855B335627AE1E303C09B6B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209806, "uuid": "d7db34f1-31b8-42ce-ae57-cbf222c6ef71", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209806, "uuid": "6654e58c-e388-4687-85c0-0a079f042798", "value": "3072:kpWQ9SfLe3vRlTsi3C3TqxIHzzMlrOl2p0kTOzk0CNQV8qJTP5yr9pP3j2YK2CKx:SML4Dy3glrOceO0CNQJP5yrPCST84eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209806, "uuid": "030a6be1-a446-4918-924b-b87bb19b4ae4", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209806, "uuid": "847170bf-796e-4427-97a3-7dc881891c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209806, "uuid": "89820d0c-495f-4527-beac-cd2ec84b0ce9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbf9296-bcfa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678201955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201955, "uuid": "0caf6935-6927-41f1-b7f1-b399584cde9f", "comment": "Malware payload", "value": "0bdbd096d8c183ca7d36faf8a1fd7c8a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201955, "uuid": "8e2c5b3c-bf6b-4e8b-b2f7-9517885fb64c", "comment": "Malware payload", "value": "159b2054a371627ffd95352454f0e846a62a039156c6305f127208325a1e5f5e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201955, "uuid": "92c49348-22e9-48c2-afb6-4fc4b8d384dd", "comment": "Malware payload", "value": "e0b2ce90db16691b47a5eb18537ffa350cf9b9f7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201955, "uuid": "25818012-10ec-4bf1-873d-376ec087b034", "comment": "Malware payload", "value": "37b3039d026e6f7e6f19dfa0d2107dbd92585d43d9295cf585487401e1df94a7d65bdba8be36ed26005c6458d034a481", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201955, "uuid": "a0b17288-c0a0-481e-abd1-6d22e542077d", "value": "T1381612EBAC4AC9D7E9E815BC67B51AE4333A40B1D732DEF2837584E89989345044F6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201955, "uuid": "ecd3a8c0-b52d-4d98-a281-16b77789bea8", "value": "98304:7vteWfelo8Tf0gWqGSh8GqVF4FDCmWt3QnG+ATGHMs:YWfepfH1h8DyCHt3Qnaqss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678201955, "uuid": "2ff5c598-4a24-4f40-aa78-b744be06aca3", "value": 4208262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678201955, "uuid": "554624a6-7e24-4035-b799-868e0184820d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201955, "uuid": "b395306c-eb7b-4c0c-826f-7ad798de1333", "value": "PDF_Archivo_AdjuntoLETHBNEEFRXOBQUlxrrkZQJFV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879430ac-bd28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678221728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221728, "uuid": "caec60b1-c2a1-4a76-9d39-8d6491624b1d", "comment": "Malware payload", "value": "3271867f57a7ddd53d2f36210f79b241", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221728, "uuid": "6c5c04d6-01df-4bab-b8b1-3e18772f77ef", "comment": "Malware payload", "value": "15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221728, "uuid": "1a8145d6-6da6-4dba-8083-ce42b2d57644", "comment": "Malware payload", "value": "04ccf49f32406c6a0d61745bae090a9426a1500d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221728, "uuid": "edd9dbcf-8339-4de2-8654-c4c75645b70f", "comment": "Malware payload", "value": "1cce54fac8b4d7f80ad3ebc28dd36595a92062182193eb86f125adede5bc6bd4a4850e0fe4c1827ff0b4dc827ff2a68f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221728, "uuid": "0e730f62-07c1-4fe4-b7e5-3b11e393a1f0", "value": "T1A3245AF1EFF83960F51946327538427C19E3EF61DCAA40AAE5AFF14A1877AC041A8D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221728, "uuid": "0b19a98e-edd6-4e7a-af2a-5061949a918f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221728, "uuid": "d0aa8ae6-5b4e-494a-9c9f-4e32f275deea", "value": "3072:XBkGJ8YXmHDZLWlTSMu/9laSnsBOSrXo0hL5VNWrIV9Y5cYE3vqY:uGuYXeDZW4MuVgUsBOchL5LWrIV9ugq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678221728, "uuid": "de10c15d-965a-4012-82df-665658eab7e9", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678221728, "uuid": "e5c41961-cdc6-4bfd-b3fd-c0eed8371dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221728, "uuid": "53863e1d-daa1-4060-8bd1-e008b810c5cb", "value": "Fabel.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a731058-bd0e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678210378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210378, "uuid": "5b955dee-a774-4bee-8c41-3ce41a90e75e", "comment": "Malware payload", "value": "3fe3fa5fbebcf71367586d6d2a3824f9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210378, "uuid": "602360a4-f680-47ab-933b-b4902e295fae", "comment": "Malware payload", "value": "15eae9134dac9268cbf005c23299c88dd5c5176a240201da751691a543375360", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210378, "uuid": "0e59fa09-bde1-4136-a2fe-158165ed90cd", "comment": "Malware payload", "value": "900122232d087a1b189168096798ef40a94ac442", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210378, "uuid": "1fbff1ba-a4a3-47bf-95c7-f26f492f1ea0", "comment": "Malware payload", "value": "a6d445bedf4d1fa4659b2edc1f3bfa32b43bfbc4258f9dc18314866169a445914c21407b3a2f3330d0b92a73d1a0e80b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210378, "uuid": "95c6cb23-25af-47ce-b9d1-120cd477b42a", "value": "T177361242F7D9A96FECF3C3329776462654068C66CB03E743584877BC18BB9C44E86AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210378, "uuid": "a6520ee4-d595-4d0b-971f-c0834013ae83", "value": "98304:RWY/5eMi8wI0KAho87G0hsdQi3UGcJxuEfBAK7KSN1hwV:RW4e98VioNDdQi39cPrfBFKSNcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210378, "uuid": "a4e106c3-2dcc-4d45-b204-349546894585", "value": 4976443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210378, "uuid": "9e701f12-3c99-485c-a487-151e8fe31d71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210378, "uuid": "e1e057f1-da80-4098-9e94-d576368d2630", "value": "Chrome (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb712a0b-bcbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1678176826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176826, "uuid": "7103cf09-e4e5-4f43-9550-8bec019f9334", "comment": "Malware payload (YoungLotus)", "value": "8ed2a04ece93bee35023ce41afccae0b", "object_relation": "md5", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176826, "uuid": "be232fd4-480d-403f-a3d3-5afcef346cfb", "comment": "Malware payload (YoungLotus)", "value": "167a12055852953ff43bda213ecc524fd8af28f6613ffa9225a6c3259e079357", "object_relation": "sha256", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176826, "uuid": "7275a5fe-a8d8-4394-b787-f5cc52690b06", "comment": "Malware payload (YoungLotus)", "value": "3016aad9980006cf98d761f60436773c2fcc1162", "object_relation": "sha1", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176826, "uuid": "2c9d0a65-2f7f-4ba8-9b6f-f4e6afe81b19", "comment": "Malware payload (YoungLotus)", "value": "ea6bd79437c214511e40ccc0c1bbc71fe477bdb2586f846e937f99716b90bf44d38f6482d6bdf1404e1b4ee4b09be19a", "object_relation": "sha3-384", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176826, "uuid": "8289f271-55ad-4ba8-90a6-12227beaeeb0", "value": "T1D9450185D92411BBD1A7597058B622FCD2B23CA12938E7FA8297F67439B31F0C1E9173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176826, "uuid": "a4d8fac3-120e-40fd-8e48-bcc7142fd1aa", "value": "8f54c7f89ab7fb80e3cbd057af48cb19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176826, "uuid": "79c5b3e1-5a2c-4bb2-8412-ace526e23cd7", "value": "24576:8NxPFagwIFbznWbpht0ESUxMG+/VIwDn051L9R9DtdTKak5wz:8NPtvFbS1T0D9KvLbZKaawz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176826, "uuid": "06504fb6-bda3-4db5-829a-faa110dd04e7", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176826, "uuid": "a255d2e9-219a-4056-889c-9d694eb4eaba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176826, "uuid": "b4216ad2-1e1c-40cb-8069-68c5fd6e99b8", "value": "zckop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446aea4d-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191980, "uuid": "89f2a436-e6f5-402a-99eb-b3c60799cbbe", "comment": "Malware payload (SnakeKeylogger)", "value": "1626c722d58a3429b25184fe3d6f601e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191980, "uuid": "55a16e75-392f-47f1-86cb-31d42875b90f", "comment": "Malware payload (SnakeKeylogger)", "value": "1896efa72cff54069401ed803a33765d3f6ca525aba0be3c5d7f27c9f9e02269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191980, "uuid": "60c0393e-c962-4011-bdc9-de86ae107a02", "comment": "Malware payload (SnakeKeylogger)", "value": "ec305bf341f7372711dadccef52b7af11e012552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191980, "uuid": "42a91593-116e-4986-8532-3e92afd9cf9f", "comment": "Malware payload (SnakeKeylogger)", "value": "9e55ea6ab7a846f3f420ce93182ca07ee1a0e19b543f635a5d3282b122de4563204725919c1c2a0d5b2070bfaefc2b33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191980, "uuid": "22544a68-3dcb-432d-b396-ba6aa1f8319c", "value": "T11DF49EE42F5D7263F786A1B3180526A7DBACBA5D2517C0181EE210CFC1CDE7C5252EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191980, "uuid": "deafb26f-b143-4375-a28d-acb5c3ad7515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191980, "uuid": "7bc0a89e-14ec-4b6a-bf49-6367bff5d901", "value": "12288:Sk/XAxyOfqNYyVHY5LTyvQR2Y0c6F76TIHZb+3Ix:SkvAxyOCzY5LKY96IIHZb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191980, "uuid": "4e727dfb-8529-4129-b7cb-d5d44b2c676c", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191980, "uuid": "7009cd39-025b-42c3-89e6-65754e4f07db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191980, "uuid": "a9847c59-1dc4-43ee-bb6c-ce57fa8677a8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a80567-bc89-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678153220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153220, "uuid": "5ab072df-41cd-4606-aba1-59649c3051bb", "comment": "Malware payload", "value": "b85f98fe9f230756570dc9da1290d610", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153220, "uuid": "a7e18132-d01a-473e-b057-3633951677ef", "comment": "Malware payload", "value": "191da1dc372bb33705cb2d6e728239279e6ca606e91808ee033b2dd4d47648ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153220, "uuid": "515f9a1a-0e74-4021-80b4-2e877f747dbc", "comment": "Malware payload", "value": "12ff68edd50addfc59aadabece0f062a10c39739", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153220, "uuid": "eee9aeea-f420-4a68-afa0-8bbeb5a4b919", "comment": "Malware payload", "value": "95e44f6f888a350f09bd071a631293d93465859cc296bd597c9f37e2959494a0b3bb35ec015c7f8ff72e41d85b7d7970", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153220, "uuid": "73b6083f-4515-4617-a0ca-256fe73a3091", "value": "T13A742325EE43B0E8E0B3A9FECD799238CC8AC75724581DAC840EF3A25BC65051A6CDD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153220, "uuid": "7716acaf-e6c2-496d-b48b-0b200e3a2871", "value": "6144:T8Cyjf3ktT/T0+RN718HFRdHnwlUhsm6uxPTUqhHB4NhpwqyW:oJj8A+RB18HFg6hp6u9TD2vyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678153220, "uuid": "3dffd4ce-d6f0-430b-8a1e-1a9055429ddd", "value": 359939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678153220, "uuid": "f80618f3-d170-4b3a-87ab-3bde91118c0f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153220, "uuid": "04126fd6-b9bf-43a0-a3ce-c518cbabaa5a", "value": "autorizacion_de_pago.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a99f26-bce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678193615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193615, "uuid": "53d031b4-74cb-4727-abea-9d9972681edd", "comment": "Malware payload (Gozi)", "value": "01c14e3fd06158981d6f9c91390cd01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193615, "uuid": "5d5a7f5a-a1d9-468e-877d-42d91c1fdf3b", "comment": "Malware payload (Gozi)", "value": "19a9a43b36d2ed6516e4b1d8368cb3af64362507d2b30f4cb742fbe50780ee89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193615, "uuid": "73c2cc70-45d5-4641-9d99-7c2368b07357", "comment": "Malware payload (Gozi)", "value": "aa2cc644468329cf5abf8da11e6110bd61d7b900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193615, "uuid": "5bb8ffe1-b858-40d4-9406-74c1a7027515", "comment": "Malware payload (Gozi)", "value": "32967fc0e163b4bee39d7ffa28a8ee02f00555d54393a4a7a7f2f8913807dfcf33af76a0f65a952f819e58ed12b2c69b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193615, "uuid": "a0a82654-7c1a-42ab-a7d7-53e96c199e88", "value": "T19944D02177E1C0F2F2AB01715475EF921FFA78721620869F37E816AE5E306C09A7A717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193615, "uuid": "26acaa6d-ceab-4688-ab95-5d1753bc72f3", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193615, "uuid": "41115848-bc55-4fa8-bfda-e99a739c513c", "value": "3072:rzYI2LQ36fuf1d3BFG3mYA9vjOL0xmYo9+OfRk+Rq2ncI8GTSq6dqDimloDNb:nwL3GN5Nj+0xVAjfRpqZIbZq9mlMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193615, "uuid": "9f3b867f-1288-4ac4-b0e7-0d67b62597d4", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193615, "uuid": "549d638c-e0ef-44cb-8107-0421114093f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193615, "uuid": "050d92f4-d02b-4481-a7ae-1e24dc663949", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5288e07-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176386, "uuid": "a6c37e8d-7079-41bf-ac56-bcbce2e25482", "comment": "Malware payload (Mirai)", "value": "dda51d635977d5f63964ff0557f2a824", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176386, "uuid": "c909f7f7-a5bc-41cd-9e87-b590a927ce2a", "comment": "Malware payload (Mirai)", "value": "1ae0d572e3207890ce2b98a7877226f72cbcd52cc09b38caeb5925d6989fdc74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176386, "uuid": "1d925161-b437-4ade-a62b-ab282f469873", "comment": "Malware payload (Mirai)", "value": "4710353fb9c2d1284732fb2bfa2f3a2f95fc4842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176386, "uuid": "5ca7e7f4-6bac-4761-8eb9-76750ec01e5d", "comment": "Malware payload (Mirai)", "value": "0856eb9318189456db56165ccedde447afdd21f8bcfd4af3bd6a5b39017f54977742fb953bc3f23440cb4e5907a38cfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176386, "uuid": "c9adf7ac-b6ef-4866-81d6-97ea7410ec57", "value": "T1758350097FE11EB7EC6FDC374AE9274521CD651620987B79BD30E818B20A65F19E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176386, "uuid": "687e2474-aefd-4cbb-8995-8c53f06e0057", "value": "1536:fGFBmAZcUUEpNsZjWNRsw5ybs3RrZhkGPM:+FBmAZcUUEpEQRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176386, "uuid": "4e1dc67d-b07a-4713-8579-ddfdcc4b3c44", "value": 88144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176386, "uuid": "e5fe1c98-4e80-454a-8248-c99913c944fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176386, "uuid": "44450ffa-f1f0-46f9-b115-ed48c3cdff1d", "value": "dda51d635977d5f63964ff0557f2a824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e39ba43-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678192051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192051, "uuid": "4fcfba56-8579-4f12-b8f1-899fd8392fd9", "comment": "Malware payload (SnakeKeylogger)", "value": "09228260081c21059444a62e0cbf782d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192051, "uuid": "ac6add5f-665e-44fd-b594-a43ab83f822b", "comment": "Malware payload (SnakeKeylogger)", "value": "1bfa5ea815d3c9b69e80acf3f3fe868a650d9f88b205d1c8229b9598c5ab5847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192051, "uuid": "2c26b30e-0c20-4740-8fc6-a549f0afe7d8", "comment": "Malware payload (SnakeKeylogger)", "value": "cb37f2efada1f39761b24b71066298ee91e50071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192051, "uuid": "c33caa55-9ce2-4d39-98b1-3e907a779bcc", "comment": "Malware payload (SnakeKeylogger)", "value": "de1aaf1127aa6fc5e2604bb98f62f8b87a3eba3cbb4a7c0a97bf8aba7b9418542d9f66688168b2e3ae55e90ba80b2299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192051, "uuid": "dd70bc58-19cf-40ad-bceb-6f9338b42d65", "value": "T116957CF08E53BE9097AB1D4491DC2AC05C4C0B9F86AD89A8FCCC6556D2E1A94FFCC1B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192051, "uuid": "4b29550f-0889-4128-90b9-0ee260fe0471", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192051, "uuid": "801c936a-1193-4de2-a2e9-07234eb41b54", "value": "24576:nmrLqebGNnjzQE8LZyINffVJ+hTzM4C5iiEU:mjbGwLZShsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192051, "uuid": "99200953-4d4e-440e-a435-cf2dd2b818af", "value": 1987072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192051, "uuid": "0fbd149b-3aa3-47cb-aa0a-91439aa55e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192051, "uuid": "5f11109e-2a0e-4340-9805-027084058e2e", "value": "Shipping Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46e0891-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678196490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196490, "uuid": "c7dfdbdd-edc3-4973-9905-0027db4495e3", "comment": "Malware payload (Formbook)", "value": "1090e44d9d170f4e87c7bcfb23200596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196490, "uuid": "ddec3f1d-5a09-418d-aa0f-f4edd94905e7", "comment": "Malware payload (Formbook)", "value": "1c0a9c963662d8f1a32f87a3c33f14c5684707e97257a2583dbfa74c89e51800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196490, "uuid": "ff667ce9-1b92-4bcc-8ff3-23e4c89b8f7d", "comment": "Malware payload (Formbook)", "value": "dc04a59b259f5159a66b578c0b37884174969f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196490, "uuid": "05ebdb92-f634-4ee8-97df-96e8ab144458", "comment": "Malware payload (Formbook)", "value": "5bf7463116ceeb14035f16e75c8816308332beb11abc1e71396cc2bc987e2d4310948a97af1e06e74d6e88699d75452d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196490, "uuid": "b00136b3-71c1-476c-a9c1-1bb1c2a225f9", "value": "T17BC423995166938BDAEC8FFA187836824331731D7D21E58F0C8E28D94E13B454A91FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196490, "uuid": "f7697cc5-723f-485f-80a5-67c948cff88d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196490, "uuid": "b7209ea6-200b-4abd-b039-9b886189049a", "value": "12288:RFFZ6K13cWP+x6Xdqd4fW6oGtJ2mKJGomUZSOG34DVbB:766cWP+x6N4goGymKaUMLIDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196490, "uuid": "714c4543-3f1f-455b-a004-c94d06bd1850", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196490, "uuid": "a3fd22ea-091f-4ba3-8785-09870e1a54a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196490, "uuid": "83d85301-e0e3-4a6d-acad-5bf356aa7eba", "value": "1c0a9c963662d8f1a32f87a3c33f14c5684707e97257a2583dbfa74c89e51800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34d6d79-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678195710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195710, "uuid": "7ac25e7a-4fc5-4c77-a392-cb5b20e1c907", "comment": "Malware payload (Mirai)", "value": "0527e864af38187d667cfbed37776ea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195710, "uuid": "a3da346d-4f6b-4da4-a183-d2a65684a2f7", "comment": "Malware payload (Mirai)", "value": "1c2a6cef092f332b11879c34df1f19c5472234b8912a3f2fcf1f11c18e719af8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195710, "uuid": "e525aae6-5e18-423a-9981-0317f0b9dcd4", "comment": "Malware payload (Mirai)", "value": "8e1ee37d74e55b0402ad636258b8a238b257c1d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195710, "uuid": "6dcc1e8c-0d2c-42c2-8eb3-f0d79f1f8fd2", "comment": "Malware payload (Mirai)", "value": "932098cb0004384a7edbd007f6f3927e5dcda74b23240ae4e5428927ca22f59a37ea6cc10ad3b527cf5666e34a9a24ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195710, "uuid": "9e2ec3f0-ac5a-4bcf-a7ab-3e17d92c96c4", "value": "T1FAC2E160F002C846FEF3E9F11E1499D6BBD0964E77A7CD42119063A2774990A5B0EDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195710, "uuid": "8fa979c5-6b45-404e-b0b5-7db431cbf5f2", "value": "768:iVdafO76jpmNJtSla6KZOsAiZcgF+z6tQoQ6Ex4uVcqgw09W:Gam+AauO0rUwgx4u+qgw09W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195710, "uuid": "cac346fd-036f-421a-a7e3-5d02080f1938", "value": 27064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195710, "uuid": "1abc7868-1a32-4ae8-8486-6eb37112155f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195710, "uuid": "f695215e-404c-4da5-8b75-e3ec2d5c1b44", "value": "0527e864af38187d667cfbed37776ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44c3b6f-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678195685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195685, "uuid": "5c3804ee-f00c-4851-80e1-05050e9e2cbe", "comment": "Malware payload", "value": "05c78a46a81099683159e830d5d1f1dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195685, "uuid": "66fff0c7-03be-42d3-9dad-b441a46cf87f", "comment": "Malware payload", "value": "1c6be6e3a00fd2b18514ee0eb6d0b213b9cab972aa6178064156aa57eeb018bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195685, "uuid": "1bee6399-8262-4c24-b3f0-58f5bc517c8e", "comment": "Malware payload", "value": "6e6cd3a2bdc0078bb88bc246514dbd60c0283213", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195685, "uuid": "79a86b04-d29e-4fc3-b3d0-518a6a02c24f", "comment": "Malware payload", "value": "a8e20c793ec2fc6f63260e7bd7ad7ac0578c019bb2974d5c063e3cfaf7d5136e192746c7d7da9e9b5551e21dfe16f53d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195685, "uuid": "6dbb2d9a-1a25-47de-b843-038a94a6dc5f", "value": "T1EF45231273D9A99DE0F10F312A89D562527EBD545FED002728493FDF0ABC761AB0B3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195685, "uuid": "06b5fa25-7e11-4c37-b3a5-1654d3c9ff7e", "value": "5774734b3f34bc8eabac3f454f2a6852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195685, "uuid": "08aa8f62-c801-4704-9baa-3fcd9ba199c7", "value": "24576:bJGS3mrxWI7n3OqiHThrmotbY7rSrZWZlJmwJI+ymA/uVExtZXCN0/dYWIQ5aqLC:9GS3mrxWI7n3OqiHThrmotbY7rSrZWZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195685, "uuid": "a6b39426-e5ab-4a7b-9cda-7e94b3ef1ede", "value": 1244384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195685, "uuid": "0f8e2673-1367-4b0c-a175-3f29b3b75b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195685, "uuid": "a7e2c201-1d32-4beb-9b19-2028e71162d7", "value": "05c78a46a81099683159e830d5d1f1dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1053a3f6-bd0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678210791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210791, "uuid": "10fde204-45a3-4520-9636-22d80da4d047", "comment": "Malware payload (Smoke Loader)", "value": "c42da644d3c00284fcb5ffcd7a988283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210791, "uuid": "34eb06b6-6036-43ca-9afc-86fca460b6e1", "comment": "Malware payload (Smoke Loader)", "value": "1cae7e40933c543d85b22fd00cf88898a5daa6118c8c50e9875472736a53eb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210791, "uuid": "0478edde-245d-4045-a3c9-b4abede01073", "comment": "Malware payload (Smoke Loader)", "value": "8bb52deb73e9c39bbfccf4ca7aaa55b247d6473c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210791, "uuid": "9ef20eb9-83eb-45c7-820e-7a62b02c59d1", "comment": "Malware payload (Smoke Loader)", "value": "3b775b5cd5fc75e4f94bc27946151b846c78d281273ca3629506c96834eeb14c3d65a24da4c2231d6b55bf2e59a12ca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210791, "uuid": "22e702f4-86a6-4d67-a4b2-94c2a4cc78aa", "value": "T1AA44D06276E0C073E6AB09B15430CEE56E7FB8311AB5894F77680A9E1E307C19A77317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210791, "uuid": "a1208ec4-5b49-4cbe-98fd-d16fc7443b54", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210791, "uuid": "b36eb95b-49c1-4798-8a85-61d511fdc2fa", "value": "6144:YwT07LtmFcwelq90aRB8F0nG4s4eZeqm:Yq07hm+Vq90O8lZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210791, "uuid": "677208f2-1cc8-43ca-95dc-4c92ee65569b", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210791, "uuid": "be4961c4-916b-4216-99da-0a55c50cbdf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210791, "uuid": "5b42fb9e-f82b-4b92-8d82-4656eba051e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1274d2fc-bce8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678194044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678194044, "uuid": "7133c2a7-ac76-4632-ba33-607f481e9075", "comment": "Malware payload", "value": "a1527b5a30d24c1f6f97b913de83b2a0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678194044, "uuid": "83539835-e491-447e-8dfa-8ccade2ca08f", "comment": "Malware payload", "value": "1ce8aaabd9fe827afc2b118a6775bd198f9706604379e35918eac50f51e0d855", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678194044, "uuid": "338d8fba-2bb0-4e40-982c-d67040558663", "comment": "Malware payload", "value": "b96e324b9cad528482253d1efee6a64d810bd4ad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678194044, "uuid": "7c2e899b-ff39-479b-915e-742b4e08079a", "comment": "Malware payload", "value": "c21ea27e167602039ad7a73f8154cbb1f352081fd24a9450d81385f7536b344300b22ef00b5a06b2e649b57338f2288a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678194044, "uuid": "3b363743-266a-41c7-80aa-ab588d3ead4c", "value": "T17415338D3414EA4CF7292036DBC45BE91EF450714984AFDBD89521CDC3BFB28EEA9948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678194044, "uuid": "cc0cba2b-f715-4df0-8481-7301320d52c4", "value": "24576:/mv6t4ct042sM4lDY+rNMHcVK1N+vdhIhayfT/1zZ:/mvcuSlDBts1N26oy79Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678194044, "uuid": "d1fca56b-5508-4db1-b8f6-cf0f7c15c118", "value": 899890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678194044, "uuid": "eb6104d3-a331-483c-ba6d-48ae30e639d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678194044, "uuid": "4afd5d06-46b5-45fc-b28a-c562de7a47f9", "value": "confirmaci_F3n_d.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31d37d2-bcbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678174959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174959, "uuid": "1efcedd7-0024-40af-a4aa-b9ea7b63a8c2", "comment": "Malware payload (AgentTesla)", "value": "3e59cdb176453385b8d90128adb384e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174959, "uuid": "51242971-af84-4850-91a4-3dbfaf04dbd7", "comment": "Malware payload (AgentTesla)", "value": "1db93a92b9b52da3dd6bcf9797705f9a5d24aafb777befa9dc6e0ccd10508507", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174959, "uuid": "ec681f5f-1f8f-4f38-b6c4-1b5ee9c25beb", "comment": "Malware payload (AgentTesla)", "value": "87a73e7809360c6919cf149b001cc6b4ec002b11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174959, "uuid": "4b5237ec-ce16-4287-bfa9-b5250df9835c", "comment": "Malware payload (AgentTesla)", "value": "12b7b13705daa1e72e5460468d2d644d196663d95f2a9655e2a60116b73997e2f03bf0dbbf7651258f00cb121a3b9249", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174959, "uuid": "5bb894c0-6d42-49d4-942a-c74e0e413233", "value": "T10F4412A16DA4C05BEBB341FA7D3A535B6AECE12104EC979737941A8C37233C0D90A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174959, "uuid": "d34bc1ee-15f4-492a-9d9e-4d601acc00f4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174959, "uuid": "ad38e48b-1288-4aa5-8411-fe73bac6a85f", "value": "6144:/Ya6cPEGDYBWdEGIAMEPgV0EqOQqKpHUSqlE+wfKjNvQH0lMhQe+ay:/Y6dcMdCEPvXR0S0phQUuL+ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174959, "uuid": "478e5f93-2b81-4bc5-8674-ed2c81274614", "value": 275452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174959, "uuid": "e68fe6ee-f878-4a2b-84ab-bed788b5aeeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174959, "uuid": "3d3d706e-7b30-4633-bec1-b0d8b0cd11a4", "value": "R F Q -74Y8HEI990-S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123f3ff3-bcff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678203922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203922, "uuid": "87d827e3-a2ea-4309-b69d-4ae3323862f7", "comment": "Malware payload (Amadey)", "value": "3064f5852d2a298cae1a380516fdc4f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203922, "uuid": "5823e266-d5ac-4879-b2df-32b01da2f9bb", "comment": "Malware payload (Amadey)", "value": "1e13c8a7c2b89db3cf0f5d84ae88f5a6a12ca10c4673ad0297dfde1445626d0d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203922, "uuid": "d77bbbf2-429b-4d48-b021-bee0d4a0edcb", "comment": "Malware payload (Amadey)", "value": "35232aeb6c5cfa91606e69c68eaa5271da0396d0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203922, "uuid": "cb9a817b-44fc-4b8d-8573-35ba4e15bacc", "comment": "Malware payload (Amadey)", "value": "579b52108fb7ba40b665624d7237dabf35487005ae0cdd3e3ac9320b0e7987cacbe7d0d41a8388875ca485aee1237e0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678203922, "uuid": "48be5f56-3cf5-4445-910a-b7e61451bc2d", "value": "T1B94612B7214EA407EDB88F3943677BBC78BACEE5FA48E4FD1A9974D1043914C5A32052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678203922, "uuid": "58e70dca-c223-4b52-9460-63d2e7bac4de", "value": "c7c88a9f12777d4c1f156ccc8f276fa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678203922, "uuid": "d13908c2-a781-468f-b8f7-b0ab01637646", "value": "98304:3oCyTf/n6OzwnQZrRDQF7nAfpKkhS3OOCd9RWy6SkfB/iB:CH6OEnDAfokI3DigaO/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678203922, "uuid": "838f3c60-f27c-4fc0-9a54-aa4839862d9d", "value": 5636568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678203922, "uuid": "c87988b3-f4e7-486c-9f70-f99038225d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678203922, "uuid": "25c56815-a551-4578-ae40-f3f56a41cff3", "value": "1E13C8A7C2B89DB3CF0F5D84AE88F5A6A12CA10C4673A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f3d469-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678192842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192842, "uuid": "059f1bcd-c110-4984-a217-4843676d391f", "comment": "Malware payload", "value": "e8bed7c8acab539a5a1eb45613ed7c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192842, "uuid": "76e5bdac-c6d4-4f0f-8839-d541c48b186f", "comment": "Malware payload", "value": "1e2eca98c1f944ae1857ccdc8ce42603f82818e63f199650492e3f08a7574cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192842, "uuid": "100b52b1-4039-4440-a0f2-39f2b8027abd", "comment": "Malware payload", "value": "d59e75bf8d2ce18e6ab2a89666f50a6666710489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192842, "uuid": "adc97315-3d44-467b-8a3d-21a64883cc40", "comment": "Malware payload", "value": "4f17eb39c524fd8c94e555c6658b3d999505b6d47b115df291426f61a1190b157887a08b6945a133a98bffa8b12f60ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192842, "uuid": "adaca8e0-73b4-4724-90c7-f1bea5dab48b", "value": "T1E3760271B3E3E012C46306F312656E5492B97F700836596FBFE82F289DB95E0DA06B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192842, "uuid": "46bb886e-25ad-4233-96c9-74bc52aa7c16", "value": "5c7b3ae413c0f0e24c92f9dd96212906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192842, "uuid": "1039375d-275f-4b0b-a973-ad07ddb04f74", "value": "196608:uPeHfvYQ2enw+Vns481AVKe7dNts4bY42xGKT:umHE2w+Vs48+VKe5Nu4bZBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192842, "uuid": "5aa8d4e8-d44e-4e24-8da1-c7630b0756f3", "value": 7211008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192842, "uuid": "c628855c-35c3-404d-9d1d-d8cf3df1c1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192842, "uuid": "5a042f7d-3d1e-406e-a6e8-dc81c645067c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f954a0-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191924, "uuid": "693d58a3-04ef-46c3-bf2f-ecfdea9f20bc", "comment": "Malware payload (SnakeKeylogger)", "value": "e669ef7db0760731cf0b683554cc9e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191924, "uuid": "fd94279d-88b9-4e20-b09a-3b82afbf482b", "comment": "Malware payload (SnakeKeylogger)", "value": "1e45e4cb7d2e0ecd7ca9cf8c4470526d31dd78367c7e05d2b0f49c85e5aeafbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191924, "uuid": "5cdd5dc1-35c7-490d-987c-8a1cf508d45f", "comment": "Malware payload (SnakeKeylogger)", "value": "fc27dd2be85f382c7688e3c8d4bb284f00010ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191924, "uuid": "33b9e5f8-62dc-4650-b8bb-ab8251e782c9", "comment": "Malware payload (SnakeKeylogger)", "value": "b14a96f23a0fa330016fe4bd148196869ae219f459b0e66dd28eeb6db2cdcca664f75dddcfc02aee9abf25b1a1abda39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191924, "uuid": "cbd4640b-957d-4fe3-a73f-e884dd348d47", "value": "T11C259DA56F19A257E7C5A1B31804E7B6EFACBD4C5427C0882EE23D8FB0B9D2C1015E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191924, "uuid": "a90b6953-336f-4cf1-a09f-98e2be1267d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191924, "uuid": "dd42ec5e-66b6-40d7-ad52-54038cfc47f4", "value": "12288:1GX3cBVmNUfqBe4c6Qak/jr0/wk2T+hifC/m3J3sX+KQU8SKWkRNp:y6YNUfqBpc6BOYIZdZ+vLXkRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191924, "uuid": "7d106168-a29e-476a-b2d4-4a4fa3db5896", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191924, "uuid": "6ad30ffd-12e4-4aa5-accc-602637fac59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191924, "uuid": "29bba53a-0bd3-442a-b534-1f9f2e4d5e60", "value": "PO-7323_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd320526-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176345, "uuid": "ab44e222-c138-453b-a430-d197654f1921", "comment": "Malware payload (Mirai)", "value": "676aab9baf6800b4ea535b3b7f006a08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176345, "uuid": "2fff612d-0bda-4a9d-b84f-7bca6eb75672", "comment": "Malware payload (Mirai)", "value": "2001fcb9b21a6f56b0ae51fbf73c3d7bd43de654ee114edecdfdb6f4efc4dfca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176345, "uuid": "b591e9c4-1a91-4699-b723-89c58d95f2fa", "comment": "Malware payload (Mirai)", "value": "26693caaddcdde12c72ae1ae4f21ed35023d95d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176345, "uuid": "944e8620-3162-4b4d-9bcb-4d66c64ab3d8", "comment": "Malware payload (Mirai)", "value": "eb19d2b75e3e15495fa8bf439d41f126da74aea27f0c19d1693603532e32b7cb20377324a0ea1aea90c64fbd452c3aad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176345, "uuid": "5febad98-6f29-46f6-92a7-df4959b857a5", "value": "T118731B792585F32CDAE650B4F45366E519220A083FDCD2E36883143AFF71B4CB66DE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176345, "uuid": "07638298-c9be-49b5-93ee-dd8989199a08", "value": "1536:NFNlGv768JCAqBMIanff9B24o/6YVBIVCCfy0K9Oq:rGv76kf6Zu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176345, "uuid": "0bb10695-119b-46fc-94ef-a88c9ef769d6", "value": 75136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176345, "uuid": "59ac70c3-3df3-4872-8fdf-c2eb520a8f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176345, "uuid": "b4cd4584-631c-4754-a2af-766b87c6e587", "value": "676aab9baf6800b4ea535b3b7f006a08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b447a6cb-bce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678193886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193886, "uuid": "c1151d37-9889-401c-8f06-d7fbce73039b", "comment": "Malware payload (AgentTesla)", "value": "4b96d196e8bef09a6c095e30aa0af6a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193886, "uuid": "7c1ae515-e236-4f76-8c6d-328277335d48", "comment": "Malware payload (AgentTesla)", "value": "2046e8ccea17e0fb35401b6454d958666741aef184989d81f0a0a310c12794a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193886, "uuid": "82b9d85b-b1c8-47cb-9136-14056d23d831", "comment": "Malware payload (AgentTesla)", "value": "f097b2653937ece303b1a61d1e283603d0deb54f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193886, "uuid": "7b42b5cc-9892-409a-8ca3-07cfd7e77410", "comment": "Malware payload (AgentTesla)", "value": "130b6a0dfc33c2c2841a494a979e783179a461ced592ea0c4fc792c6a188d93ed00774d94f90ae4a3c7697e502cb1809", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193886, "uuid": "3de06524-aa36-426d-9972-e7ee3ac8a61d", "value": "T1C2F32968D6C98D12D72D4078F4A0404807B2B167C6F7E76D0EA0A9FA3E067D3762F997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193886, "uuid": "5f636355-08bc-43a6-b93d-290bb0d8d9e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193886, "uuid": "3531941d-f885-4153-b0c7-faf434e22a04", "value": "3072:MnbyVkVmqv/rvyUGSrRPD0LkJVBWBlkg53QZVkD2hZ9P5Ez:MnbEIvzyMgcWr53Q0iT9xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193886, "uuid": "88e04659-5139-46a4-b5d2-264d7ef916c1", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193886, "uuid": "d1685876-11d1-4560-98f1-a262ad9d8221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193886, "uuid": "7b05886e-96b5-4e62-a579-c907dc623b55", "value": "2046e8ccea17e0fb35401b6454d958666741aef184989d81f0a0a310c12794a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb2697e-bd11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1678211750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211750, "uuid": "9c618500-c3ea-499a-8447-db4f2a769edf", "comment": "Malware payload (Adware.Generic)", "value": "4748268168017a6282bcac59dc0203ac", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211750, "uuid": "c29a9afa-3b82-49ee-af3b-c1be7681e2be", "comment": "Malware payload (Adware.Generic)", "value": "21a330c2b9f07801c498eb4c036dd4ecad7feffea90bbddfa61bc4e1fabca647", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211750, "uuid": "fe5c27aa-0385-490d-ac74-6c824c59b356", "comment": "Malware payload (Adware.Generic)", "value": "06a6b17713b35a68996b29edaa566470f6ddc38e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211750, "uuid": "baa8cadc-15a5-446e-a996-316ff43ac9e1", "comment": "Malware payload (Adware.Generic)", "value": "60b3bdafdfc5be4e16a929cc6517e754031358fc0cfdecbd0205d6aaa6a7b0e80dcb698139b6f419bfa12854e8d54521", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211750, "uuid": "44d1eb4c-bd03-4e47-abe4-d3559eb0525b", "value": "T1CDD533A3BA6019A5E04B8577B16CBF20AF5CDC215371CF0BA561FAC6A9B02D347D2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211750, "uuid": "fdc8dfba-7518-48a0-a712-d82b79a379f1", "value": "a0c012e2da92ad42555210cc958fa405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211750, "uuid": "ca60912f-598d-44c2-95a9-8d09ed5526c2", "value": "49152:RmFGB6jgk0erMz6z7SNUbaHrzC+3FbbmxUZJmZjPS3KDBorqoyT/SV0:EFGB0gZmWOyu+VbbxrUPoKDBorq1SV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678211750, "uuid": "ab81de59-6b25-464b-93d7-3314ca942cf9", "value": 2864544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678211750, "uuid": "7a31e954-e73e-437c-8515-a8fe83cfadf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211750, "uuid": "0170075c-f150-4369-a54e-a4e8dc095e14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8571c73-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678195691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195691, "uuid": "e93e50bb-6c19-45c0-a717-aa7240ce9698", "comment": "Malware payload (AgentTesla)", "value": "27798f97c66a8536fe8367e72e73803b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195691, "uuid": "9d1764eb-a798-4b5f-8cc6-8b3e30c5d45b", "comment": "Malware payload (AgentTesla)", "value": "22a3ede29f71a79ebe90679e3c55c92d139b9c4e129b6fe9467bc5f1337c4f9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195691, "uuid": "64ab5376-a743-4dca-9379-e7ad8cda184a", "comment": "Malware payload (AgentTesla)", "value": "72b7585068ff3e6cfc75d162b069a4c6810b604d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195691, "uuid": "7f93661f-7c85-40c4-a49a-726f79275860", "comment": "Malware payload (AgentTesla)", "value": "2289cb3f7616df56dc1bd1d45cf6c4c689dca0f89f89400570d4368c81b945f6a3c0e803237bddde2793de321ef06edc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195691, "uuid": "181a43de-2a89-48c5-8e7f-165a92056d84", "value": "T184F4120BBAC65F00D88909B5D4E7457003F3A6D32336E1C27F9546E60F913E68E8AB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195691, "uuid": "9e4ac2e2-fc0b-4df2-bee4-a1da0d6b2717", "value": "12288:omMyQWOKKOkGrmbyQt2uGgkvyEw+4x9OFrmbRDNnSmq4/mZfTSqHfnbIa:1uKVVTuGgkKEwBOhaRDNnSmh/KSq/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195691, "uuid": "703daff7-6c40-4c73-9138-1e7215e3a3ea", "value": 756296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195691, "uuid": "d4b26825-12dc-4960-96eb-ed5dbb79b4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195691, "uuid": "2e12da31-47cc-4893-8a68-1410d0c1091e", "value": "22a3ede29f71a79ebe90679e3c55c92d139b9c4e129b6fe9467bc5f1337c4f9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46957b38-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198427, "uuid": "e5a8af12-6879-4e1e-a422-412052bf8f8e", "comment": "Malware payload (AgentTesla)", "value": "c35832a81fbb042920622948eee98cb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198427, "uuid": "a6d3b9bb-f7dd-4e16-bdf1-39b485c3e2ff", "comment": "Malware payload (AgentTesla)", "value": "22cc0f0f7f87f0afd0fd17465e04682c8bc6d868103a09ae9922b39276113d63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198427, "uuid": "daef094b-b20c-48be-8d34-d57ac89e2581", "comment": "Malware payload (AgentTesla)", "value": "ca1328b9edf83bcad0fb2cb8e623fbcf416581cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198427, "uuid": "9df3f196-8e1b-41fe-b78b-3d5c32f232e2", "comment": "Malware payload (AgentTesla)", "value": "598a483002bf030409b6bbc03bffef0beb6fa2ed1a1931e63d0c3259d3093d726aadcaf94d83bf6bed2c0286c2aff048", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198427, "uuid": "ff910081-a94b-4026-b10c-2c3811c4e890", "value": "T1EF25ADA56F196257E7C5A0B31804E7B7EBAC7D4D2426C0883EE13D8FB1B9D2C1111EAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198427, "uuid": "290287fa-2794-4db9-8f28-b4a497614dd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198427, "uuid": "dda91ed2-f351-4473-95a4-538a14c4ba6e", "value": "24576:cKYNUfqBpVsFa/qYlEPZyvf72i0tB6VN/zr:8NHqUqDPvx47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198427, "uuid": "9d166d26-2082-413e-9227-4e33e0d52f74", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198427, "uuid": "1acf04a8-659e-4829-b7ff-b894c22bd092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198427, "uuid": "df9a0676-befb-44e5-8582-97508d7809ae", "value": "COMPRA CSI122825.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cbe9be-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678176065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176065, "uuid": "d1aa001e-faaa-4df6-950f-c7fe87f4955f", "comment": "Malware payload (Formbook)", "value": "0cfb2efa5a22c4cc99842471db6f415a", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176065, "uuid": "bc923317-2580-439d-a009-f29285e76e6a", "comment": "Malware payload (Formbook)", "value": "2327b28e657d08e4b9db8e6523523c1b6898bdd4080bd26ad017e4f00d23a6c0", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176065, "uuid": "11d552c7-a942-4fd6-a37d-06453b73d8c0", "comment": "Malware payload (Formbook)", "value": "83a61f8dffaa6aa5ed1959b6c1f2eb803b102a26", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176065, "uuid": "d3e7f326-dc03-475d-ade7-e8b49b588eb3", "comment": "Malware payload (Formbook)", "value": "2e74708f49b59a014e2cc3054be3b32575638283e736d6876c81163dabb79e0513d85f12e35171e7c9e6f2b3f83bcec1", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176065, "uuid": "cc557f51-28bb-4736-a7c7-5f1697175d01", "value": "T11DF4F37D38B692E6C238FA3346E7E530B5BD81923307D959D9EA1AC04F421827DCE95C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176065, "uuid": "d4fc91ea-945e-48d7-a0cc-03957d3442dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176065, "uuid": "e01cf0f8-f0b9-4284-8a52-17338944c4df", "value": "12288:pqdaPk2IkegET9jsIBMNjnNNOhAe/S0pE+tM5eo3BxXcYiI20t4AVYvSZE7GCGQe:p8xTsIBMNjnNNOhAe/S0DpWBmPI20mAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176065, "uuid": "6fc8ad6e-d98c-44f0-8e03-ab031f3a0b41", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176065, "uuid": "60e6093f-7a51-4b04-a31d-297031a76b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176065, "uuid": "5e626b9c-7996-41f4-b9d7-408d99925857", "value": "new order list.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de70dfbc-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198681, "uuid": "fb1a4294-b8c0-4438-a665-e5f1cf95d119", "comment": "Malware payload", "value": "78cd6587825049af82b19f81d631cfb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198681, "uuid": "f2843bc1-ffe0-4d3e-b4a4-dbf3286597cf", "comment": "Malware payload", "value": "2337c16c323aa3679996890be0aa4c1f56545c81c968a3cba8cd1ced308b8033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198681, "uuid": "5a450ed6-823d-464e-a559-9dde20981e62", "comment": "Malware payload", "value": "e431b5c6bb38b5ff809ef49e02d0e389c4a7ba5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198681, "uuid": "c5e7c02b-b09e-43d9-ba2a-c4866e8c1916", "comment": "Malware payload", "value": "94503d91315c7d1d0b79c610b0509ae9284b85d45d8bdf33d7a6ae1eea8865112e907cedd3e0cc0591bc404a07d14de7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198681, "uuid": "3c9915ac-952f-4e76-ac34-b53837056cd0", "value": "T1BDD40122B151C49BD5A773F2197D0AA21B97FE112874A20E23317B5A3777143CC6EBAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198681, "uuid": "2960f81b-10dd-475a-9323-855dfac38353", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198681, "uuid": "a1c9fac8-296a-47fc-9016-ee51896c6f39", "value": "6144:2Ya6YVZVEJIXBqA2crL7urWI4yYNY5cqb:2YOVFxjrLaSI4yl5lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198681, "uuid": "d6d15c75-c5f5-4b76-bc25-84d62417769f", "value": 613424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198681, "uuid": "7fb60120-f33b-46c2-aa7b-be1e6c4b96da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198681, "uuid": "bc8df15f-1477-4411-9b83-a1840a004309", "value": "78cd6587825049af82b19f81d631cfb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47793cd0-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213460, "uuid": "a5597cc6-5474-4b03-9122-ca244a8184d6", "comment": "Malware payload (Mirai)", "value": "e2203b619cb5c946d236a69a79322183", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213460, "uuid": "bd983b59-a0e3-47b2-b209-0c4699bfe4d7", "comment": "Malware payload (Mirai)", "value": "233d70edee5251c5c6584347ec0a00c23afe8d83e23164d7e7eac74bc57b8139", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213460, "uuid": "09beffd3-6c36-4367-a30c-79faecc54f02", "comment": "Malware payload (Mirai)", "value": "971547aa967b4c7534757f0ec83065a91e527ace", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213460, "uuid": "96c4cfd1-3b8f-4815-a558-d803ad9125c4", "comment": "Malware payload (Mirai)", "value": "fcc6c942f856b8619c87d9a8228ad95b5430d435e9df97cf7af9fc28bc1f6dda4fcf3fef77c0305255913c96dea64478", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213460, "uuid": "4ca850b3-9418-44af-93b9-cc01f1ef5d19", "value": "T17DA33CC0F353D8F8D81606712132FB36AA77F1BA122CD997D7E49E63AC81E41C8465AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213460, "uuid": "8fe486ac-5137-4cab-b689-41fd82785712", "value": "3072:5L8VduScfx5Kac+vAtE17mttkneujybIZDUYfuk7JlwbZnZem:5L87uScfxoaDvAtENCeneujmIZvtnwRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213460, "uuid": "63b89dda-8ae5-4e1f-9e31-6e645c9738ab", "value": 100500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213460, "uuid": "012ff687-f793-4d7f-b113-76771da65fe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213460, "uuid": "84842f7e-d707-4b0f-a9c3-544f8acf5587", "value": "uYtea.x86-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b23e7fb-bcdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678190327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190327, "uuid": "f1365fb5-d167-4953-8908-e5465f18aac4", "comment": "Malware payload (GuLoader)", "value": "f698bae55d26e7fb2f655f843d2652d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190327, "uuid": "a3abe0c4-9f5a-4ce2-85ee-1587334ce9b8", "comment": "Malware payload (GuLoader)", "value": "236f588e342c10bbb188c4e9c5ae6a404cde15d852c1dae044248a3fb966c124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190327, "uuid": "ea82e647-834d-4022-9935-ff091a974a48", "comment": "Malware payload (GuLoader)", "value": "2ed22540d752675fab78467ec3b06d3f913c72bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190327, "uuid": "c6d8662d-a4f2-487d-9fbd-662e40327075", "comment": "Malware payload (GuLoader)", "value": "a73226bb3f1e9a570c5d576176e0dd1f47d7b95db8104c50f71ba25d0b9acdc5e74b706eed909e2d2f178718fe0b2a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190327, "uuid": "ce5becbe-5f5d-40e4-b3d4-e666ae8188b2", "value": "T19D94F103F400C0A1D21E8931F2871EF286766FF9A6615D9636D8BF05B975340E89FE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190327, "uuid": "0084c67c-5fda-4a79-9c48-02d0160f0867", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190327, "uuid": "8b7958a3-2c1a-466a-9dd6-b05505bb84c9", "value": "6144:tbUTp15lOVWR4vFSf00fOkTfwmUBxJcuaJ8ldmrSPcojTqvvm9LXMJkUxM+Aur:tIJlsW8200PTDUBscQ+ljOvu97MJDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190327, "uuid": "1983722d-3aa6-4e3c-9bc2-de5aa1446bc9", "value": 440712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190327, "uuid": "588ae1e5-01c3-456e-8e1e-4ecf75db172c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190327, "uuid": "abc4d6b6-3077-417d-a46b-7395b907a663", "value": "REF#05129598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a2379e-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678195692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195692, "uuid": "457fe7d8-6294-43d9-ad9f-3128904c0ba7", "comment": "Malware payload (Mirai)", "value": "db02b9f126df682e4fc2f24f3a13a929", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195692, "uuid": "cd16b78a-97f2-4024-ad9a-ef124216d607", "comment": "Malware payload (Mirai)", "value": "2412d017cf42a5cc48bc8346b52dac723d6496c1e57837d8155a3863736d6104", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195692, "uuid": "b810c175-364e-48ea-974b-b736c5bfe65b", "comment": "Malware payload (Mirai)", "value": "8b398da3322d9fc32faa4d7cb8d3814e77623e06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195692, "uuid": "3a8bcccc-0b6a-4ecc-867a-46ef92b6010b", "comment": "Malware payload (Mirai)", "value": "348d91f20f64c70d201c53f1068920593e150146e4433e53dbb77b66578a10977a21959deb5956246a36c750d14b5efd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195692, "uuid": "63f47851-5409-49c6-b3de-49196a6a8745", "value": "T18B535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195692, "uuid": "b9473b0b-2c59-45f7-abc9-17fa07c35e14", "value": "1536:AXyRgQFTTbSX5dhLepSGYucFuxYhON2PPB+qG76E83:N1Gjh8EVGON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195692, "uuid": "69a126b7-9c47-4892-a9cf-37b70f25d1e4", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195692, "uuid": "fcbc8372-4acc-4c11-840b-938fa9a2775d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195692, "uuid": "b59684ff-54e7-4c7c-be3c-b33c5d626daf", "value": "db02b9f126df682e4fc2f24f3a13a929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81520440-bcef-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678197237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197237, "uuid": "c6892eac-2a83-42ac-b124-643a723b467a", "comment": "Malware payload (RedLineStealer)", "value": "46483fa7468e34ce2ddf1f89c282c8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197237, "uuid": "15d46c84-9529-4b3c-89e4-742d7a823be0", "comment": "Malware payload (RedLineStealer)", "value": "244982d45d69eff9af5620eed85c3ec725f7446b50ba3ac64ec2ca883c5f4444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197237, "uuid": "a7f25b3a-00d2-4634-a64a-5e05b0a375b5", "comment": "Malware payload (RedLineStealer)", "value": "0dd6b938c8e5c5c1702b9d5929b8cee6b694855b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197237, "uuid": "88b45561-ecd0-4092-893e-2d1e7150a01b", "comment": "Malware payload (RedLineStealer)", "value": "c581a8b6cb0367c626dedb664ab4f6485a0b85d801fefa0ccc5ffd3e2ed25d323d6d5e384de10924f994f5b300c8e843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197237, "uuid": "93ab7d69-356e-491f-846e-f568983876a6", "value": "T120652313B6D5C0B2E02209361A29E751553DFD302F24DADEB3DC6E1D9A361A1B235BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197237, "uuid": "88b25a33-4aae-4610-b365-57754bf0c2de", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197237, "uuid": "15d72590-4152-4b4d-a386-3b356bf9244a", "value": "24576:0NA3R5drX/Wb4b7hdC6fAU6B/AqoUiB7SMoildKv2hJVffhG/8ertiytCv2nUeTE:V5Obuhh44PB77JVI8eJiywqV2pR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197237, "uuid": "79637ebd-bc0c-40ce-aaf2-8363e1c379c6", "value": 1527659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197237, "uuid": "f28395f1-10ec-42d8-8115-6d7c20ffc88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197237, "uuid": "51851f14-4fd9-4b12-a073-0d23f987ae52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4f5f6a-bcc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678179005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179005, "uuid": "50bec2f4-f403-41db-96da-6778b9207523", "comment": "Malware payload (Mirai)", "value": "a46f0668b621ff1ecde683bfb2b90e56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179005, "uuid": "1a753afb-d9ef-4fe0-859c-57589147ced3", "comment": "Malware payload (Mirai)", "value": "245d6fd6373e25985c576379cabdd354d9ba923503a476abfbcc7fa8bee9ce9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179005, "uuid": "25b2995b-f1e3-41c9-a927-19fdaa1da94b", "comment": "Malware payload (Mirai)", "value": "b6b06ecd44ec7b96804916380099c5cf18e22626", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179005, "uuid": "e81f374e-3cb6-401b-9dd1-6262b969377e", "comment": "Malware payload (Mirai)", "value": "6edc9570f17f9d643e7fbccfe9e0808da24a91066ba020950ba094eefe1878e489fe001a2a76c44aedc232f438532b31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179005, "uuid": "1beb0c86-74a3-4941-bec7-8fc21854299e", "value": "T196436BC4F643D8F5EC8715702077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179005, "uuid": "43bd6897-6e80-4958-a90f-24fb69dd6cd6", "value": "1536:JeESt/basV2rcZhG6ySN7namlSR9zWOIaEjrqM9s:JeESt/basVTgS7namQRVtXES+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678179005, "uuid": "e20e4cd9-8618-4b63-aa54-23a9b54e17a0", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678179005, "uuid": "dc4d535f-354d-4555-a4e0-ac9214abcf52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179005, "uuid": "6aeecc63-4313-46b8-a3a0-5d1f73fb7433", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac91958d-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231669, "uuid": "97b43df1-466e-4676-b1fe-fa0846ece415", "comment": "Malware payload", "value": "4e94401fa7bca917f001e1b847236b72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231669, "uuid": "73615226-9bff-4b6e-b850-b8f6da4b880b", "comment": "Malware payload", "value": "252208db900b179b97fdcc9994a9f6f2a814b6739262973e5ab408ab1efc2172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231669, "uuid": "aae80628-e27c-46eb-9448-1dccc1801663", "comment": "Malware payload", "value": "2726a09ea093edaab32d84bd6fe1d8b0f622278c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231669, "uuid": "439dafe1-3920-4b84-946a-9f3cfb256f7b", "comment": "Malware payload", "value": "eaa653513e1fa0569d3ef1deafc14246954fab46346f41c3670b32e063203c5adcb35dabef36d300a9398e1a0adfdd87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231669, "uuid": "06d35fe7-7012-4a7b-8ab3-43c5d388b4ed", "value": "T1DA0633A3A02AF957EC442530C772E3B16DF14126197FBDA1A532EBC858D7E483772E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231669, "uuid": "6fffd069-0cca-49d5-afa8-d6a25967b2fe", "value": "e41c25ab7824b3df73334188c40518ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231669, "uuid": "274b82d4-3f8a-46ac-8376-44b1b7a1b1ad", "value": "98304:x1dK2swozgITCy4AmT2tQLYIsDjlmsO7zitMclb9EOA1:x1dywos3BUQLYIkle7etM49O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231669, "uuid": "adc666dd-5d1f-4da9-91d6-05be53fadb90", "value": 3806305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231669, "uuid": "9dfd8548-1725-43b8-8230-7fdab897ab40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231669, "uuid": "b0365853-c760-4c45-b0d6-e8d0bff8bc35", "value": "SecuriteInfo.com.Trojan.Siggen9.10546.18132.32609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4bb748-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231670, "uuid": "bdeee0f8-ca5d-455f-8c4a-df34f437f65c", "comment": "Malware payload", "value": "7a679a69c55b70094d917567fdca0404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231670, "uuid": "57d8cb9b-1734-42bf-a53b-3f36b302e9ce", "comment": "Malware payload", "value": "272b6a17a8a58a5e75bfdbf88290b0cabd871d72e9cc1dafc7f38a35776495e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231670, "uuid": "bb5ffe22-e2d5-4b51-8cec-cd72f5a08960", "comment": "Malware payload", "value": "d1ba1e1a30657553e51c02840bb74de039de7337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231670, "uuid": "91376139-4b8b-4ecd-b6b7-04f99045c2e8", "comment": "Malware payload", "value": "813a6f0681caafeefaa03051e3cf2dec1614615a02048e42c2260c9eaf5f1882b01624796e5898a41e87d0a400671335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231670, "uuid": "41375f9e-87f1-4b2d-af11-5b5adffbc129", "value": "T1DCE4222178208655EEBF88360A378EDB6722085163919D4CDB68FE8DE4265CCDFDB347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231670, "uuid": "b5f09003-483a-46d2-b250-b3596cbfba4b", "value": "79420f1baa63b40963b5cae8cd85925b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231670, "uuid": "be36f9b7-0218-47b0-9c2b-60834bfe3c3c", "value": "12288:2XsPXqcf00rzOfWwuPDp5rztivzMiNt6jaDElwJZvgB3W3alPMA+5kupuuT:2XsPagRzBwIpHivz/i+iwJZvgBm3GMPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231670, "uuid": "bf0da67b-85fd-4975-92e7-9dcb2c10949c", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231670, "uuid": "91af3452-2da2-4a62-a2bb-43ed7222d057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231670, "uuid": "50e10ffc-6376-4dc2-801e-471bc746c835", "value": "SecuriteInfo.com.Trojan.Mint.Zamg.Q.13858.19794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ddc9a1-bcbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678175316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175316, "uuid": "43dbf8dd-f8b1-4614-bc6a-68251bebead5", "comment": "Malware payload (Formbook)", "value": "447469d4745267e6aa0b64cec76034c1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175316, "uuid": "fcb64546-d3f2-48b8-ba33-2e7354d7012e", "comment": "Malware payload (Formbook)", "value": "2825836dc19914ce12e95e4d79c686493467dc79ad732fc7ff4423bd5bad4df4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175316, "uuid": "3388754e-743d-4e38-82da-9be5a1afed82", "comment": "Malware payload (Formbook)", "value": "5c9bb4b287813b2813d60a44e9216ae97a06adb3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175316, "uuid": "3bea81d8-c4ef-4f94-abe5-45e0c6fb2508", "comment": "Malware payload (Formbook)", "value": "e29ede5533d2e49659ddea8749e1f19d8597eb72a0b0a43e62d5475648925315cf21ed6fe6fcb24dd3f733bfd3290112", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175316, "uuid": "c86e141d-4936-42cc-8d6a-ff71c34d0f81", "value": "T1D1E43338F51B78D7026707A3DF1C88284A633BAB86B4B65693DFBCA7E812351D813157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175316, "uuid": "7913e6b3-6710-4e33-9035-309cf76d6c42", "value": "12288:lfiNgeJBv3xCc2+i/ne/sHJ/1CgV1nqulSaEuBaBvy8h6HNA:lfiNzJBUc2Te/sbCgV1q+BMyftA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175316, "uuid": "2e5354b9-b0b4-40e5-8a40-d9e38edd5532", "value": 717634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175316, "uuid": "03531a12-d01f-44d9-9833-260a0321ef82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175316, "uuid": "eb8b91aa-601c-4df7-bb2c-4223ba9309c3", "value": "\u0421\u0410\u0422\u042b\u041f \u0410\u041b\u0423\u0492\u0410 \u0422\u0410\u041f\u0421\u042b\u0420\u042b\u0421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d8df20-bcf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678197493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197493, "uuid": "74883f11-c953-47dd-a6e9-7e049a5f1172", "comment": "Malware payload (AgentTesla)", "value": "e209224d5d19c23608c748dc03a41231", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197493, "uuid": "b8d0c368-aea7-4d2b-bedb-286de8046643", "comment": "Malware payload (AgentTesla)", "value": "28524408c97a1ae0de62d924b9b9f01d4e45fefbf7d1e0377a2080eace3cb838", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197493, "uuid": "9643b3a4-efbe-4a5b-a07f-0883e2e33710", "comment": "Malware payload (AgentTesla)", "value": "bc29c6f727c8d77ff63f03a2e0e1b802962d6c9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197493, "uuid": "25896233-d104-4059-aa38-9bf54cec2ea5", "comment": "Malware payload (AgentTesla)", "value": "08f828f7b246aa218b122f1d742575929e07d61630758a0a35d7e5f041e7faf086f04cecc23afdb615563b263012b0c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197493, "uuid": "45b41997-f0c6-4ecf-8062-f2975c123f16", "value": "T173F4121632D85F05D46941B1CAEB663413F3AA8B7B72C2823E0443D64F523E99EDE78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197493, "uuid": "74e75853-cb02-4b1b-b44c-c7ec29fa2e11", "value": "12288:XO+ijzl1kbbsdMECMoni6nO1ZWgWy2kLdA/vYwnZd+wduY/KVd7FGCmxWYa:Bczl1aMoi6OHWgWy/+/v33+w7/uFGCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197493, "uuid": "78a56255-e218-47e8-93e5-6944399727cc", "value": 757320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197493, "uuid": "b701c1b1-2271-474a-99d1-502bed76dc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197493, "uuid": "15148ac2-d640-4b75-90db-4980ca90fbb9", "value": "28524408c97a1ae0de62d924b9b9f01d4e45fefbf7d1e0377a2080eace3cb838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b9edf8-bcc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678180519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180519, "uuid": "949cc901-6d60-49b7-b58f-fd37ee5d2e37", "comment": "Malware payload (Loki)", "value": "eff63edb21dc723a40b41704a7634ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180519, "uuid": "f6e2e794-afe6-4da8-b9bc-22b43e3a1347", "comment": "Malware payload (Loki)", "value": "28d4101cef00acd3914aecaa06d50a27be0f8b8819e9a37c5ec863d9989a28c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180519, "uuid": "91562367-ffd1-49ae-a7af-dc13f058435f", "comment": "Malware payload (Loki)", "value": "14afa54eba8346e683338a34650da45dce3aaed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180519, "uuid": "ce5b80c6-0dbf-4619-bd92-b1992d3f0c17", "comment": "Malware payload (Loki)", "value": "84c1f82536a687b91c90efd65a77448d79c77a7a6e3b4350e5f5db651189d927d30924fd1374802864f0e216799926c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180519, "uuid": "d39cf8d4-abe5-4ef2-98c7-1a356c96d399", "value": "T1F5256B8076F9D211EDCF3269091C568E7E79A107A152F22A9F7736C2530BBF676CC182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180519, "uuid": "1a291458-5adf-43ae-83f7-613dc3198087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180519, "uuid": "30c3648d-dc45-42b2-80b5-502ebceb04e3", "value": "24576:YMFy+jFy+IA0Iwm/IYBbABlj+jx/x49E25CX:tFrjFrIzaIYAljO1++25CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678180519, "uuid": "e3c94947-474c-4cf7-9041-dc32c3559bab", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678180519, "uuid": "11240312-c85d-46aa-8ccf-0be8678b3632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180519, "uuid": "6e8684ff-7608-43db-a9eb-6a217808c048", "value": "eff63edb21dc723a40b41704a7634ab7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314c0e6e-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678175628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175628, "uuid": "8d0a703a-6266-4e5f-9d38-37748c2dfed2", "comment": "Malware payload (Formbook)", "value": "52c9052e18499512603e25a1a3a1cd8c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175628, "uuid": "a9ba6161-8bf2-4f4a-ae4c-31bd0793615b", "comment": "Malware payload (Formbook)", "value": "28e9f55bb7840a2296170dba587b8a81be3ab860b3aaab8186ea9a01b288c1b0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175628, "uuid": "decef688-ca56-4e3a-acda-9d50fe54d748", "comment": "Malware payload (Formbook)", "value": "f3a3f18e325d149790dcc300f38e0fe8398445a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175628, "uuid": "aaa44d1d-dd3b-4375-8fec-55d688763759", "comment": "Malware payload (Formbook)", "value": "ef8f388f2aa48f5a9ef7621714c8e0ff88cdd961f6923487c103f07cf196fd72405ed613ae1c72f295bcf6008d31a437", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175628, "uuid": "f7e1ff34-9d4d-4ba1-8882-8d854ec2b5c8", "value": "T12165AFE42F5D7267FB86A1F3180426A7DB9CB95D2527C0081EE6108FC1CDE3C5612EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175628, "uuid": "3954d42c-e3e5-4da2-887d-842e79dd8eab", "value": "12288:rXKjX+rzknTP8pO4G0OIecssiQz34O0t3MxzfWAAIO6:LKL+roEpThzzIO0t34rWAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175628, "uuid": "1b8bf53f-b430-42d3-ad25-4a0faab1d70b", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175628, "uuid": "d90f5e45-138e-44d0-a719-2e2a816de9ec", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175628, "uuid": "2480e95f-ec43-40ae-a2d6-267e49714e37", "value": "04797 ALVACO ORDER.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b1f278-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678210189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210189, "uuid": "5feb8131-79f2-4479-aa35-f75ee9ef18e9", "comment": "Malware payload", "value": "c048c29dd017beda7f54607f9e416353", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210189, "uuid": "e7e61557-8798-4d7c-9379-f0733617f565", "comment": "Malware payload", "value": "2a1ceca155e85ad7430a5fc100b9fd5b79873e61ed13a2123b8287c27b9579a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210189, "uuid": "11e70179-cd9d-49b3-bf44-2bc42f1eb9ba", "comment": "Malware payload", "value": "e0dba3316c85acd9662629f2c7e391dc7846275f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210189, "uuid": "1370a54f-ea79-4dbc-afdb-cc9906c7e50b", "comment": "Malware payload", "value": "95cea8ec147246bfdc2021411cd8f73175917cc394168aea7cba9b6411cafff90c65792175aceebf3a261231d427677a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210189, "uuid": "484310f6-22ed-427e-9cf9-c0646eb3556c", "value": "T1F7563A32B70DC52BE45D42F6792C5A974448BA7A07A148C3F7806F9A34F60E36636F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210189, "uuid": "c9e30f79-2e6b-4c03-970b-90657b070af8", "value": "3523cea9892e850605a4bb19be6c3536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210189, "uuid": "f85151e8-39f7-4800-a362-c391afff27ed", "value": "98304:Mpmkl7uAEuvs0UFD5VyU66URkLC8Ct81Eae1JqI3YL8SFlWC2nCArWQY14XJcvwz:wl7rEuXUlBikLC8Cy1Eae1JqI3YL8Spq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210189, "uuid": "d4a84ba8-9efd-406b-b9bd-c43abe589b89", "value": 5998080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210189, "uuid": "e716d59e-f6cc-4489-9ecf-26e286fd2f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210189, "uuid": "d257bd8d-e967-444f-a064-aea1d046b130", "value": "irmfmodulewin32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55bdac8-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678196143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196143, "uuid": "31f42a60-2623-40a8-a15c-483e322a7b22", "comment": "Malware payload (Smoke Loader)", "value": "718659d862ff9f420a50746b4333460b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196143, "uuid": "8945e0f9-711d-4044-8d1b-f9591e8c68de", "comment": "Malware payload (Smoke Loader)", "value": "2c610023e2f0f2217f2442269eb188fc8300f5415c3d46f65ec44def2deb80d4", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196143, "uuid": "6eae5c81-d1e2-432d-9d75-bcb38f2b7a48", "comment": "Malware payload (Smoke Loader)", "value": "450f4daa52ddbc8ae1668055042e28d926aa0f93", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196143, "uuid": "86c0eae4-c27f-4967-bdef-5becf240a143", "comment": "Malware payload (Smoke Loader)", "value": "eba081e77fc4c91f007b66ab7a77f5533161dfed6176cfea7462763f2f4ca69300f04b91fecf39c5d964edcbf10336c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196143, "uuid": "0c65de71-5788-4c7d-a47f-415561995a13", "value": "T16864CF3E7AE0C0B2C56B05748571CBA41F7BB8725A7486CB37540BAE1E306D09F7A31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196143, "uuid": "5249ce83-2819-4f94-b47c-f60075e97e63", "value": "e0796fd4d2678f1ac0c3dc6d4697501b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196143, "uuid": "e5c2e8d8-1e3e-41fa-ba4a-04dae5d82c94", "value": "3072:bgERhDctLuaPV1a5Cxk3H6JkxD32C1Qu3l+4S9fmC5GVwx2+UUY9e5rU:8E4tLVVOfH6JSmklnS9ft56t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196143, "uuid": "0636c23f-39de-40aa-8858-d63d80779e57", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196143, "uuid": "1d128fa5-e1f0-45f9-8c1b-2f7496944370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196143, "uuid": "4bfe295a-54dc-4d90-b50e-95344ccc5ba1", "value": "718659d862ff9f420a50746b4333460b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638130a3-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678192033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192033, "uuid": "dc670cce-731a-4d95-a347-cc7d096b741d", "comment": "Malware payload (SnakeKeylogger)", "value": "cb26a5cff74c0c20ec2856d57e321ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192033, "uuid": "0b1194e8-7435-4cc5-84e4-5786cca95efc", "comment": "Malware payload (SnakeKeylogger)", "value": "2d00afff6535a1fafd100b518b45019ec4645afb3c105670f71ceb6cdf552814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192033, "uuid": "d9c89836-e7c2-489b-8721-bb72a1d23ff9", "comment": "Malware payload (SnakeKeylogger)", "value": "2102c018b8f2a8efa7a7d611e4120794b332c659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192033, "uuid": "a6c50a24-945c-46b2-8b45-eadf779d764c", "comment": "Malware payload (SnakeKeylogger)", "value": "3c284452b95486778c4782f82cedf9a8d108cc5e4b503105affde1aa6b0c158447eb4237968b656d8376a2e8cc1ab2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192033, "uuid": "785e36e9-0e27-4233-a753-9e4bc4714b8a", "value": "T108355A803EF5C111EDDB223D0D5C4DBA7C79B1C7A162B22AAA7A76C563077F676C8081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192033, "uuid": "87a4ac48-d6ee-426f-8fa0-19e17bfe62e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192033, "uuid": "805d3150-39f3-4a56-a948-c7edcd71af45", "value": "24576:Iwk1CdKvPiXYe6xPQebD1UZ8zBu+dOCwoOBE:vkE4SXrCPHbD14B+dl+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192033, "uuid": "6df6374a-b6a9-4166-b661-143f45a327d1", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192033, "uuid": "fe16b752-3fa9-4114-be20-f6d60402fac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192033, "uuid": "bdd7d284-9762-4e39-84bd-fe5a4cedf716", "value": "cb26a5cff74c0c20ec2856d57e321ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd18fad-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1678192104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192104, "uuid": "dccdc127-bed5-49b9-b8d5-ab6d56f2feb7", "comment": "Malware payload (Adware.Neoreklami)", "value": "e5c69b628bd74229a29a76985c7243dc", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192104, "uuid": "7c25acd4-46a5-45c6-84c3-04e758a4dc60", "comment": "Malware payload (Adware.Neoreklami)", "value": "2d1ca70fa936b9d26d57df1c5616f00fcd45de5500483218c61ba2572ecda80b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192104, "uuid": "23f89db8-42a2-4d69-8a40-1982a9964f27", "comment": "Malware payload (Adware.Neoreklami)", "value": "68f36e87e6b877e40a180b1a994493e193a2f611", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192104, "uuid": "8e86e158-4120-42c4-bfc3-a5084e3dc975", "comment": "Malware payload (Adware.Neoreklami)", "value": "8eb61d26802d545e3dfb4b3777098523b95fe85da0c6df4b0319005a391aa7e35f30939de299313f4f1d0a5c47dce685", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192104, "uuid": "ce276bc0-04ed-464e-901a-3f5ccdade5aa", "value": "T143B633FD17A0E461FBB14C34BEA1B5834D2F738A1ED2FE827622421634E511BC4B57A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192104, "uuid": "cf092fd3-dc88-4a9e-b0e8-ef11b95718d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192104, "uuid": "920a40d5-ea5a-4806-a466-001554696b24", "value": "196608:lfCNpipDus1p7eydx4Jbhr84+FRyl4o6gjxsL72E/IVOkCHZO+n:lUpiZ/7fx4JbhQ4QyGxIaL7b/IVM8+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192104, "uuid": "a546e239-2436-44cb-aa56-46361e9d0a3a", "value": 11239936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192104, "uuid": "d58c39b1-a4fe-4b64-a7b6-125e61194fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192104, "uuid": "abcd1161-847f-409a-947b-601ef8100ff6", "value": "e5c69b628bd74229a29a76985c7243dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89790af3-bcb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678174057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174057, "uuid": "2798f623-068e-4395-b6b2-4e2756a6fd14", "comment": "Malware payload (AgentTesla)", "value": "d44e4dac3575615b2fcc91ff20ab9080", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174057, "uuid": "ce10709c-3c25-433d-9018-1eff6d5263de", "comment": "Malware payload (AgentTesla)", "value": "2d25b0400116af8ab12dbf98f6a6aa7e466211c889f960bdac183bae2868e5bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174057, "uuid": "dd88641e-204d-463f-aa58-d4b4049b7ec7", "comment": "Malware payload (AgentTesla)", "value": "99cbe33d10ae4eefe38f2becc21196e695df2b7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174057, "uuid": "adf4023d-dd10-4191-a7eb-90633b2f04e7", "comment": "Malware payload (AgentTesla)", "value": "c38e6bbdf0b0bbf54ebda958c276e89b6b1bc7e4e30a629d226ca09dc28dbe2059e80fe646210ac07f18ea0db9b1ee32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174057, "uuid": "99a4b93f-86ee-462b-a7af-db659331bccd", "value": "T17FB423083F12BF6124D0FEFCCD1F91181CBBF6FEB9107AC2429A514DD64582AEE92596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174057, "uuid": "4ab5f809-a321-4e99-b00b-bb41d3ff728b", "value": "12288:fea6wSyI5dtjG0DRgSpikmruulUCST7pMCb1nBDzL7Y:feBhjGKRgSQknuS7LRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174057, "uuid": "5bf05a16-7fa1-4a12-bcdf-8770d62da00e", "value": 523333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174057, "uuid": "6ac800cc-6129-475b-85df-d854b44145e9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174057, "uuid": "45d68e7a-b07c-4abe-b1b6-cd5ff6dbcbef", "value": "Scan_0013882982_SKMBT Remittance Docs.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409e6ea8-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678196269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196269, "uuid": "dd7581a9-4e64-47ed-a92d-9231703d5c0d", "comment": "Malware payload (AgentTesla)", "value": "c130a5175c03b31941eed7f67d74f6fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196269, "uuid": "afdb33bd-c357-45cc-8257-3564fee3dba3", "comment": "Malware payload (AgentTesla)", "value": "2e47895c2d29f29ec1e1315a34ff8f6ee075513a92072fa9d0fe522986a712fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196269, "uuid": "85c75662-da00-40aa-a5e6-fd2e79d15467", "comment": "Malware payload (AgentTesla)", "value": "3a0b4663bd0baf0760adc8e8baf2cbcf5e98cc0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196269, "uuid": "1b3f6944-572a-4c26-95a1-d0409cc89339", "comment": "Malware payload (AgentTesla)", "value": "ba7d2565d9114173ca6cb66758f60d205ca648aa1a8e6cfe33ea187c6994c2ff3283bcc41a73ed32160151fe26bf1e87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196269, "uuid": "ac9c848b-d9b2-4a7c-991a-a4654c243b49", "value": "T1BAF3396DD28A8E21CF2D4CB4C5A3084806B2957F4627E65D0EA09CF53E777C3F61B8A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196269, "uuid": "41c1f180-049b-496c-8b02-40b0f61d1d38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196269, "uuid": "ff57cb60-542b-4868-84e0-f8843b43168e", "value": "3072:E9aW00gJCNjhluV2ET1W3ZwjrRj4Hl2/6E4At+HDjL4eOY88M/oGNhA9hr:E9705JCNTuV2ET1WOJjInqr8KhAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196269, "uuid": "b3846a73-5641-4e61-ae0c-78440d629edb", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196269, "uuid": "b3fa2e0a-92ec-4f82-bf37-cd1e72d1a0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196269, "uuid": "cf8a7d17-4313-48db-9609-bb7be5263b18", "value": "2e47895c2d29f29ec1e1315a34ff8f6ee075513a92072fa9d0fe522986a712fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52e1d89-bcff-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678204222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204222, "uuid": "132b7087-5e08-4fc1-9811-b3cbd330a5ea", "comment": "Malware payload (NanoCore)", "value": "51e1f639ae2c40a42cdf55d811f742cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204222, "uuid": "f215f5a0-d2cd-4ce3-a4b1-141ac28d75b9", "comment": "Malware payload (NanoCore)", "value": "2e9b8db393b9d57061144c9ca41a2780403b2083628cc630a0c627207d9d43be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204222, "uuid": "ea4bafc4-3488-4b04-9716-eefd63f51c80", "comment": "Malware payload (NanoCore)", "value": "54d00d45618a8dbabf8bc34350facda467f08fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204222, "uuid": "e8ed713f-8437-4ce3-b4c9-3dab9da91535", "comment": "Malware payload (NanoCore)", "value": "4a1c03bcb7e4039f67bed9f618342bb6896c17a37be8807f4d4e7ebe2013ded7039c471c07247fcfb59a1f94a2a20cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204222, "uuid": "66e3849c-2fe6-4e52-9681-f9fa9294740a", "value": "T1C455CF2373DE8272C3721173B919B3116EBB7C2506A5F46B2FD8393DA870221529E677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204222, "uuid": "63da50c7-da73-4d21-8aa5-f86da67adc39", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204222, "uuid": "20573ffd-8ba4-4a56-8cbc-503a32366029", "value": "24576:Btb20pkaCqT5TBWgNQ7aOsVTgu2K6WDVyx+yguqd2vK6A:SVg5tQ7aOsVTguYWDbSqdr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678204222, "uuid": "eb54ac6e-f016-4cbe-b979-b12e774efdae", "value": 1353728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678204222, "uuid": "1405948e-5b08-4418-93c9-24f4ecab2f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204222, "uuid": "903621d2-a8ff-4c3d-ba6b-1e0077bff607", "value": "2E9B8DB393B9D57061144C9CA41A2780403B2083628CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c386bec-bcde-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678189766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189766, "uuid": "3044dfe9-8943-471a-b1de-8afc5be54132", "comment": "Malware payload (RedLineStealer)", "value": "27e1c36812a809cda3b0c275042338da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189766, "uuid": "29ac9531-1473-4474-9093-5e0bc55fb0d3", "comment": "Malware payload (RedLineStealer)", "value": "2ea3184687d420a49192f4d7727564701799a144023bae49c78bccb9ffdb182d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189766, "uuid": "ca09b7ab-4f07-45a3-8b6e-47f7ff6f0526", "comment": "Malware payload (RedLineStealer)", "value": "e7fbc1e11a99e1a6a6b8094682224c751d3fa576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189766, "uuid": "66ad1f13-4479-469a-8c67-5f135d940ea6", "comment": "Malware payload (RedLineStealer)", "value": "e069704beabf92c4bb2004a69f76db137f820d55ef22096ead5ef755d3087292d16b19dc18a3177ef6a43f8bf147ffd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189766, "uuid": "1fdd0ca7-520a-47a9-9dcc-58712a14d33b", "value": "T106A4011BE6FD8173E4B467B01AF603C31A32BE545A38929B174F6D1E0C726A4B231767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189766, "uuid": "8197465f-f5db-413f-80d1-2f4651dd3f34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189766, "uuid": "0299b42f-c254-4690-b075-b935aa86a505", "value": "6144:K2y+bnr++p0yN90QEXBEyWzP8Hao4s+9V6odP5B/d34Rbs94mp77Lip1Mv:6Mray90d2yQIao4r6opPiRs94NPMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678189766, "uuid": "0b359ae8-6ba1-411f-b31f-ef9f78276e5e", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678189766, "uuid": "054874e4-5487-4e24-9699-8743f0ef6a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189766, "uuid": "91a13576-1cb0-4b7c-ad7e-0c32b464cc02", "value": "2ea3184687d420a49192f4d7727564701799a144023bae49c78bccb9ffdb182d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3aba5d-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678196211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196211, "uuid": "b5133777-13a9-42a7-9d7b-5fb548f777f6", "comment": "Malware payload (AgentTesla)", "value": "a5b7c41ccef2e8b8d3d5cac2f7a21e13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196211, "uuid": "744fae8d-d9a4-48a8-ad65-a80325fdfb50", "comment": "Malware payload (AgentTesla)", "value": "2f76e57e296684243279d8d4b388798600beee3d3de8323e5b82d2ad93cb56fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196211, "uuid": "971937c2-3da0-4b42-a658-47b8dc2843a0", "comment": "Malware payload (AgentTesla)", "value": "ecb37e478a8954d712d47888609cf221d746ed3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196211, "uuid": "91c27933-c39c-4909-997e-89b6ba414062", "comment": "Malware payload (AgentTesla)", "value": "d4f5357dc9c7ac626d0a03d161708ff2b714ef0c3be1338cc5894c22c445712402762d0b828fc4945d38cf7b6e06c1e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196211, "uuid": "e937a9e1-68ed-4a04-9f66-c023161840e2", "value": "T1CFF3396892D99DC2D32C8174E4A011D8CAB2D1465227EF9D1EB1ACF63F467C3362EC67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196211, "uuid": "5029883d-594a-44e7-b4fa-4bd160a76e07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196211, "uuid": "960d1850-0ab6-4033-ac03-108333e6046e", "value": "3072:P4kfksY6150zb/k1Z7bU5sWm/tGiwvI1QC3R6Dt:8yG/s1ZHUqnVwvI3ID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196211, "uuid": "2ac2a445-286f-44ee-8bfc-334aee2a35aa", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196211, "uuid": "c2e7f363-bd67-4a9b-99ef-df29b7c5e684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196211, "uuid": "a13b093a-7d38-4a2d-a44b-0c0bb72e53c4", "value": "2f76e57e296684243279d8d4b388798600beee3d3de8323e5b82d2ad93cb56fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe654b0-bc80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149768, "uuid": "661d4907-cbaf-48cf-aa64-a441ee6c2e67", "comment": "Malware payload (Mirai)", "value": "1efd62d960e038fdc875a876abdf6b46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149768, "uuid": "f71bc8f5-2a69-4f76-a116-439500b57454", "comment": "Malware payload (Mirai)", "value": "2fc3141eb3e0427769b77572be8d0f6b7c90dea23d5f8e8fa8901204a02794f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149768, "uuid": "cceccf36-9ece-4a51-bd8e-469bfdf10fd3", "comment": "Malware payload (Mirai)", "value": "05057396e7b3f79e831d6168b196b9a90b06113a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149768, "uuid": "75c53828-2dda-4867-8ab5-6398ed41bb0c", "comment": "Malware payload (Mirai)", "value": "89c2e7cca0a47fae8e284f4d6cffb9f8accfcd152479b947372ccecde996d1245cc292c37f9ce7be5ec2346ec20b6ebb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149768, "uuid": "bf28ef84-0058-4f64-be63-b5b4f4cd5864", "value": "T16072B03219473A25CA701C39A67DD4E723A61339E2FE71F103640728EA8665791BDACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149768, "uuid": "5a2137cd-705f-4323-acd2-2f2b8a5fcd1e", "value": "384:GvwUk/F5juTz7Ri8D6lDGSGu5dhTBq86EPcZlVWs8/ShymdGUop5h7u:4tQan7FWDfBg86EkWqs3Uoz9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149768, "uuid": "017b8d0e-3427-40df-b54b-e3822d304b41", "value": 17496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149768, "uuid": "f0fae776-d672-493f-b0ff-b9085ea0f034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149768, "uuid": "78b2bb39-c6d8-4533-8656-aef1943de789", "value": "1efd62d960e038fdc875a876abdf6b46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260f5e88-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155422, "uuid": "7da00eba-e97d-4aa6-bbe1-d6c4dbadc9f0", "comment": "Malware payload (Mirai)", "value": "644fbffee35b3a7b4c5ba02d10e82b48", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155422, "uuid": "5401422d-142a-4ee4-9681-10d8bf587592", "comment": "Malware payload (Mirai)", "value": "320ac9c1fbd76cd7d5c71fca7413bf2073a4b85ef73954555e5fd03b6d385b7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155422, "uuid": "5ab14df5-4c2a-44ab-8bb9-1e7463d03295", "comment": "Malware payload (Mirai)", "value": "47d7f8b7381564998c0a7a4f37f5a6d3a7732903", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155422, "uuid": "94cd9b27-1d84-4137-860b-209055b08e24", "comment": "Malware payload (Mirai)", "value": "57b4b02d5f08e405e415b0a98098f87dc17395de7f18150f56f6f7bce313d5f7508bd13c2744c40b91c8a73541d5afd4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155422, "uuid": "a1eb040d-d497-4c83-8e66-f40e8bbc5719", "value": "T145C33B56EB404B13C0D51779B6EF42463322E795A3DB730699286FB43F867AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155422, "uuid": "aac8e960-3ee6-458f-9705-ad677205691c", "value": "1536:UInpOvHL+hA392jEYXUK7MYoMuPGY+cTNl94iuqcbWoq+P7tWDzw/9T+yLJD:+HShs6R7MYoMuPGYTEqcCoq+jtSM/9/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155422, "uuid": "7fd83c0a-7495-44d4-8a40-7406b7beeca7", "value": 118940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155422, "uuid": "5208ab33-4ae1-49ba-9451-c48f9ccb6cba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155422, "uuid": "e49cd2b7-a6fe-4d73-89a0-df84cec03a32", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280fa355-bd0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678210401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210401, "uuid": "6878e719-acd8-4a1c-a09f-35350b86af25", "comment": "Malware payload (RedLineStealer)", "value": "341dd25109a0edf55c3169110a358e48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210401, "uuid": "5254bdc0-754b-4f84-9710-df54912595ec", "comment": "Malware payload (RedLineStealer)", "value": "32e595d4c93e4e0ca55de6756cf23ea090ea45c86d958857f44109376b02e3b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210401, "uuid": "e064f694-d8bc-4d5b-ae58-ab7f38fe84fb", "comment": "Malware payload (RedLineStealer)", "value": "10d375284193deed8a23103f8d9c13af138d034e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210401, "uuid": "e7eee5e4-744b-48c5-b710-5f9ad0114866", "comment": "Malware payload (RedLineStealer)", "value": "67934bf55a5d3d145ea5f7f31540ea70bf5330fa48ccb84694a602cd186ffe1cbc236d509f500bc1645e35b533894733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210401, "uuid": "acd29bed-fe4b-4763-b8c0-30602083fa30", "value": "T14474F121B7E0C076F2A716B018709BA52E7E78716676824F73A95BAD1F603C07A76703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210401, "uuid": "84df321c-73bb-4a90-816e-7fc286b3b464", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210401, "uuid": "37b4c723-3ad7-41fa-922f-9946ed8ab5da", "value": "6144:Yk/Lk3Hn8O58Js+fi7nmDhaUOlpfJpb7TbBnqbn4eZO:Yk/g3HPuJlK7mAnfDloZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210401, "uuid": "3aab7f80-1095-478d-9bb8-d59871932806", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210401, "uuid": "cb8ec485-aff5-4461-a145-11f77101b5b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210401, "uuid": "28478e0d-9cd1-4de0-8b87-e22a5afc6ba7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfee0a6-bcbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678175323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175323, "uuid": "e964e17d-4260-44be-938d-a7956358afb3", "comment": "Malware payload (Formbook)", "value": "969b812603a67a1678ece6bb07742025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175323, "uuid": "b36e40b1-b608-42be-8b1d-bd59cd1de248", "comment": "Malware payload (Formbook)", "value": "331a1fa77bd0b90483ec0d32a815e1e766f75ce389a8c9f26f24d3db61459e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175323, "uuid": "5d77ece1-60fb-4b12-899a-d2e498a8caed", "comment": "Malware payload (Formbook)", "value": "ff17e0b7a147710baad211d4067ec1942e6559cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175323, "uuid": "9b9ab333-3dfb-46b4-b8fc-679cd35619a5", "comment": "Malware payload (Formbook)", "value": "bb1fd73c6f699cbbfed67a6d04a2607f3c4bdb776ce68b2e15d9e823735b50dd9dcfd94cffc5aacb151ee7cf177e7be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175323, "uuid": "8e9e2246-60aa-4d9b-8d71-b2bc95011113", "value": "T18805B0E42F5D7263E786A1F3680426A7DBACBA5D6527D0441EE210CFC1CDE7C1112EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175323, "uuid": "b6eccd24-6706-40bb-a494-d1d6db7be8db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175323, "uuid": "219aaefc-07f3-40b3-ae3e-a295ed0da929", "value": "12288:klXOOBxCcIii1n6/sHH/NWOV1nMulMa4uvcBhy8x6E/:0EcIh6/slWOV1Mwv+yNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175323, "uuid": "39e6cb13-d30f-4899-b946-5fcc774485dd", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175323, "uuid": "9881c97f-a295-4d8e-bb71-d406a531aa78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175323, "uuid": "3c191800-c968-477f-a9e8-a59fda639730", "value": "rasbp altaa saprbqbr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9494367b-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678192544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192544, "uuid": "1a577574-e0a9-43a0-a587-af0536547e89", "comment": "Malware payload (Heodo)", "value": "17bb6e6373cb380a935e271aa121ce06", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192544, "uuid": "5e7a87eb-c632-4787-9645-3708059cf1b1", "comment": "Malware payload (Heodo)", "value": "33edffa63784ad3a12c496007e3871f7441d5b4609ed10a346d239b9582b1059", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192544, "uuid": "50393fea-0c34-4cd7-bfe7-a7c35f2d2823", "comment": "Malware payload (Heodo)", "value": "b11e9d1d839957133b660c37ac4ef9aafe2f4bd6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192544, "uuid": "5c5ae27a-7cb8-41e8-8bda-4e80fff54590", "comment": "Malware payload (Heodo)", "value": "ce5ab54613ee808e1dba1bc713b310a15032a4efda8b329c631bb9997b70b745985664a6b6cfaf34f36259e3f7650ce6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192544, "uuid": "a1bfd77c-ad81-413a-b172-02d50b46d4fa", "value": "T1E41523F8FEB5E4A7F489E03148468B47C28CF9C6C6D9D9C612B8467D9143FEB0B09946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192544, "uuid": "a755b74c-f8da-471a-8813-6525eafdda97", "value": "6144:/s929TDSYLJY3lhXf0cJzkHFliEo6BMTJgw+b2S4oMUCIkaAWr92GoKO33EG:/VHSYLJY3l5zzkH3L6gjt4R5+tr9vYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192544, "uuid": "3b2daa5e-65ee-42a4-97d9-421420322d82", "value": 909622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192544, "uuid": "70921edd-4994-49db-9fc0-904650e681d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192544, "uuid": "9e9fca92-a7a4-48d8-b73d-1326f0b98b0e", "value": "qAHBdubzwy32lVnudsQNbk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56a1d75-bce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678190935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190935, "uuid": "94ebabb8-f06e-4c5a-85ca-b1c762636598", "comment": "Malware payload (RemcosRAT)", "value": "1ab0d89f3cb63255cb7281dea668ac59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190935, "uuid": "1e0766db-c712-4542-879c-838bc3eb3acc", "comment": "Malware payload (RemcosRAT)", "value": "34b984dc3d53c9a37675baf2d7256e668a63c770cf88ceadf7822b8506623d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190935, "uuid": "b354859d-5000-473d-abd9-a06a125492cc", "comment": "Malware payload (RemcosRAT)", "value": "a2a0e716c1c8d9ed842497a411ea41cb0ac64ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190935, "uuid": "22aec926-2844-4b55-a44f-0803937097fe", "comment": "Malware payload (RemcosRAT)", "value": "f0fb744edb9a8d3e89b4474e4f099574808d566116bf44acbd8ba12661993dd76e330c142e8994d4666b96ac290a6f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190935, "uuid": "0cb83c4e-99fb-4ffc-94fa-96033c8cf733", "value": "T1E536FE252EFA501AF173EF755AD470BAAB5EBB333A2A485900C10B0606D3845EDCD67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190935, "uuid": "f4cdd049-b5c6-43e5-834e-198844c04e1a", "value": "24576:eTK0BHE/0STkBofcv1vwRy7xUBFgxdmn/DpJiVKPBHE/0STkBofcv1vwRy7xUBFo:eXB6K1vwYfyB6K1vwYf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190935, "uuid": "5bf67220-ebd6-45bc-8909-cada9b9050e7", "value": 5191680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190935, "uuid": "6d73c4c3-d173-4d5d-b696-8cd2a9aa7a32", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190935, "uuid": "9db2dd72-90cd-4bc4-a11a-c5963d170cde", "value": "0028200282 - INV_pdf.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba739031-bce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678191320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191320, "uuid": "6ee97a94-cd94-47c4-87f1-28704cabd90e", "comment": "Malware payload (CryptBot)", "value": "7ff84a02ad72387680ba63d0fb3e084d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191320, "uuid": "2f0a93be-da13-4e76-9237-48748623a8df", "comment": "Malware payload (CryptBot)", "value": "3529fdeb51006fd75fa7d19d9b686d64de7b2b89f7eb90b5f9e0e83b82693b28", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191320, "uuid": "48850c1a-d4b2-40ba-a1ee-8b8100a43d8c", "comment": "Malware payload (CryptBot)", "value": "1edc49435ac9f3e294ff578c0fba13e8e56e97d5", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191320, "uuid": "6ca284f5-0140-4540-b583-6656fa53da43", "comment": "Malware payload (CryptBot)", "value": "0f504d984cbf8beeb7e935a98c443033b6bfb1092df9d413ec78fb8240374d061cdc8c003c92a9561bb151ccff604bd0", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191320, "uuid": "f34daf17-b182-4d3d-bd4c-0b1f4f527d12", "value": "T1EE050176BCC6847AD0C15132C666C2307BB47E3A046268D777E4FE2DE72D8918BCB625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191320, "uuid": "902097e9-cb4f-4cd7-9e48-13d319ee524a", "value": "24576:P9biLizJtXjgotPAMEsbZsTJz0R3uLr4HaDF+7H:PMLAXh5dvbZk0R3hg+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191320, "uuid": "0bba7ee7-2297-4408-8784-72efa23e1495", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191320, "uuid": "69b2314d-2ba7-4409-aa0f-2753f96c0d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191320, "uuid": "6ca32186-7f0a-4d65-85fa-aa934169070b", "value": "7ff84a02ad72387680ba63d0fb3e084d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24eb2ffc-bcdb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678188492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188492, "uuid": "675ac6d4-d63a-4a1a-bb88-a70ae8fe98c2", "comment": "Malware payload", "value": "266eb42274deaff41173cadd1ce347b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188492, "uuid": "7355ce02-e45e-4db7-8d61-29cbe765f05e", "comment": "Malware payload", "value": "362b3d10fe3b3c4abe1f56ed6f08f9199a4977ea41eb9dcc4671280301c08190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188492, "uuid": "beec3698-4320-45a5-b138-d4d074f54a57", "comment": "Malware payload", "value": "1e43c113a48078e6e23463fd144bf6d3cfdd4d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678188492, "uuid": "e7487327-d483-4ae4-85e0-f4f036e7b849", "comment": "Malware payload", "value": "feb6db7b1e65c20a85247bd7561d6268b17b5f8140168dddf26d6bfdd7c0fda955861640d00de27a427d19643bc9f8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188492, "uuid": "553da95c-895f-4f8b-98e8-81f6079dbee3", "value": "T15FC1D60357200CD3E7498FFA56738D9C4A3899511B5119EB43639CAE88E87C2B4327DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188492, "uuid": "502eff94-9378-4178-a24e-2685399ceefa", "value": "2911fddc05530c2e979456cae29b84b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188492, "uuid": "269df1ca-1b30-4fe5-9a4b-b06537c4c8e6", "value": "96:yxZQBaABSEy3MiFLqNPtboyn9Zi3LBf7dCcTVq:/B/BfEvFL6P1oynnmL+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678188492, "uuid": "889ca257-3d6a-4b7e-8684-5466a948fc52", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678188492, "uuid": "abf95b61-dd35-4c43-a37c-de20ee44bc8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678188492, "uuid": "266438f9-95bd-4c24-9bd1-53b02577721f", "value": "SecuriteInfo.com.Win32.InjectorX-gen.13796.28359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71447a3f-bcca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678181318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181318, "uuid": "ac1449a9-ccfa-4250-85d1-9cd88cee89ee", "comment": "Malware payload", "value": "d51b795d07157787fcbd5a19a70f1a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181318, "uuid": "3b24fa87-2db4-4d91-a3a9-9a63b169b1ab", "comment": "Malware payload", "value": "36cea9a517889dd607921a87d2bd9ed04b2de4c465f17d52bd1e399aa979da83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181318, "uuid": "a7e1c7e2-7f65-4ba7-9418-e6563cc3c227", "comment": "Malware payload", "value": "b6b7732f77f6c2f8cc9971649c039dace86d5ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181318, "uuid": "44d47406-7725-4e6f-ba19-63f10affe60d", "comment": "Malware payload", "value": "22895a2db2bb62eabea48196d715badd7cc3f79ef04ef13f89b25cf8053cc457ec8af1cb61cc1a4942c16babf1dc2696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181318, "uuid": "e6aad927-e919-4607-a09c-797cf9920e2f", "value": "T19BD43332AFD2895AECE8A53DB8D47173053E956C880EEF631859470D9C9FC309598A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181318, "uuid": "3130968f-b14e-4e42-852d-d16d79f7fbf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181318, "uuid": "dd3b1905-cc02-45d9-8355-fe32dd98e012", "value": "12288:WyZAR+MapJGvh9+XPV7FyKrc6p4gXka9V3F/rJK3y3pEQAs5abyxZY:WyZA4HFfVpyM4g06V35j5XAslxZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678181318, "uuid": "38d00944-0c3f-4b4a-87bc-acf946e45b75", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678181318, "uuid": "d0aacdfa-9933-47aa-93f0-af46efda6760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181318, "uuid": "62e77639-5c64-48f7-b6de-9797425576e1", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.25602.2701.20822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246d7d4f-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191927, "uuid": "b3cc97b4-8655-46f5-a52c-32e5721527fb", "comment": "Malware payload (SnakeKeylogger)", "value": "0cf2257d8f0ea8c72741926c8f831ad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191927, "uuid": "c1d96f5f-6ad9-4bb4-beeb-e1d56afb943b", "comment": "Malware payload (SnakeKeylogger)", "value": "36de80967b905a8119ff8a5f0871dc21086ff79c04ce3955662548c3e372de52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191927, "uuid": "d405687e-16a4-44b7-88e4-4fd02dc51ad0", "comment": "Malware payload (SnakeKeylogger)", "value": "3b3e4b8b9eab1cbb93e9f0dd3359edf0967d8fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191927, "uuid": "8da2cd1d-8a90-4ef5-b971-d412fd366fd4", "comment": "Malware payload (SnakeKeylogger)", "value": "ac39021eebdb7c1d6c6590a6b862e389d5938b351a473cd4d7ca5bf55eb844b6b48e5bf62884f557e032b68373f84a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191927, "uuid": "cdb11e4d-a82d-407e-8d62-e894d5aa3a61", "value": "T1D4259DA56F19A257E7C2A1B31804EBB7EBAC7D4D2416C0883ED13D8FB1B9D2C1111E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191927, "uuid": "690b91ee-dfc3-4d50-8093-6166afcc7a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191927, "uuid": "ee112a60-0645-421a-9063-0f3a595837ce", "value": "24576:ZVYNUfqBp6ROPMmJTHKb4uSYSq4s3Vg1g:MNHRTTHE1ze1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191927, "uuid": "66edc4b7-be46-4320-b45b-d36a6f0d5e34", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191927, "uuid": "c4eb902f-f313-4faa-a4bf-f1d687b194a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191927, "uuid": "0d428179-ecb8-4780-a7c8-20f84a9dc633", "value": "REQUEST FOR QUOTE - AJAX Quote for tender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2ecd71-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678199563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199563, "uuid": "793db59c-7fbe-4520-8131-351944d1d71c", "comment": "Malware payload (Smoke Loader)", "value": "1d2fcdee0c3215a95f19a59cd206cfaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199563, "uuid": "27c62992-2abd-4140-89ab-9e8c46ad6ba8", "comment": "Malware payload (Smoke Loader)", "value": "3700b3c0d0391384653b225401baf6fb69885e80250f6704745b65b30b6a57a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199563, "uuid": "a79e821f-9abb-402b-9485-e53115dce610", "comment": "Malware payload (Smoke Loader)", "value": "bb675197f33aafb3d395f9509281b093f415e8ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199563, "uuid": "f3f42a8e-df89-48ab-8f45-1f761f17e999", "comment": "Malware payload (Smoke Loader)", "value": "6312fba70656407860f9c8d59c615979f3d2a19d75673715891b99fac5177be7520a740fb17235383457be2847e40c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199563, "uuid": "9b594d72-8560-434a-a742-c7c2dfdd8fc3", "value": "T1B744DF31B3E0C076D6FB19B41974DAE41ABF74322674858B33A8576E1E307E0AB66317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199563, "uuid": "25e20356-dce7-42fe-8b29-5bcf14065fb7", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199563, "uuid": "a5604dbd-79fd-478a-a214-c72b261b202b", "value": "3072:9N0SbFLZ30SonRt3lTqxIjQDbXb0QRWb6nRLp78mMm1YtQEeHNz8rw0HUPYebgyi:9LWt5YbrvnRLp78TFQtCrwJY24eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199563, "uuid": "5509a76f-dd04-4a0b-9215-4ab7b8d992ae", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199563, "uuid": "9a21ab8f-8e3f-45e1-84da-5d94acf3cad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199563, "uuid": "41a9aaf1-61c7-4bd4-9b07-20da565a6a03", "value": "1d2fcdee0c3215a95f19a59cd206cfaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ef1ac0-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191953, "uuid": "3769dc64-9f78-4cd7-b1ab-4a70ddb06748", "comment": "Malware payload (SnakeKeylogger)", "value": "c900513d49f0104410c3bed7ee93c999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191953, "uuid": "e945b2e5-3057-4f43-81b6-693ce47c0964", "comment": "Malware payload (SnakeKeylogger)", "value": "37060f2c77a3ef9365f60835a9a3c2e7f524095952a18bb805c6acbbd6388cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191953, "uuid": "6556f1cf-e94a-4fa4-9417-be27a7d8b95c", "comment": "Malware payload (SnakeKeylogger)", "value": "40f54bf892d928aa42db33a79aba3dba11b5bddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191953, "uuid": "f20d3a8f-157b-4c0e-ba3e-36e5f2b9cf90", "comment": "Malware payload (SnakeKeylogger)", "value": "a3ba51aa7e8db38a65cad3cf3284c7878d7f010acd99fa814795ea307baf79cf145037d6e3274408f1e43ef59ff5fba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191953, "uuid": "3f7efd55-4f7c-4cbb-ad5e-a89b2eeb2af8", "value": "T105259D956F19A257E7C5A1B31804EBB7EBACBD4D2426C0843ED23D8FB1B8D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191953, "uuid": "9928078f-964a-4e74-8e99-66a29bf0536d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191953, "uuid": "e0c298ef-105b-49a7-8f85-487a61c05a4c", "value": "12288:CiX3hBVmNUfqBe4+Q1kZhAJNmC4UywczRqk1HMi/dXXkFtn9cSmGGpKsJpte/K:3fYNUfqBp1CHHUyTEeUFtncros8/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191953, "uuid": "133316cf-8762-4187-9cf2-e48ad36972cb", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191953, "uuid": "88e7fd51-d771-4490-92ff-de2f78519280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191953, "uuid": "cfe181d7-21ce-42d5-8ce1-bad8cd93c8cc", "value": "578dtZQ3vawdrNY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c89cf2c-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191967, "uuid": "3f4cd932-56ef-496a-b0ca-6984f9c02d20", "comment": "Malware payload (SnakeKeylogger)", "value": "efa2297c8192bb6b27f3ecb42ce328d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191967, "uuid": "e052dcd2-70a6-4452-9b28-cea54dfcdec5", "comment": "Malware payload (SnakeKeylogger)", "value": "372d9f066620aa4050d10aabe89417d5d028c3fe0de5bc62bee864b1f2b18dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191967, "uuid": "95370044-9ffe-45e0-9f89-2115a089d7b5", "comment": "Malware payload (SnakeKeylogger)", "value": "371ada2b2e048d9457a3fd1c01a8c3e7c46a2c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191967, "uuid": "ff0be25b-aaf3-4a46-aad9-08b7aebfc369", "comment": "Malware payload (SnakeKeylogger)", "value": "3361f2a08db4e2f568edc8003f26f85649893f55838dc2ea4427903d84e4484790d6039cda2a5ef11b3b904ade203da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191967, "uuid": "e0836255-93a1-4689-a50d-1bd416efbc7d", "value": "T143558CD1B6549897EB9B41F36C1AAA316ADABE4C5464C00C2AD93F0F71F3B15205FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191967, "uuid": "2a80ab8b-9bde-4093-a241-6452d36d5b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191967, "uuid": "699bb455-08d9-463f-8163-9ab7dd37f53b", "value": "12288:n3X3bBVmNUfqBe4WJquJmFVDzgotjuAO+HpX19jRKK9wm8ItJHMsMjaJSY8fDUQ6:nlYNUfqBpyJmFZzgoVbrN9P9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191967, "uuid": "8681dc27-bd3f-4a1b-ab1c-43c5bd1abc67", "value": 1281024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191967, "uuid": "ca2bf2b9-11d0-456f-ac07-b73bc8c150fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191967, "uuid": "97beba9f-7d15-4baf-8465-4591dc7a657e", "value": "YPT23-99717 numarali Dekont-Ozkanteknik-20230307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb2cf38-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678192129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192129, "uuid": "8f3876df-ec57-43ba-b203-b07f143d4641", "comment": "Malware payload", "value": "cbbdef6c4d82eb4ff01ed43f1e641907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192129, "uuid": "abae17dd-8489-45d6-abb3-893f0e5e899f", "comment": "Malware payload", "value": "37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192129, "uuid": "68d5d4f2-6c14-4908-a395-35ba6188e83c", "comment": "Malware payload", "value": "722ba8786507f2cad599b11cdc4a139909f4f9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192129, "uuid": "1f8c7dfe-425a-48b5-9cc5-b20e6e607e0a", "comment": "Malware payload", "value": "0d59414ca0ec1a85740335afeba1176a59a011f59851cf3b6123a0d8369f9de9786022a0f26048af6e2fdf90b078b02a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192129, "uuid": "a53c53c6-1761-4f64-b51d-91e5858064c9", "value": "T1C9835A4775D2D432E4B31E3A14B4D5B14E3EF9210FA1DD6B2788033A4F641D1AA3AE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192129, "uuid": "bde7a3fd-28d3-4b89-bafa-dffaa3c274af", "value": "c53787f039f9c23a754046adc2fd2ddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192129, "uuid": "aac5c846-1a9e-457e-ab1c-f7844ea310c0", "value": "1536:qce5tx7pMyapco9fGaIZ0rViEddJo9YLndeB5SvE6LSvaNIsWWcdv+mh1FB3x3hC:qLx7my0cA1IZxMJo9YLnUBoLSCov+mhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192129, "uuid": "63b8fb95-d811-4eaf-be11-4c689fda36b1", "value": 84128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192129, "uuid": "584f4771-8186-4b45-bb68-bb29779d66d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192129, "uuid": "a0e2d4a3-38e7-46c1-90eb-3dde93b0bb80", "value": "cbbdef6c4d82eb4ff01ed43f1e641907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e85ed9-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231680, "uuid": "d0906439-3857-4870-a147-a1f7a203f6b0", "comment": "Malware payload", "value": "8a58ca21db656cc971b6fc464c0e6a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231680, "uuid": "e81974c0-7d95-425a-85b4-73fa790b61de", "comment": "Malware payload", "value": "385cb8dac2b259fbcb4ca6c84753936fd6bc61c1a01d428677c43aaaf7cdeb9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231680, "uuid": "7767f62d-1fb3-4968-81e9-7e1709da6d3b", "comment": "Malware payload", "value": "e857d3be8d9ba0e37f7fd3d0794a476e4b0fcd16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231680, "uuid": "e749ca2b-f32e-4acc-85ca-90491a428a98", "comment": "Malware payload", "value": "1050e1723783bb3c29b9deee98181f65a01ea12e72d4f04b8c001be9971fae081f964eccb90385430b08240d54a4ed74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231680, "uuid": "201e6988-5413-474f-ba9a-e77cc640ab85", "value": "T1CEE16513F3689BD1F35856398CB32A72AB764524317EB17F57D70225D832500FD0D68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231680, "uuid": "5374e6e9-c397-480a-a026-2028f33693e7", "value": "f56985cfc48658c63b62bd37fc834bed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231680, "uuid": "e8eeaa0b-f9e2-47dc-ba77-b9c16e0ccb91", "value": "48:6zK7OlRCVwrqwySzU2knA6a4fDwsrHfbOAWwoH1iX/jbVL1fLQRVpzprpepcp3pN:AoOUOrz6pfDwwHfbOAW1wLbJZQRXF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231680, "uuid": "888be06d-66ae-4d35-b912-571f7250e18e", "value": 7200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231680, "uuid": "41889751-b582-4949-95a8-2a2f911fbd96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231680, "uuid": "57519948-5f5c-4bfe-90f7-4595a787c3af", "value": "SecuriteInfo.com.Virus.Win32.Heur.354.10958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d1a10f-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198850, "uuid": "196133d5-5af5-4787-a0aa-b17bb924ecaa", "comment": "Malware payload (AgentTesla)", "value": "bbf04020b6cecd39ec3112e9faa464a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198850, "uuid": "f20f3289-8783-438b-bbce-d90e404fdf33", "comment": "Malware payload (AgentTesla)", "value": "395b7bdcd37a243402190a6e4805879bd2df0efd57a64aa8f1b59f0ffa78156b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198850, "uuid": "1972516a-21d9-46cc-a041-bed543f94bfe", "comment": "Malware payload (AgentTesla)", "value": "9debb4424dd09d6d327a37ef4323c22f90c6186b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198850, "uuid": "8d5723c1-c415-4560-8980-cbea9bbbb29e", "comment": "Malware payload (AgentTesla)", "value": "2ab2428247f57747dfa6214f915b83e8b48ca6df551d1e4adba4cc25fc135b3206874250df7ed8956b056a422cc96ae8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198850, "uuid": "a51bbb55-6bf6-4e11-9252-38fdb673c820", "value": "T1E005381B243E9002F49D11B51B16272FBE38D66D5E27E6F63685586BD10AE233FC2B34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198850, "uuid": "34129609-399c-4dd8-a96e-f312cf0fe5c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198850, "uuid": "e9c51c04-c828-404c-96f9-1eca80856b71", "value": "24576:j6CCF1W6ZesX2vB9OLmn5kUFAMglY2+pgnkC+oMCnraP68r:j6CCF1W6ZesX2vB9OLm59FWYzpOH+/ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198850, "uuid": "2dd34f45-2f3b-41ee-96af-7764f869f122", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198850, "uuid": "860e74a3-a72a-4e3c-881c-0e61fb876a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198850, "uuid": "4088be67-ac5d-4d47-b10c-524ba286caef", "value": "bbf04020b6cecd39ec3112e9faa464a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599e00ab-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678231530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231530, "uuid": "b31b1162-4878-4987-b20a-aaa895abb107", "comment": "Malware payload (DCRat)", "value": "7123a4a6005b41f8c8b0a2c3c2984d72", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231530, "uuid": "966dc457-0cf8-48d5-9f15-9bf95293b545", "comment": "Malware payload (DCRat)", "value": "39fb074fd0776fd0657142ff769497cff4c20e5af529c038b5c8f4cf89d69a81", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231530, "uuid": "d8addc10-5ab2-49e4-8a20-dcd75af7587f", "comment": "Malware payload (DCRat)", "value": "5a0012e705f955ce9a84c8da191e692cbe7c1e87", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231530, "uuid": "267b9136-68af-4e1b-854c-419509fedbcc", "comment": "Malware payload (DCRat)", "value": "e5d9a924522fffdddf97ad4a62b9e912f0240b386ccc3c5ae5254b09d6a7b1448247846d788d4a163c20998b66e7be34", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231530, "uuid": "8af217d8-c8fb-42a6-8a7f-7b1226907b9a", "value": "T167159E113AF85935F1BF5B39D5F069668B3AB9222B62DF4F02D103891A23740ED50B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231530, "uuid": "f3b326a1-8250-43f6-94a6-d4e49e70d352", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231530, "uuid": "17d48c5d-18ae-45b4-8eb5-ee3208fab67f", "value": "24576:R2G/nvxW3Whv6+OgbjAN2BJKC2XOIJiX+/Oz5:RbA3gtLb/CC2eIkuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231530, "uuid": "78b0dc15-bfad-4aba-b7ff-37f8375b5630", "value": 913352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231530, "uuid": "5e7fbefa-3d45-4469-9727-12ad9022ed13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231530, "uuid": "cb665f9a-ae1a-4834-aac3-37211611c28d", "value": "7123a4a6005b41f8c8b0a2c3c2984d72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19475332-bd24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678219825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219825, "uuid": "f0fff504-d56b-41e4-bb69-1de990a5c2ea", "comment": "Malware payload (Loki)", "value": "e0031838b5f640d5d70532d03b016ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219825, "uuid": "0f2bd689-a67c-4888-ad47-b58c9e3be643", "comment": "Malware payload (Loki)", "value": "3a86f6f2018119707b616977342cbab7e40ba5771ebc853301abe2b28c613e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219825, "uuid": "4c37d024-86c0-4edb-9033-1c9c036e9066", "comment": "Malware payload (Loki)", "value": "2f3db882f056d743e9ac2f3dbad0d2e033c91640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219825, "uuid": "ff9a318a-d051-4e3d-88b8-231d6c6bee93", "comment": "Malware payload (Loki)", "value": "8635c8cd2519d1ed0a54508d1fcc0062f914a5d6bcd5e9439942125eb88f057836d5b7eae1f027e77f499bd770c9f626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219825, "uuid": "97af1e98-0dee-40ab-9959-dcefecf63535", "value": "T1DBF4163CFCA49BD6E23AF7638557E210F3F550F3B311C8166EE2488502A5A72A2DE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219825, "uuid": "23949b82-58d9-41dc-8924-bf0b08a6467f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219825, "uuid": "c294ef4c-f23f-4cc0-8c95-1db8d66a65fd", "value": "12288:3ZPkxrK9arhoJmKvy8ZPWro3BxXcCE+tM5Dr:VkFKOXyuWBmGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678219825, "uuid": "0f9ff980-8f6a-4564-8546-c37f3763018f", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678219825, "uuid": "2983ee86-fae3-4513-87dd-60ee1dd4b15a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219825, "uuid": "b7a79eaf-bf9c-407a-b3d8-3567e0a84672", "value": "BANK COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8841f9-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155433, "uuid": "9aff1892-1789-423e-a351-d049d15451dc", "comment": "Malware payload (Mirai)", "value": "d96af6f73ca1d4792403513b362bb9c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155433, "uuid": "7651377a-b056-4150-a46e-ab8d3a887a84", "comment": "Malware payload (Mirai)", "value": "3af7b6405df7b784a5f64adb3ef03b5be51e5a36be36bdf6682501ec5b1dcdb6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155433, "uuid": "c012ad0d-1705-49b2-b046-cf7bc61f91b4", "comment": "Malware payload (Mirai)", "value": "4e28709461c0478e7e6da01de8f75c405e489d2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155433, "uuid": "eeef5f09-775c-4c3c-a528-47356963a83c", "comment": "Malware payload (Mirai)", "value": "7422183783d5c9f308e7af293f2dce17243129a06c187ac3d8c8f46303ac890b16beeea016de5a50f46b519ed7891176", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155433, "uuid": "dcdf0e54-235b-40d4-93f3-c9304821eeb2", "value": "T1CC439319BF610FB3DC6BCC3705E91B05398D644A22E8BB3A7934D528F61B24B59E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155433, "uuid": "706711a7-ae7a-46f4-85f5-33fecbc67f15", "value": "768:q05hUzYhyfzhlft52aeUVe3hdVZ4faXizAQEOU4+pw:q05hUMCFtphVshHZ4ftEOfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155433, "uuid": "7b3ed029-b157-46c9-bf98-8f41cffb4344", "value": 59448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155433, "uuid": "7b4af550-74b4-4908-b66c-ce2349e1adaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155433, "uuid": "04e8f7c3-b712-471b-af26-a01b43c44826", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b455777e-bcf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678201188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201188, "uuid": "11ef5212-dc46-4753-81fa-8af279a4c472", "comment": "Malware payload (RemcosRAT)", "value": "fd235f4cdb48e7185b45125746de77fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201188, "uuid": "c3fdde8a-4d34-4366-aa98-b28ae0f91ee0", "comment": "Malware payload (RemcosRAT)", "value": "3b07ad25ee1df777dc55b81828866fd88ac45020d0de4747b75b105f1f953e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201188, "uuid": "3f8ac5dd-c168-4edc-8091-c4de3b0c6ee6", "comment": "Malware payload (RemcosRAT)", "value": "81991043c8fe1c646c09df8ff2d6bffd19d12e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201188, "uuid": "7940d0f2-6262-489a-851c-083511e99eb6", "comment": "Malware payload (RemcosRAT)", "value": "77741d925a4fbc92ee0bc1198b81c8f096944948166cb509e742a4bf445b1f8247711c21c0c333a3704c500a894708ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201188, "uuid": "e14b5055-a994-46e1-a931-dbacfbb320f1", "value": "T14B36FE252EFA501AF173EF755AD470BAAB5EBB333A2A485900C10B0606D3845EDCD67F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201188, "uuid": "53a354f2-240f-4895-9304-3e3b3a14244d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201188, "uuid": "3adebd6b-49ad-4097-8f09-112b8874514a", "value": "24576:nTK0BHE/0STkBofcv1vwRy7xUBFgxdmn/DpJiVKPBHE/0STkBofcv1vwRy7xUBFo:nXB6K1vwYfyB6K1vwYf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678201188, "uuid": "5c36d398-44e3-4c4b-9710-e69f07a06579", "value": 5189632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678201188, "uuid": "9acfcde1-c02c-4a36-8c31-e3b9c81ef5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201188, "uuid": "0e4175d7-f70e-474b-8283-923af7560166", "value": "0028200282 - INV_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706d14ff-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678196349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196349, "uuid": "fd677cb5-1f90-45ed-9dc7-0f8309fb4a17", "comment": "Malware payload (AgentTesla)", "value": "b2e94cd9904051b166e444eb89f7718b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196349, "uuid": "db6ecd07-27e2-4ec3-946f-67399c0d9d25", "comment": "Malware payload (AgentTesla)", "value": "3c2e7cf7056b1e0d33d192a3734a7a2d2b21f9eaa4be69aff1b7983064270d02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196349, "uuid": "361229ed-a787-497a-ad48-f4f0f1f5625b", "comment": "Malware payload (AgentTesla)", "value": "2ec08b304cc4755c234800963ab3b28b8dd1eca5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196349, "uuid": "618a7350-b083-457d-8470-c48e1f278f12", "comment": "Malware payload (AgentTesla)", "value": "f650e226f51a65e511b2c5555ffc999a9afcd20034c3ac1f9c93218c59c63f57a537735b815b5d8a693c11a028a3a94e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196349, "uuid": "94f9f41b-7f71-429d-b9b8-24cce32cd0da", "value": "T1FBF32A2D92CA8E51D73D4074C4B5103807B29186953BF76E4EB1BCFB3E867C3762A866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196349, "uuid": "141291c9-8966-4e4c-aab1-6011945da2ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196349, "uuid": "dadd098b-c7b1-4e42-8b11-5bce941d7217", "value": "3072:5dkOi7SuHTui2BMGS3h5Q5grDYf0zuId8n2GihZJt:ULTxzRQ5gnY8zuq8n2HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196349, "uuid": "459f93d0-9ac2-475b-9566-c130dc6c43c4", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196349, "uuid": "417bbdc2-86bb-4d0a-b593-32a581b31361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196349, "uuid": "1eb320b0-cfe6-4abf-bc02-8c1b50be6177", "value": "3c2e7cf7056b1e0d33d192a3734a7a2d2b21f9eaa4be69aff1b7983064270d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac6e2a4-bcf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678201037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201037, "uuid": "56c17bd7-6361-46b1-ac57-8def6956881d", "comment": "Malware payload (Rhadamanthys)", "value": "0492a562ceee12e6db78b77aa191e267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201037, "uuid": "1da75408-8c37-424a-87fa-b5b8515dc96a", "comment": "Malware payload (Rhadamanthys)", "value": "3c41412eb5d424cbf29a62862bc2ccc0ba89c32c27e36f5c74a8d16a82fe2331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201037, "uuid": "c5e50b6c-5b57-4088-baa8-480dfcae530c", "comment": "Malware payload (Rhadamanthys)", "value": "f3e83274b2ac15a501d00c9ec2ff85b2f4f135a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201037, "uuid": "28fe04ab-7bad-431f-9171-7a3526457928", "comment": "Malware payload (Rhadamanthys)", "value": "c04da75bbb8eb87162645e59bdbc2ed775db457a1f861be9f470195bb3d4ac9ae046df1df6a191e5966a62b27475fe22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201037, "uuid": "8175e97a-f8ad-479d-ae34-11fc7844e85a", "value": "T14085E10C6D504120EBEC72BBC561D2A073396D76AB5940C372C66E9726266C8FCBDF39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201037, "uuid": "855b0ac5-42c0-4017-a579-5dbcb844646b", "value": "151f536da17206958ed89113fe3ba656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201037, "uuid": "d77b543f-8e8f-4919-92aa-67787a61e3eb", "value": "49152:Qh4FhhuZD6yJ+aJLSHvg1+Bn3ceAhFkXXVS8DO2F4PNKscRDSsj5xjo0fc8VZK0R:RKze3ns8Cna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678201037, "uuid": "01ade64f-e385-458c-b8d0-3d1ece21980e", "value": 1736840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678201037, "uuid": "dd42e538-3137-467d-ae33-9f694d9a99fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201037, "uuid": "70253048-c1a4-4a61-8d1f-78f1adbcb2f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df2c413-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678155543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155543, "uuid": "61d8f62b-1053-4f29-9897-2fbd8dfa8371", "comment": "Malware payload (SnakeKeylogger)", "value": "c43f0bb7aa9a3a9b77aa0d817902eb63", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155543, "uuid": "2f457f56-b760-4537-ba73-389c060b91fa", "comment": "Malware payload (SnakeKeylogger)", "value": "3cdc18aaf4dc860e8679f0c0bc118f7c2e4dd159cefcc31d72209b8eb88caf81", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155543, "uuid": "8da58b7a-16fb-4d55-845c-48670864d9f2", "comment": "Malware payload (SnakeKeylogger)", "value": "f500a13e266572a987ae0e568862a0983477f6f9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155543, "uuid": "b44c928e-c08e-4cf7-8aaf-8f9ad26c0cfc", "comment": "Malware payload (SnakeKeylogger)", "value": "f088f339238fbd86aad073881b188910214646d69fc7387c8be8b928716ba4a37514151a4a6336929351e820a4769a31", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155543, "uuid": "ebb14cbb-47cb-4e37-97e2-5c205a72d5fc", "value": "T19C72C5060BDDA4F2C395F0374269840A54BEF1BE375326F9398D91AA37BE20D19B91B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155543, "uuid": "cdd9e43c-52a3-44ee-9c53-7374fdfee80c", "value": "384:K7CzyJjqCjRMSHiqPJG1YpSb9UQq24STIzQZ4BZnyasMPnz:IJjBjHHiq8eS1qoT90ZyJMPnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155543, "uuid": "5164bc47-c38a-4941-86c0-024c12e79f79", "value": 16082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155543, "uuid": "20ac92e1-18c9-4772-ad48-7142ce8025f8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155543, "uuid": "f89dffa0-84d6-466d-a8d9-abc7dd1731f9", "value": "c43f0bb7aa9a3a9b77aa0d817902eb63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a29d588-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198862, "uuid": "126b2cc8-9f4e-4cdf-89f9-e69ca19a3a7a", "comment": "Malware payload", "value": "8d53d38773c5e3677a108ca3b08f12ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198862, "uuid": "a077afdd-d7ed-4f4a-8560-afadaf143b20", "comment": "Malware payload", "value": "3d2050f1429c8653fbc225433c96aa27c13f1ec215b429dff8999957f5b5b58d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198862, "uuid": "1782cfad-cc0b-48ec-a64d-05c75942a45f", "comment": "Malware payload", "value": "5a83f095a2bbfafb8497040bcac816a0883878ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198862, "uuid": "80a15403-6bbc-4fe9-bb25-24e42a0f8e8c", "comment": "Malware payload", "value": "ae8085990373fbc3c335a4630fce331819129cc5a9cf819d9a24ca38fd5f166fcb7976f7912a84e24890121e9eedec33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198862, "uuid": "6171b82f-0654-47d8-ab12-6b308fe8eea0", "value": "T1EA56334355E1095AFA55583AE1373EB7B2F753A3AD42A93889DF58C429220FCFF03894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198862, "uuid": "66a7c014-5f43-4248-80f7-3456a4e4567b", "value": "196608:qUXrHjuYhyImGImXGoYNUBtdGjQ0Bv1CsU:NvuYLmmGF+BsPxHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198862, "uuid": "83c36e56-9818-49f7-91b2-f0b021a0286d", "value": 6322318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198862, "uuid": "6338bdcb-59a7-492d-b488-ef8474c62818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198862, "uuid": "a961815e-abd1-4345-82a4-5be4160f1d26", "value": "8d53d38773c5e3677a108ca3b08f12ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04871676-bcef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678197027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197027, "uuid": "e3160f44-bd23-426c-961a-b9526a053f37", "comment": "Malware payload (Heodo)", "value": "d43f5ef654b7987ce45a3342fe575793", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197027, "uuid": "33e92e0c-704b-4f0c-af6d-f5cc505b1ac1", "comment": "Malware payload (Heodo)", "value": "3db074a5e31d27fa8ace07fa9bbba963443687c55acd8a3aa649c0be5863565d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197027, "uuid": "3051696d-0c52-43c5-9d7c-dd32284a5b4c", "comment": "Malware payload (Heodo)", "value": "480d7a5b350ea702b85043057f9f2024d7939903", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197027, "uuid": "657fd275-40f8-4d6c-8740-84a9b42dc65d", "comment": "Malware payload (Heodo)", "value": "c3174c71f47d5c14319c755826584315cc9e607ea0b201d48b1df8ad21a93f76c5ea4c633151aa15bde6e4f21f8cc056", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197027, "uuid": "9649c0de-7009-444b-bdc6-26335fe5f631", "value": "T1571523F8FEB5E4A7F489E03148468B47C28CF9C6C6D9D9C612B8467D9143FEB0B09946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197027, "uuid": "fa459495-4df0-4b1c-aa1d-6d920c5858c4", "value": "6144:3s929TDSYLJY3lhXf0cJzkHFliEo6BMTJgw+b2S4oMUCIkaAWr92GoKO33EN:3VHSYLJY3l5zzkH3L6gjt4R5+tr9vYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197027, "uuid": "938c4e1e-8591-43e0-aebf-1bc41fccc7d6", "value": 896352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197027, "uuid": "9eff122b-e4de-4980-b124-cc8c57014c41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197027, "uuid": "e381a57c-4a97-42e2-9051-77af82007210", "value": "kVexLkm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bcf594-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1678198638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198638, "uuid": "444fc4e0-b75c-4780-9bf1-c66829f31c37", "comment": "Malware payload (Vidar)", "value": "c56b758f00562948de9cac375422074c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198638, "uuid": "f3707de8-37ee-43cc-a89a-7a92fded5636", "comment": "Malware payload (Vidar)", "value": "3df572ecd8ad88b1b744adc3323998b64d8303ef1a19eba3d7fd6e76aeb67532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198638, "uuid": "27263ddb-6ac3-44eb-86ec-7b124fd7bf54", "comment": "Malware payload (Vidar)", "value": "9f98c4c403b98aea3624d905b2e1ccbe5939c908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198638, "uuid": "86411391-54a7-47a9-a423-5668186c0d6f", "comment": "Malware payload (Vidar)", "value": "8f6586675cdcf7c5da32f7a07f4b11afed71b3e450630f6ae6e6d4244ded06b88d03ec67a524a5bf2aa31dc7075e5219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198638, "uuid": "5984a1f3-d17d-476e-a5cf-348a9b0a5386", "value": "T19884F22536A1D036E2DB64705078EBA52EBFF8F22261C98F7754139E0E706C19A7731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198638, "uuid": "eb19cce5-6949-48a5-a2d5-31374930d999", "value": "7ce8be817094ce334ca321b79c30ac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198638, "uuid": "0179e6cc-0cf7-41e7-b722-e60993f219a3", "value": "6144:qdIjLWKjRaNPXd5G3KpR0JjKXV+3rQqkuWZgdVlVZ/X36qfAk:gQ6KjRYPX/G3KoJCMZFpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198638, "uuid": "b8fa27d3-21a5-40d0-a6de-ebf187311659", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198638, "uuid": "3f91d708-97d8-4e90-897a-22084ab165e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198638, "uuid": "1ab42279-f23e-4cb7-9836-9f7cbd1600e9", "value": "c56b758f00562948de9cac375422074c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af016610-bd22-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678219218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219218, "uuid": "fbbd08a7-204a-40a6-bd83-ce7a56e3a69d", "comment": "Malware payload (CryptBot)", "value": "d59773dbf0fe527ef8da4289b07f87a4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219218, "uuid": "98ffa495-3c22-4575-a92f-298cf623a6ec", "comment": "Malware payload (CryptBot)", "value": "3e29f918baf660aef18adcb2e4962d529fefe3c107ecc011c4b06990b459aa94", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219218, "uuid": "989aad16-4b96-4c90-bb0f-826b1b84d554", "comment": "Malware payload (CryptBot)", "value": "2ff85eb8ae1056f2fb9838674d7d57f638e4df27", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219218, "uuid": "3cf32a9f-372e-4e5e-ab41-858ef5894465", "comment": "Malware payload (CryptBot)", "value": "5f41889a807a1f4c61cabebe42cff6a0dec6c81abc3a39ca7ff35c9f000f79dbcd04ff8edbaf5831ff4c10db7bd94e60", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219218, "uuid": "227fb4b2-7575-4881-9c33-40e81fa92989", "value": "T161050233A1C6823AC1522571486D6A34267CBD730467059FB7FA7E2CFF6C8E3B662251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219218, "uuid": "12c0ebac-f433-40a9-99c1-6b49c6d5d666", "value": "12288:RflYgRuMtnvjk5053grTSwlCIVQlhTFbbhL0XoEdFw/+GpQwm+sCLyuq7H:tDLtbkK5NIVQldLq5IFQwzFLyvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678219218, "uuid": "51ab3e02-a0fd-433b-a128-e7e998a6e640", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678219218, "uuid": "f427313b-1ab2-4777-b78c-865a3f063e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219218, "uuid": "66d43a21-d13f-4d96-ba18-0b6d5d10c991", "value": "d59773dbf0fe527ef8da4289b07f87a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38db9cd2-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678175640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175640, "uuid": "75be9f57-35eb-4be2-9162-e99f03844299", "comment": "Malware payload (Formbook)", "value": "8215fb520e6fd4cdd51e1c63c8d0fd38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175640, "uuid": "42f5ae25-6b98-4a15-82e6-431a4a3e1b47", "comment": "Malware payload (Formbook)", "value": "3f0c02a6aba9a637ccbc0e9f3ba35e50ef50d89827d804c163a77fa4e027b583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175640, "uuid": "0d32f414-c9e8-4fb0-a70e-507ff88727e2", "comment": "Malware payload (Formbook)", "value": "24e1a669e01e63071d425539b2aac4207a4a7f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175640, "uuid": "fcd95619-3e73-4531-ae23-9f96da0dfe3b", "comment": "Malware payload (Formbook)", "value": "9cffe0610d7e332fc5db42f6d1476243ad7e6ccdfaca67eb64eb6ab325a9f2426eb699f1fb21ba103e55302476ff1e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175640, "uuid": "fd7e1492-a2b8-46ac-8ab5-0bbdb0a52bf5", "value": "T16505AFE42F5D7267FB86A1F3180526A7DB9CB95D2527C0081EE2108FC1CDE3C5652EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175640, "uuid": "6ece88a1-2a13-4906-b538-97e7bbd88c14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175640, "uuid": "9d200a35-2a24-4c9f-812d-ba4a27ed7bdc", "value": "12288:EXKjX+rzknTP8pO4G0OIecssiQz34O0t3MxzfWAAIO6:OKL+roEpThzzIO0t34rWAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175640, "uuid": "7e321866-a9d3-4450-adad-5af1c6995476", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175640, "uuid": "190eccf6-e75c-498e-8cc3-7008557dbc20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175640, "uuid": "f5811781-842a-4eed-b684-6e022e8e24e5", "value": "04797_AL.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1e4139-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678199453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199453, "uuid": "c01d9daf-fc45-4b81-9102-b88221fb2227", "comment": "Malware payload (SnakeKeylogger)", "value": "d218c65b01376996973170a38e0ec238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199453, "uuid": "f0fdf60e-9f3f-4afa-8a96-664714529092", "comment": "Malware payload (SnakeKeylogger)", "value": "3f92bf4694bf1f903d68a590a096f40b8d0f4df9a2545019c9f9cee086117b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199453, "uuid": "eb56acdc-a3e6-4098-a8d8-d0c0ef7a21d6", "comment": "Malware payload (SnakeKeylogger)", "value": "5a3ab809d8195f69045c1d0743ab258c4d363a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199453, "uuid": "23cfbc2b-9ef5-4c44-82c0-3533981d104c", "comment": "Malware payload (SnakeKeylogger)", "value": "c408c015cf345d80f56539ea47ba0789ef3f814d2f614d797e26af4889bf5a248f6d89640ed4dc2347da97a6fe739ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199453, "uuid": "c7c76c3d-ef1d-48a7-9118-d364a0ff190b", "value": "T187259DA56F19A253E7C5A1B31804E7B6EBACBD4D2427C0883ED13D8FB1B9D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199453, "uuid": "ee95451a-c707-42d7-b039-20862fa51253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199453, "uuid": "877312e3-6049-4f5f-b207-0aae1991e09e", "value": "24576:opYNUfqBps+1/SM50ibMvt31OB96ZiB4a:bNH4tM5RwvqB9Yiqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199453, "uuid": "c4ebea85-4b90-4ede-a29e-46c4731edf5d", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199453, "uuid": "54b634a4-5639-4edf-a9cc-ae0cc2176bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199453, "uuid": "3e815cc5-e867-488f-9ede-e03139705cb4", "value": "d218c65b01376996973170a38e0ec238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec6a357-bc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161128, "uuid": "11844e9c-1b66-45ee-b497-fb118fe59a47", "comment": "Malware payload (Mirai)", "value": "503830095feed060fefb4335db544ed9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161128, "uuid": "d81bf218-e3cd-4bc8-9143-8c6b584fde5c", "comment": "Malware payload (Mirai)", "value": "3fe09bb3d86aa61ba28c3f8d4e176366d919e1c16ff108ff513978ff83d2f020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161128, "uuid": "b7ced37e-ca54-475d-bc5e-2e35e8e1d02e", "comment": "Malware payload (Mirai)", "value": "99038a0f08468d22d3dc160c98ad08654ee46448", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161128, "uuid": "6d3e29f1-2ac6-4b13-978a-2c3ce83920ce", "comment": "Malware payload (Mirai)", "value": "1b0adf067205e914717e3e1fd6784106697ac7cd702a7472654dc8e5b7437c74a7f5202bd27a3be3acc3fbad279415e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161128, "uuid": "6176cd3a-c57a-4140-95cf-da9f82c5d04d", "value": "T13EA2E019BF2C818BC832293555E9E5D61396FC71F29DDC093540C16BF0A33A52870F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161128, "uuid": "61c5d04d-4aad-407d-9fb5-e06f6b3bc267", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTU:x98o08kxofBE+ZkXaITbp2F2TWul0c5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161128, "uuid": "9f4e1ac7-e90c-40bf-be61-0aa43555cb3b", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161128, "uuid": "d3f57d74-6bb6-4f53-aca8-f5ebe5c5a246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161128, "uuid": "66f8a942-42ef-4e8f-8045-75d5a75db8ad", "value": "503830095feed060fefb4335db544ed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d918e6-bcb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678172258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172258, "uuid": "273391e4-ba77-40a1-93b1-bf718109994c", "comment": "Malware payload (Formbook)", "value": "2e1c1f0e769bcab49ae0a8d68bedd1c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172258, "uuid": "f9cf48e1-6358-4d02-81d1-8f80d3a275cf", "comment": "Malware payload (Formbook)", "value": "3fe3d1dde71fcd12d4f23149c19255df9571bf3b5db5e221d9be7e8657e1aa35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172258, "uuid": "c9e7f15b-b765-4fbb-872c-9a93b31f5121", "comment": "Malware payload (Formbook)", "value": "9b91d64954af959d2587987248fd68326feca117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172258, "uuid": "3ea1bac5-8899-432a-a9dc-89df90b73251", "comment": "Malware payload (Formbook)", "value": "87c953f225f0d54b33b6333c9ee37f6643fa30fb2d16054e1c0719da3a50c634a44baaca896cd06bd48ba9715a9cc7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172258, "uuid": "ee4b1000-83da-451d-84dd-6d27fd286ea9", "value": "T169D42384597DCCA9E1E74970AF7A916EA73BA507383A4A0F3F14170C3F16A51E60D3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172258, "uuid": "dbd67594-6807-4df0-88b6-46b43f36dc6f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172258, "uuid": "01398d38-5774-45df-a4e5-f1ec6bbb7590", "value": "12288:/YjCECjCgQZfiLWQhb4IwSYjZZOMA+ZNnZJ1Ih9ORbPYqiOSF/zeYv4yZQdEf:/YjConZpQN/psmaZbIh6gqiOSlzek9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678172258, "uuid": "b038690f-862f-4f85-a2ab-778cc9c0a1ed", "value": 641517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678172258, "uuid": "43cf64b1-17ae-4f68-ae3c-709619629d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172258, "uuid": "47fef293-6178-4a7f-a9ca-1123fb6c5b8c", "value": "M.V. TRITEX GLORY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327b1b30-bcc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678176918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176918, "uuid": "f654d6d7-538a-4c36-96d4-2fe3ac61e605", "comment": "Malware payload (njrat)", "value": "ded6e4c6034c299d59a7a8b45f96f6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176918, "uuid": "03351469-6407-4e7d-af13-01bbdc3e62e5", "comment": "Malware payload (njrat)", "value": "400839e985f3b243d21dc246c4ca9b79f83f2ac529cf3bd9cb08d543ebd5dfc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176918, "uuid": "28cf7735-2c91-4a1a-81a4-6dcae7254306", "comment": "Malware payload (njrat)", "value": "16c4467712dcdbd30303f613a06181c7ab7109a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176918, "uuid": "2ebfdd8e-7f23-482e-8a3a-ec45b9bb10f8", "comment": "Malware payload (njrat)", "value": "bfbb8863a4cb9a50cc9be77d1c22f08ec59a37bd8fa41aa3f013630ab7c02412a15cb253e6165c049fc1cb9eb0c28606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176918, "uuid": "0bc86018-ea78-4dfb-8e0c-11d0b547310d", "value": "T1BD946C2B40074760E7391370CE5971A385E875097C97EAFBFED92A9205B91F9E02EB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176918, "uuid": "7718a821-c8cc-46fa-a270-f5402405ac01", "value": "d32519c93924bb24d9874d86c5993ee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176918, "uuid": "de186bb0-02c9-4ab2-8f2e-5b4487c46096", "value": "12288:9UomEFRu3xEPED85p3Yas2n6u2ibhbvVRC+:bmOMSPED85poLc6u2iHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176918, "uuid": "60492ca0-b303-4069-baf2-dde30c6fc5a3", "value": 446787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176918, "uuid": "7705eb8d-4b60-4f73-be41-6f26b22f9f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176918, "uuid": "1ced0a64-88fe-409c-b58a-bf02e32277b5", "value": "ded6e4c6034c299d59a7a8b45f96f6dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d22c81-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231676, "uuid": "a810f1b1-c8f3-40c7-8660-920f49893048", "comment": "Malware payload", "value": "518c01615d840e76662b9723673f91f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231676, "uuid": "2e67fb0b-55a3-4749-978e-f1a8c0d8e784", "comment": "Malware payload", "value": "40764003c3478b67dd418b90193b34c0518c84ca79000e0f6fb5693ebe0b583c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231676, "uuid": "e41ebed2-6823-4819-be63-875874d89575", "comment": "Malware payload", "value": "f72310a7c6e7f84627a4bb7ade5be621ff01f2a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231676, "uuid": "4a408113-4fd5-4f93-aa58-521781f7b6ee", "comment": "Malware payload", "value": "ecbf431795aa9a45ff005b2866e440858d8d1ae48358596b5b971107c69a8b54543c354221fc9f760fc49b23ecf128de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231676, "uuid": "fc7c1d41-5212-4d03-9943-454508133ba2", "value": "T14D657D26F2818937D0222F7CCD1B93D9592DBE203E28585B7BF41E4C9F7969139682C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231676, "uuid": "6e9d4249-9ec9-437a-992f-d9a6508f3ab8", "value": "f434ab7e6494f1444566c2f7ab538588", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231676, "uuid": "2bfc5ed4-228d-451c-9d93-a9b2e37c6487", "value": "24576:NOZy5bcDOypZgk8WQGD3yqM50+kD6yz15vL2GzYD9CD52Gy1BWBjkJ4uKVMeg:op9b/p69CD5kWBjkJ4DV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231676, "uuid": "dc3e28de-5c0e-4533-8f04-0643e2a4bd06", "value": 1472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231676, "uuid": "2e930988-52fc-4df8-bc17-cb795efee3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231676, "uuid": "782dd868-5402-4316-ad4d-3ae0490d48ca", "value": "SecuriteInfo.com.Trojan-Spy.AgentTesla.14657.18018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5bdebb-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678191917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191917, "uuid": "f1d05888-64c6-447c-963d-a7960d6c7622", "comment": "Malware payload", "value": "edcf9ed5c636461117a03ee6110e0f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191917, "uuid": "a5bcfe95-29e2-47ea-a36b-04e615ac6bc1", "comment": "Malware payload", "value": "42483396acec8a922d5d179af0460812f58d11af847d7d11490205e2b954a48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191917, "uuid": "83adbc26-92f0-4b0d-a4be-b5a32d5e4d3e", "comment": "Malware payload", "value": "5de406f06505c47a8b076628b0f264e66634a9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191917, "uuid": "1fea4f12-bee2-4c2c-b402-1554539d3881", "comment": "Malware payload", "value": "09245404e4f93f987f319e040a12bb6b9a72ced86cc1c75bc3059e1fd1e20c348ea649efdad9261719dc109dd5c29a3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191917, "uuid": "d0f3bc3d-7a9d-4c31-8494-a7b21b7f7fd2", "value": "T1D5D59D32EB049132F5D211F1891D1B6F884CA53403B940D7E2D67AD969E0FE36B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191917, "uuid": "072aa936-32d5-4d4a-8cbd-0e290f85a292", "value": "18b314a5b04b566b00aebdc385da7a13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191917, "uuid": "ab64a738-deef-40b4-80d0-ecc886c56f81", "value": "49152:A+YivS/hSk458oyPRBrC276RlU5xsGpwUVN8e80ecebxGh+iif1SG:3Yia/wfgBFGRlU5xsGpwUL89cebxNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191917, "uuid": "6b3c1a62-90d4-4523-9ea2-1a10285c272a", "value": 2821632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191917, "uuid": "a5209cf2-c545-40c2-a20a-031a91958587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191917, "uuid": "3bc835ea-276b-446f-a207-8e1fb2e91b23", "value": "edcf9ed5c636461117a03ee6110e0f7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26297055-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192789, "uuid": "b1fd5a06-1fb1-4193-954a-8644d2629d77", "comment": "Malware payload (AgentTesla)", "value": "7e501a2bd73a98cd3053ba67e930da0a", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192789, "uuid": "08afdb26-8167-413a-bfbc-9b7f17533ccf", "comment": "Malware payload (AgentTesla)", "value": "4285d087c93a107ca5af05beb3af9252295328f1ac7bf29e4bf6dcec07993319", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192789, "uuid": "73736636-c1fd-406d-8116-7e3032213ed2", "comment": "Malware payload (AgentTesla)", "value": "feded07bf56ef25175c8830bdd5f1e2992996331", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192789, "uuid": "d7637441-be09-4008-9a23-5b9430fe7840", "comment": "Malware payload (AgentTesla)", "value": "2a5e5d2377c5644624d200efd398b8dd1af619cb07e17f927a14bf6ba36a8e6c72232b4f90d45d091a7ee4b181206905", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192789, "uuid": "6ed804ee-5865-442d-a10a-8ccaaa49aa76", "value": "T1E9A30D4272A45B26E5BEDBFC5B61A9011BF5AC1A6861F3494EC27CC73473F014AC1E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192789, "uuid": "ab0edd9f-6b30-48b3-8e6b-19c63cb9fda6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192789, "uuid": "fe8ea2f3-353d-4855-a256-a448424d36cc", "value": "768:vwobSLX09s8fX7aBO63bhjoMgVO1rwWlECefwg7gi7:vEZp3RoMgVO5vE5wKgi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192789, "uuid": "c074ff72-5b83-443e-ac0f-d819c22d14aa", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192789, "uuid": "3fac403f-1bac-40fb-9255-0ab9ca7a1545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192789, "uuid": "cefc4beb-4fe8-4797-894f-a6e50d516aec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e07916-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198635, "uuid": "e41d66e0-3683-4bfe-a79c-f5e0985aaae3", "comment": "Malware payload", "value": "af69e7a2b862eecb0a09326bbe8dc9c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198635, "uuid": "d01b01f7-b168-4f6b-9223-4623da9f4ff6", "comment": "Malware payload", "value": "42ec6157a607c2e6762ec56cd3e98d7d9eb8290943b47c491b31c9317dd7d280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198635, "uuid": "b6e807de-ecf3-49b8-b4ca-b58f84272486", "comment": "Malware payload", "value": "3b3bb81c81b9db7d46f8cd6c6d8df36bb451a0ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198635, "uuid": "c35e05d4-7a2c-4862-bd50-323b12089d63", "comment": "Malware payload", "value": "89ba07757310dc8902cf1de457bccd8ee87c3e50526bcdd2a2290baf2eaf47c34a31fdda051c178743a513900372d5a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198635, "uuid": "44873aeb-1a1c-4216-99a5-8f2b25b0f867", "value": "T144F45A11B4889866C7130E31FE9CF67DB2AC526403A944FF53EA9D007D67983B629D2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198635, "uuid": "c7eed2ff-3366-468b-ac26-cb1333bce734", "value": "12288:W6KygEtqB1ZEAZHDl5AmQYRSwFXNF/QN6KWn19uWQgmlXViXMWI9OqJEhkc/QA:WqgEtqB1yCHD3AIsiNFIN6KYvuWQjiXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198635, "uuid": "84f34538-4291-4db6-a7bc-754173b326dc", "value": 739058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198635, "uuid": "8af39392-ee85-4da2-b20e-47840eef555b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198635, "uuid": "2df1a4ce-e468-4927-aa31-37a4b9ceed6b", "value": "af69e7a2b862eecb0a09326bbe8dc9c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9b5bd4-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198791, "uuid": "ade17573-3275-48d1-b369-12832151db3f", "comment": "Malware payload", "value": "c128526d0c9e50e60bbc5fa7c262ada8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198791, "uuid": "e4650e42-b552-46c1-8513-32a08795c9ef", "comment": "Malware payload", "value": "42f4ac1fa34f363e7fe712afadfd85597393519a4ae86d4a1c23eb566aee85fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198791, "uuid": "1deff8da-23be-4f26-a85f-2b751bd380f2", "comment": "Malware payload", "value": "050095192e22b1f6baf5272fa2fcd3eddc438700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198791, "uuid": "ede92285-03f4-4cd6-8b96-c52c1fb8fc21", "comment": "Malware payload", "value": "96950e1d0f0bf51acccb54fed1edbd3834912e2f89f46849dfe7c591e66221157341c62a8010d1df140359dbf055ceec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198791, "uuid": "34c20760-1e98-428d-91bf-f0239536fc51", "value": "T152D4011677108403D86273F214A95A911D97BE5019B8B20B73717F5C3BB2293FE2EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198791, "uuid": "edd371e3-631a-4c5c-ae78-8b254559bc7d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198791, "uuid": "8cff93a0-2848-402c-aafe-dfafbf745930", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqgr:2YtZCkDkQQAO8h6mZvrg6NEOqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198791, "uuid": "876f7ab7-7540-4154-93a1-a8dab91fa21b", "value": 612672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198791, "uuid": "b37af208-ab77-4a55-a811-0ce9a9210f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198791, "uuid": "6fe144b0-8fa3-450d-b512-d80df825c11f", "value": "c128526d0c9e50e60bbc5fa7c262ada8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814a01aa-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678209692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209692, "uuid": "d08e228a-cfd0-4e89-af09-334596b9144c", "comment": "Malware payload (Gafgyt)", "value": "56520a8ce0d383c341d2ed1fbbd0c9b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209692, "uuid": "6a8b1e6d-2398-48b6-a305-b734489d6a35", "comment": "Malware payload (Gafgyt)", "value": "430b364616ea6534a53a4bdc2e38d74edec19311de5d21ae951c2683d5ecc969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209692, "uuid": "debb2250-d1ca-444d-a484-966236df737b", "comment": "Malware payload (Gafgyt)", "value": "2699a4549d218586468b1022dd3a2ba34d0f43e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209692, "uuid": "983ef6e0-c8dd-4a51-b963-40e21de0842e", "comment": "Malware payload (Gafgyt)", "value": "2d44b87b97a27d0aa71bdc8a62e35368cb45213d1b2b6e6783f3faea3d1c1920856eac1f0c184cad5cf3b88a5a489ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209692, "uuid": "56b41ce9-2124-4a77-a246-04b6369912b6", "value": "T1F7C30905F901875BC3E227BAE78E438C77355E6457DB33156A38BDB42BE1B982D29230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209692, "uuid": "88759776-7559-4a1a-8079-21ca190fefe3", "value": "3072:TGGhNnu3jGOEHgsRqm53bhISOMmyVUQuiXfQd6W:/ruxEAcqm53pmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209692, "uuid": "2447080d-b03b-489e-a2c1-de1e8fd302dd", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209692, "uuid": "e0d93f8b-658f-4d87-aa43-e672cc250c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209692, "uuid": "6059420a-b7ce-4ed6-ba18-9e014d4ca0ef", "value": "56520a8ce0d383c341d2ed1fbbd0c9b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fdb416-bc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149832, "uuid": "05d56074-792b-446d-9105-64235087d036", "comment": "Malware payload (Mirai)", "value": "54b58043faffb04488e815af8a7d7ac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149832, "uuid": "b2f6535c-305d-4a63-a49b-ce207efcc274", "comment": "Malware payload (Mirai)", "value": "4368ccb0e7ba54b74769cc3aa94ee310c0f84c6e5a3ef1bf55a5c608b346268a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149832, "uuid": "2b90e937-7486-4953-b4f6-d6c0cf3ce524", "comment": "Malware payload (Mirai)", "value": "bb48cc95ac9d5cd01523644bd2044dfebf0acd0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149832, "uuid": "9d525d8b-41d3-4c84-9c1e-68871c11b598", "comment": "Malware payload (Mirai)", "value": "4e56d05f399fcadb4b13e74a18dc978d717b21b90f99c561f0bcd617955831fb80d344522304025f0007a0aa6454541a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149832, "uuid": "b59eddd7-8175-446b-b823-cbeb2712a6ed", "value": "T101231899F8025D3CFD1FA57D545A8F09BA6063C212C30B2667BBFDA36C721A85E02D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149832, "uuid": "24e7b4ca-0849-40ef-affd-948e40aa4a6d", "value": "768:87wPjmWH9QhBKKUzhBhGHGC8d5caKH60vz9zGu:NCUVBgHGC8dFKH6czUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149832, "uuid": "5443a8d7-b7b9-48a0-aff5-079b63ae7101", "value": 45740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149832, "uuid": "21c87a6f-6599-4519-82e4-55b983976511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149832, "uuid": "281dc538-55cf-4bfa-bb0f-91bc0c43ab34", "value": "54b58043faffb04488e815af8a7d7ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b509dbf-bcf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1678200904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200904, "uuid": "ced52b4c-9db6-46f7-ac61-dd1faef41a76", "comment": "Malware payload (XWorm)", "value": "3ba7491194d92ccc0d9d438fbc7b678c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200904, "uuid": "8b354703-ec54-4052-912c-a237f771d348", "comment": "Malware payload (XWorm)", "value": "43905bff6b7bdac9698c9109764e7ac3ffddddf59b9d278c648dfd8e6b1403ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200904, "uuid": "35cc6610-b479-469f-8389-3d619d3d708f", "comment": "Malware payload (XWorm)", "value": "c0c9b5818636d027e9b5ad8b351dc22c54591d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200904, "uuid": "c309ed95-c94c-4208-875c-cc2ed115a1b0", "comment": "Malware payload (XWorm)", "value": "af9342c4ed0c4ab8a028f54315d0ccffb425fef3de4733c30dce066e0d742416f146d3f24e88b5e63964b70fae0264db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200904, "uuid": "c75417ff-6629-4f68-8870-9e317f6f81d9", "value": "T1A31308D667D84102C7FEA6F22DB7930202B19EA3491BEBDD48C5419B2B97BE147009E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200904, "uuid": "bd926337-f185-4f64-9b79-64aa43863c2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200904, "uuid": "29a59416-1ffa-4d34-b9ca-84579b87cfda", "value": "768:d1UWnDPQsxXRvoHtwsXwUT4KNrKmF0h/0nLXsQhLOAj/DQ:d1UWDPQy3YqKu6P1Oq/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678200904, "uuid": "67c0c915-7e12-451c-8a3d-25e268bd8795", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678200904, "uuid": "d83e9b90-8f43-47c8-ae12-c35af011b059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200904, "uuid": "4d23ec06-06e3-4975-97fc-67e915d1d4dd", "value": "U3Ty5dXW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00e8c5a-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176323, "uuid": "23d9cde1-7e9a-41dc-9c53-7d749703da78", "comment": "Malware payload (Mirai)", "value": "8101bb8dd4355a353e910d6670949e26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176323, "uuid": "069c071c-f8cc-4ef7-b264-e4efeab529b7", "comment": "Malware payload (Mirai)", "value": "43f8be12a2367a5675046dd4afc50eca49c39223d1214b88fe1dbfb2b7c139fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176323, "uuid": "5b16a232-bae2-436a-a9ef-b91862f67c11", "comment": "Malware payload (Mirai)", "value": "8bbac60918b52bd32dfee3c8d19ddfa53eb02e57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176323, "uuid": "21446444-563d-4423-9e6f-bf0542d7f05c", "comment": "Malware payload (Mirai)", "value": "b3534ff50502630b21639f64220d46df27d2786b893f027c81b3ed7814638107a80fda739885f27fe328d24f28246324", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176323, "uuid": "23e75002-d392-4caa-814e-4908faaa3b81", "value": "T14113E684B982DA0ACAD4533BFA0E82DD372973DCE2DE3303DD255F51378A92B096B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176323, "uuid": "e24752d4-2ba9-4f26-9ee1-b179218c4d46", "value": "768:S34NkVxM7r65mNaoIqoCTolwSduuJmuNjrJqjZe2ilRCBCuXQz:U4Nk0tNcm4wn4muNjE8UBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176323, "uuid": "c0ab88b0-a056-450d-802b-9af712b72099", "value": 42884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176323, "uuid": "58779f63-258d-4467-90ac-3a0035cb6fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176323, "uuid": "23fc8714-6a9b-49f6-bd1b-a4dc21b58423", "value": "8101bb8dd4355a353e910d6670949e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2138234e-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175601, "uuid": "8ad07765-43bf-4c85-85c2-687f1dacfd00", "comment": "Malware payload (Mirai)", "value": "6a945e2a446692c852cd8fadd1e3d554", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175601, "uuid": "ae5b7008-05e8-4f24-9070-6d99b7760d00", "comment": "Malware payload (Mirai)", "value": "4522b997347c057acfb172c35928c7220f78059043984c552529d9ad7f4c639d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175601, "uuid": "566d6088-7037-4819-94f4-b6949bc8eeb9", "comment": "Malware payload (Mirai)", "value": "d0dd54b756da266e53edd33c3b519b579839750b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175601, "uuid": "bb44b10e-c0f5-412d-95da-e860d3ad6710", "comment": "Malware payload (Mirai)", "value": "74f336f5e4187c5efd1ed4b519e3504f712dc628b7a0ec04abd203c460947202f75b95574a7ea17b587e459532fb43b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175601, "uuid": "c4284030-bf58-44e9-8c24-503e189a1a4b", "value": "T1AB130B282942B6BCF657003DF41322AAA0732F2C36DCE7E2F4536639EF6078455B5D69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175601, "uuid": "564872f5-467f-4801-9046-8eff7916cfb2", "value": "768:yXXFgMbpOSh1p9QJYv5iLQZdqAqOnhDk1QtnR:yXXFf17rvxHtnhDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175601, "uuid": "82e05eb7-90df-42d9-b664-503f280c0352", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175601, "uuid": "d04d5dcf-d21a-41a7-81a8-46f632da7eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175601, "uuid": "c648dc81-be9b-4462-8a56-0c5dc09b9d98", "value": "6a945e2a446692c852cd8fadd1e3d554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7cbdf3-bca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163946, "uuid": "59920d42-2b14-4c2a-ab8a-895edbb537da", "comment": "Malware payload (GandCrab)", "value": "0ee40204297272c813acafc32eb6e60d", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163946, "uuid": "4e852829-f9bc-4fd7-b17c-ba66d5449c9b", "comment": "Malware payload (GandCrab)", "value": "4542af64bc7982a8d5c42a10e8f0be6f1af4db5f2cab2c2b7f7dc572c0b2cdfc", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163946, "uuid": "cebbe5e9-ded5-4d01-83d5-2654b8a9aebb", "comment": "Malware payload (GandCrab)", "value": "fa864e28ee37145aefed2ba2054ed96d92e001e8", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163946, "uuid": "9e1da317-16bc-4b02-bc04-b7c8cec7dda5", "comment": "Malware payload (GandCrab)", "value": "77e24eed4dcffec61cc94f8c58cf11495a2968d266ad076076b3d3ac7eae277239b27639f80f0463de2047df993d63d0", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163946, "uuid": "7dbdc7f4-3406-47e2-a5ec-b553143cdf46", "value": "T1CB636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163946, "uuid": "d9a6430d-7a41-4566-bf65-6e1f942b9127", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163946, "uuid": "4a18c0bd-e14c-4bc1-91a6-b93fa2d702e2", "value": "1536:MZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Td5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163946, "uuid": "90718e18-d394-400f-8ade-d36bfe684f2f", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163946, "uuid": "53a124bc-82aa-408a-a365-e3b1af6875f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163946, "uuid": "5e600dd2-feae-4b3f-b579-b5c0dc4807a5", "value": "2023-03-06_0ee40204297272c813acafc32eb6e60d_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed3ad3a-bcea-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678195165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195165, "uuid": "5b337cbf-c47b-4036-b414-5652db0a298d", "comment": "Malware payload (RemcosRAT)", "value": "c80e97165d0a93b86bf5e7e193b16cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195165, "uuid": "53cad273-726f-4597-a495-ca7208f2f0a1", "comment": "Malware payload (RemcosRAT)", "value": "45b2d2ff27a08b400f0e149e5371c683b09963058ff52b5c395ab79ecf6de1c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195165, "uuid": "5f77809c-a524-4f52-991d-11451c5a1cf2", "comment": "Malware payload (RemcosRAT)", "value": "5ca43a80d0148ea9084214c6a4adc38f0ee3ef9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195165, "uuid": "098eb49a-871a-4d6f-aeb9-36a47136785c", "comment": "Malware payload (RemcosRAT)", "value": "6579cddb065a474a4fe7bf22ffb633aa27721d213f097a718f8ba0feb2d5072058f205bba92bf7f2a7bdec23da0c037d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195165, "uuid": "4d5e7d59-6716-491c-a043-2b08cce10bf4", "value": "T15CA4AE01BAC2C072D57524344D2AFB35DABCBC201925597BB3EA1D5BFE70190A72A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195165, "uuid": "0500212c-3615-4870-908f-a0cd90dd8d28", "value": "b1c8f7572a6db205362528e88fd3ff32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195165, "uuid": "18067c3a-92cc-4e1a-8d91-f68c8e21d82c", "value": "12288:JjdAK8wxqkXuxOqLXO3X2orpbKs/Z6OBRq:XA3wxqkXuxOq+rpbRZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195165, "uuid": "775a62e6-f1a2-4adf-8f7e-e8172eec36b9", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195165, "uuid": "35106301-1868-468a-9f79-d7e25ef99034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195165, "uuid": "bd632e3e-82e3-4b50-b640-6d147af3ff8d", "value": "xd9SvEQRya1H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0179ee-bc8b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678154469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678154469, "uuid": "239cb650-5ddf-43c5-8468-24b2cdb923ae", "comment": "Malware payload", "value": "7ad63584f8bac97cbb2a1ff6bbf51994", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678154469, "uuid": "05eb507a-d550-48b7-89b7-3406285865fe", "comment": "Malware payload", "value": "47e75b68c264fd78ed6a83ea06dc646cc1ddf5d919f1d97eed064ab518c23dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678154469, "uuid": "8229862f-151a-46e9-880d-c74377432c55", "comment": "Malware payload", "value": "ecfaecb9a7d7c707712fb520d8b32672dee6a561", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678154469, "uuid": "fda7d8f6-d245-4f93-96c9-be84b3241d93", "comment": "Malware payload", "value": "ac668733eba0efb0f981441ffe102a1c5cfc1a755d1ca3b702978a023ef055dd1b17fa3005313c6d3faffe373facfd3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678154469, "uuid": "dbd8f4a8-7b3c-4bd6-a431-1960cc48f7da", "value": "T13FD4022667148463E4A637F7093A4BA25E6A3E112978730B57313F587733193DC0EBAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678154469, "uuid": "1d0d4f2b-4857-4aff-bd54-3fdf6d214d2e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678154469, "uuid": "7ed73716-6965-40dc-86d7-8573f12f615e", "value": "6144:2Ya6npxtxAI8vlLSuxJkhbDopBkOOPPwo7:2Y1pjWjvUukpkBknPwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678154469, "uuid": "e24d5483-8711-43ab-b364-ca33bfbc9ce6", "value": 613740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678154469, "uuid": "f35a4df5-e9f7-4b8a-ae46-dfcd811307ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678154469, "uuid": "7f39d052-4d6d-4688-a117-642edd0eadfa", "value": "7ad63584f8bac97cbb2a1ff6bbf51994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab902bf-bcc3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678178274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178274, "uuid": "b22a612e-5e70-419a-912f-d1d93255e16b", "comment": "Malware payload (Gozi)", "value": "20a59c155acac54115810bf263a49397", "object_relation": "md5", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178274, "uuid": "9e8b9c52-5a57-4d82-a9ae-e87be8893c37", "comment": "Malware payload (Gozi)", "value": "47e870e2d1a123b74c470b0e01ed75ef196c714aeed8739f77ac6e56430dba35", "object_relation": "sha256", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178274, "uuid": "844aad22-d331-45d8-a603-3a6398f7ddd9", "comment": "Malware payload (Gozi)", "value": "53656e87eadbd350c2c536034ebeac9fb29e6623", "object_relation": "sha1", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178274, "uuid": "95ca48c6-4da9-4fd2-b6a4-b601c4350e4c", "comment": "Malware payload (Gozi)", "value": "d1d4ac17a19a80c31c1303b66e810e61db1a03f831d5829e004d9bbd34875e3a88ba05453a208f3835df4584ccbca409", "object_relation": "sha3-384", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678178274, "uuid": "3b8284cc-e0c2-41e7-ac2f-dd2498a1c9fc", "value": "T1DB44DFA177D1C0B3DB9B0074D864EBB06ABB78731660865F37581BAE0E307D0AA76717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678178274, "uuid": "cdcf637a-d7a0-4210-a2ed-e39a8edf9837", "value": "7ce8be817094ce334ca321b79c30ac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678178274, "uuid": "160fde92-28f3-4072-a499-1f258ad461d1", "value": "3072:9EYdzLe3EdCmESf3lYawc2B5PZX83CBGVYIMpvQyr8oYm2G1jufo7:6cLjkkdqBFZdGVPUIG8aufk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678178274, "uuid": "38f47c38-5490-4a12-acfd-13f65624c538", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678178274, "uuid": "3f8235a0-aff7-4540-9826-100e81862aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678178274, "uuid": "4a64e032-db44-4ae7-b69e-d6e9a90e98b6", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4b2d35-bd34-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678227030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678227030, "uuid": "32dc0773-c9a9-472d-bc86-c41b9344e2dd", "comment": "Malware payload (LaplasClipper)", "value": "172c9d397cf848a13a032af9a811c469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678227030, "uuid": "ad5f2584-20f9-4690-872c-f3bb63301b2e", "comment": "Malware payload (LaplasClipper)", "value": "4894fe2f0b87652614e926f8ed796d6f7655108011a8579b7efe3f6f0f886a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678227030, "uuid": "4a8bd1e5-511a-4d62-a729-6f7f91561591", "comment": "Malware payload (LaplasClipper)", "value": "dbe653a0608043bb5e32a3940251f8943711742b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678227030, "uuid": "a2d908d6-d772-421d-869f-55d8b2644c7a", "comment": "Malware payload (LaplasClipper)", "value": "f116d9eaab18f938d29fa3e8085f1950c07df84b1d4420889e6e8fd5fa05461be04164f35a78ce1ebfd654beddd9c0bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678227030, "uuid": "0f896b1a-c19e-48ce-bc03-f1b7473c820c", "value": "T178162A43F88146E5C0AED130CA659253BA717C886B3027D33B91F7B82B77BD46A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678227030, "uuid": "03247ebb-240c-477c-9e64-073f07b32acc", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678227030, "uuid": "037766d6-e5e1-4550-9465-962e8f8f9df1", "value": "49152:4EjwvlIKv05z+UERnIcYmWjc3Cdha5E9UFiqeb0/B1:OlhWzZ6hTEciqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678227030, "uuid": "79f7f7f7-365f-489e-9fd9-d7f6624bc59e", "value": 4212224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678227030, "uuid": "3545287d-76fb-4743-99be-3379656d4c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678227030, "uuid": "1dd595f5-39e2-43d7-8b3b-e5e6a210d7d8", "value": "172c9d397cf848a13a032af9a811c469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0a178a-bce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678191326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191326, "uuid": "d546cfa5-739e-4347-bf0a-a67695153de1", "comment": "Malware payload (AgentTesla)", "value": "8ecee32d61396f90272cbf7675950ad3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191326, "uuid": "fc4f5499-e7e8-4b9f-aab4-4de26d8957fd", "comment": "Malware payload (AgentTesla)", "value": "498a462f90680268425f0be93b68cf289a0aafa02c9159e2f708a55d7c694896", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191326, "uuid": "c896671a-6aee-4e72-ada6-a3bfe2001ec1", "comment": "Malware payload (AgentTesla)", "value": "8a260fec640ca0e2ed47213218e84925223f0e70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191326, "uuid": "6d5b7ea9-a52d-4c3b-9a86-fa4cc2a1099c", "comment": "Malware payload (AgentTesla)", "value": "a018772aef99da2e015f79e43c350bbeebc59b7165d1a95fd463c246546d620d4e76b1e486e8b0f5d93d74a6af53b951", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191326, "uuid": "1fe8e00e-3ec9-4f80-9ed6-8c747ae08a5c", "value": "T121441260F2E0E15BECE04B725E3E65FB9F65C9270675925B231087EC3C23245E56E3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191326, "uuid": "e2630f68-eda8-450e-8401-168b5c990def", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191326, "uuid": "23da1173-4bce-4782-9c9d-946ebf9b9505", "value": "6144:/Ya6e5pa0bLUTsNZVXMlj5W0uwYEQsJl4WmCs3DV5a40:/YQW0vQWVW8CQsf9sT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191326, "uuid": "b2a33015-0519-4a65-9268-df87ee556cda", "value": 274646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191326, "uuid": "e4766867-68a4-4fe5-8416-a7d4f74b05d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191326, "uuid": "9cbce008-e539-4e98-8225-9ade464c9e71", "value": "URGENT REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac481ea-bca3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678164503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164503, "uuid": "56892c5c-e5ff-45f3-b02b-6c70393a4096", "comment": "Malware payload", "value": "24dc62c0b4adb821d5d0f29009b831f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164503, "uuid": "cb8a7112-a667-469d-90f9-16ba76988e5e", "comment": "Malware payload", "value": "49dd71193e7ece808251a52c9715cc599154d9b7fe34474ca96e168a2238f052", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164503, "uuid": "efc25290-46fd-4e17-8d08-f5172e9494d6", "comment": "Malware payload", "value": "eaffe14b5c35ef8ea27aec9e70d587b3e61313c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164503, "uuid": "1ba4055b-cfdd-4968-b69a-993efa975706", "comment": "Malware payload", "value": "61a8bf030b4f76b41e813b4f0c31b26dcda14b7eb7b58308ce6daf60b6346d639af50c52c9f5c836c73f08f10caee038", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164503, "uuid": "a324f0ed-f9d0-4bb5-81a6-4a2143efd87a", "value": "T199367D17B288B53ED45F1A365937C950993BBA723913CC97ABF4094C4F391816A3FA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164503, "uuid": "5cdd50f8-c84b-424d-a1f0-d57cd1b1c9e8", "value": "49152:9C0Ez+1NNXm7ov0u9FwJKSQG8BaP1bXLWvftljOeBR7AbRmCoX/ctfKHOB8xv:9CFz+1N8cvX78bWWeNX/ctCuMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678164503, "uuid": "22bd59a8-8dd6-4a43-9601-9e9f143a11dc", "value": 5000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678164503, "uuid": "0a335109-4cbc-4d42-aaea-a04338dee7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164503, "uuid": "b50cc556-36e2-4877-a9ce-3058a20acff1", "value": "WiseTurbo.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf2eb71-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678210327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210327, "uuid": "121ffa66-5761-408d-ad1c-d6a1c4b730eb", "comment": "Malware payload (RedLineStealer)", "value": "a413967d29faa8bfe4a16a4559cb31c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210327, "uuid": "81b225dd-9e4d-438a-9d0c-c04e058c8740", "comment": "Malware payload (RedLineStealer)", "value": "4b920eec3febd1c102d5be425b80053c5a56d582e0a16c24b12cb5dd42d80eb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210327, "uuid": "97f3fcff-95d0-4488-be73-db13c8e82fea", "comment": "Malware payload (RedLineStealer)", "value": "73e5da45efb8fd5d49bafce6dee1dd821cdb8988", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210327, "uuid": "f1ba9ad2-765d-4196-b6ce-7f1d8d5e637b", "comment": "Malware payload (RedLineStealer)", "value": "e13b1499a861d659ba5c070c9a8c71cda6a0ff640f72edd45826f6deeb9249111e08776f7e24d218679cffb879a02c91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210327, "uuid": "11e76321-0620-4315-a976-4607ebae9804", "value": "T18174F121BBE1D03AF6AB04709C69F6A5DA3F78325168861B7318576E1E332D0977B313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210327, "uuid": "3ebfb25b-e6fe-43b0-bdbe-e75c731de011", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210327, "uuid": "47aa52c4-20f7-4f42-a726-4f5c62d5a522", "value": "6144:FLPm5PKqhKsktou8kTRjK12KUl9fNGEXjzgU0onQCf4eZ:FLmtJGXTaqlFNfvgUJ5/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210327, "uuid": "9a472ab3-66b7-48d2-bf5a-b3fd470e45e3", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210327, "uuid": "a86654f4-ce4a-48a6-9ad9-6e9a1614c190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210327, "uuid": "4a83ca4d-9fd5-4fb6-97e7-dda11a31114d", "value": "a413967d29faa8bfe4a16a4559cb31c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ece901-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678193060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193060, "uuid": "3f2a13fa-6d3f-4fc1-b61a-796eb866a112", "comment": "Malware payload (Formbook)", "value": "6776447387587d3546350f090ff756f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193060, "uuid": "e65c74fc-52d2-43b3-8855-28b8906834cc", "comment": "Malware payload (Formbook)", "value": "4b9b4b9c7b90ff35a4842f1cd52b4ccd644a71775906560d0d280e71ced15fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193060, "uuid": "e92f33c0-1df3-4142-8568-412af327a66e", "comment": "Malware payload (Formbook)", "value": "67a41fc5c4bf832d5ebe569943c1e70104342992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193060, "uuid": "ddcdab43-d0f0-46d7-ad46-00c35a5a00d4", "comment": "Malware payload (Formbook)", "value": "3240fd11658c5d98e1991fe5e4ba86f6ba3e8e6eee050038a46952c1d09153141b8bf8cafc9fa0804be1144759f5aae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193060, "uuid": "2c912181-5420-40d0-a42b-8e473713836e", "value": "T1BCE4F101A6C18037E5B2183501F686783C3C7B3967BF9ADB17D889BD5F346D1AA30A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193060, "uuid": "0a9572d4-0aab-43df-b73a-6e3d02605f0e", "value": "f21b9f4ed04fb68076e88d1363ed51e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193060, "uuid": "7016947d-0ad8-405c-ae9b-2ac56081e658", "value": "12288:0JJqYzhltD7BybICsQmOk+DH1TbpVbC5cPhle2cEbuo9fif+:0JJZhbpPBQVVWyeEH9qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193060, "uuid": "9d494b4b-8516-4a84-a9f4-50faaf164365", "value": 662268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193060, "uuid": "bc41742a-abd6-4332-a725-580490119dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193060, "uuid": "34e9d7db-55e4-4f63-b2df-8615556d3e9a", "value": "SecuriteInfo.com.Trojan.GenericKDZ.77169.9531.19498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54ea14f-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678199498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199498, "uuid": "c652538b-63d7-4596-9856-6b5193d19fbd", "comment": "Malware payload (Formbook)", "value": "eab196e5433297aacb948116fef38de0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199498, "uuid": "211a0139-0a5f-412b-b52c-650d402ce0b5", "comment": "Malware payload (Formbook)", "value": "4be2cf5401e99bf3e1ce388004ae86aff0e170bfd369ee0d9204bd60f56327a2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199498, "uuid": "93f67d84-5ab4-4695-b755-acbc2fad174a", "comment": "Malware payload (Formbook)", "value": "44bb7c8b343f84371d61730a3c41b7698a774283", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199498, "uuid": "edef7c57-363e-40b7-9335-754341d21cac", "comment": "Malware payload (Formbook)", "value": "6168c398993878523dd3d3b6e3a53ad295d702a2dfa6d195bc675eaa53d39ea2a3ca2211ad2044ac446b29c0af9fe6c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199498, "uuid": "430d929f-4f16-4bc3-a180-7aec4285b8ee", "value": "T17DD48D91ED1C3A1C0DCA766B9C834914DEA1CD2522D200EFDEA9974D360314BE7FB6DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199498, "uuid": "b357344e-8ef2-4541-b691-361378739444", "value": "12288:d368SenYUd4coIEl51ZXbv//QblVhxHD/2iuxg4kI6EtPNxABAi95V:d4rJ3Z7/MDeeFI3ri95V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199498, "uuid": "576dae09-5043-452b-bd5c-f09e4948180b", "value": 622972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199498, "uuid": "4cc81c68-8470-4f24-bf2a-9fa842c711fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199498, "uuid": "b4b21a29-cb96-4cab-a82a-e7a6251b1895", "value": "20230306-1000_OFERTA_0000015436812_002323pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac4ac9c-bc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149820, "uuid": "10d5f4e0-5776-41f6-9969-74a6f57071f5", "comment": "Malware payload (Mirai)", "value": "da137796234d08bbc9c1542cc303bf7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149820, "uuid": "09ae1b44-9fbf-4f7f-98c1-2f68fa6c73e1", "comment": "Malware payload (Mirai)", "value": "4befdfdc362fc52cbd83f490a6c7b287cae980ad75532002dd1ca9aa3a280a25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149820, "uuid": "b0ad8885-b8da-4720-b710-ad03ea4eb2a2", "comment": "Malware payload (Mirai)", "value": "084eedf9352c43360a9cbaccfd46f03f2236efc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149820, "uuid": "b449ac7c-5ec8-4a3f-ae4e-3fa9504e3de9", "comment": "Malware payload (Mirai)", "value": "531d3a01852a235240b61a99b3d83932a38ac0ab61e0d348d0e27e4a90c8efc381a8799bb78f8c9d846fb901037235a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149820, "uuid": "2b6a60f9-ee4f-4e26-929f-de9c89d08f80", "value": "T17BC2F18A93269C62E3B01D75DF204E02EF9D6FB962F374251152467C92525E18BFE242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149820, "uuid": "2e927cfc-1c72-418f-a023-075485fe7471", "value": "768:qT/7sf6xdMncyqdprxFmVTy5e9q3UEL+a:qTIfuMcxXrLcyNLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149820, "uuid": "9363fef6-52b8-4fc9-870b-7b5d54881d8e", "value": 25904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149820, "uuid": "c7b18714-c4d5-49e6-bf13-1338736d3aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149820, "uuid": "46e4386d-669b-441b-afb3-f511b19dcaf0", "value": "da137796234d08bbc9c1542cc303bf7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3e64ba-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192963, "uuid": "f5da606c-df24-4f73-87e2-e982423646aa", "comment": "Malware payload (AgentTesla)", "value": "cdbe85dae821d8a5c779ac86c5c1d103", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192963, "uuid": "fdf2482e-7336-4f8f-ae6f-befe23cae689", "comment": "Malware payload (AgentTesla)", "value": "4c453be90162ae954bb93320418adf4180c6bd43cbc22b90a04c8b20862e88de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192963, "uuid": "3ff6595a-09e6-49e3-86b0-c138b9eac2f9", "comment": "Malware payload (AgentTesla)", "value": "f916f32a58968d82ee1aa0e20504ef9db33ba07a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192963, "uuid": "8e776573-b015-4e04-9280-f0e890a09466", "comment": "Malware payload (AgentTesla)", "value": "f785f9dcef225d502fe50b082e8b2447b9fdfc90a065098562c9da83e9ec081f082ee74dce80c94ad1aa09e153f26cba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192963, "uuid": "0fdfc28d-4834-403d-8b0c-70b461dc38cd", "value": "T1C2F309689E858B52CF3D45B4D4A011081EB2A1475717E67D1EA0DCFA3E76FC3322E86E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192963, "uuid": "ed06bc4e-c336-4931-a4b7-f995ec5cf709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192963, "uuid": "a0411372-7e37-4bae-b262-88e9ad3abb9f", "value": "3072:msR3rAaaYtpAcy/1SxJvnu2/psP2Kt7Ti8DM1HNMwf5iSu74cBgaChz:z2Ytpny9uJvu2/+P2KpinNMo+4n3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192963, "uuid": "4d89bbc7-fbea-4a10-94c1-fb81eb299e21", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192963, "uuid": "93cbc388-4b88-4fde-9c4b-1f841d56868f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192963, "uuid": "9523a086-e3de-43bd-9803-e68e2090d224", "value": "4c453be90162ae954bb93320418adf4180c6bd43cbc22b90a04c8b20862e88de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ba1ef5-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678209723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209723, "uuid": "6b8e87cd-ca5e-49ea-bbd2-9fe586edd0ec", "comment": "Malware payload (Gafgyt)", "value": "39b5206421b4b5d271b1da568c6c3cbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209723, "uuid": "c9dfd77d-d74e-4b35-acd9-0013512202b6", "comment": "Malware payload (Gafgyt)", "value": "4c621cf443f577661f13edfa166a56f18b413eb42f5f8121a0780016557d0545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209723, "uuid": "16d7d8f8-f80d-484c-8d8b-da6f6347ac7d", "comment": "Malware payload (Gafgyt)", "value": "732ca638617264992a276661f12ef1800af80854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209723, "uuid": "0829b762-58f7-443a-94e0-9f7b00e57bce", "comment": "Malware payload (Gafgyt)", "value": "1e8875b465ec5104f3491246fdc8e2022ff4ab24229620595d72e6ccb98433d09b24577418df393b555ca95a327d77ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209723, "uuid": "e3cbf436-9911-44a1-9258-dc0aba6681c8", "value": "T1FAC3193B6B270E23C0C9507116E31332B9B9DE5938B943D7AAD07D9C6F3A58834167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209723, "uuid": "725c19e1-20e7-4de3-98ce-2daff4718b50", "value": "1536:ivJm7TYtgc6RhSsN95fftvLItIgRdF/Mfm7ypwYujl3IdnuW:pNhSsNPqRlMfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209723, "uuid": "5c6ab75a-a1c0-4575-9f65-a1625d819a4a", "value": 126438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209723, "uuid": "5ba6a1fc-e569-41ab-9688-23203f5367a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209723, "uuid": "f5c152bc-8789-4ffe-aaf5-6dc60c393e36", "value": "39b5206421b4b5d271b1da568c6c3cbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e657cb-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678198779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198779, "uuid": "1ce4d93e-181f-4ad6-af7e-2e314d08e4dc", "comment": "Malware payload (RedLineStealer)", "value": "5b38bcf59496004df1932cef54f7077e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198779, "uuid": "5760a267-97e9-424d-8078-0775062c36e0", "comment": "Malware payload (RedLineStealer)", "value": "4cec6318bedc7655dfc3a6eabca18bf6651c13dd84957a813c9dde047e411902", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198779, "uuid": "6295a4e7-ccaa-40c9-89fe-8b430d8cddd5", "comment": "Malware payload (RedLineStealer)", "value": "8750d2470621110817efc4ef11b361c850380d48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198779, "uuid": "a3ecf73d-9c46-4374-a90d-79196e4a92e0", "comment": "Malware payload (RedLineStealer)", "value": "c81a8a1dab7f805d8bf6cc6ebb0ab35dec00942d7b198d5e12925c7b1797d9c00c79b0213cfc2a940fbc21e45f251707", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198779, "uuid": "08dcba71-70d1-49d5-851e-e7fa6ad5b7de", "value": "T11574F121B3E1C1F6E2F7023C6574DAAC2E7F78761624845B27A907AD1E342D396A3317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198779, "uuid": "de826e28-9365-4429-bd26-77e5b7045d78", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198779, "uuid": "2555614f-c52a-4335-a749-e2b01219cd08", "value": "6144:3LOQb3lM2hBTM1AMbDBuCzZKgtR5mBqDR17Q4eZ:3KQba23Mew/ogTABARkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198779, "uuid": "02d4f340-6993-48f8-8591-637980bf4cbf", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198779, "uuid": "b6133f9f-77c1-449f-b697-b159aa4b0cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198779, "uuid": "5d6af3d0-7637-40e4-9a3b-93bb84a9b35c", "value": "5b38bcf59496004df1932cef54f7077e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0770eb-bca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163947, "uuid": "cff85d07-4e5b-446e-9010-09fc12076cc4", "comment": "Malware payload (GandCrab)", "value": "a46142e7460a778d786bf28e475710bd", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163947, "uuid": "3b761b87-bfb9-4e86-b190-96060ab24941", "comment": "Malware payload (GandCrab)", "value": "4d4ab81f531f607a90b60514f22a4290c15385a983237a04bd44b1f0de4053ac", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163947, "uuid": "c7b2d4bf-8449-4378-8ed8-f5b0c26e7131", "comment": "Malware payload (GandCrab)", "value": "5060b3656bcb1d427a35e175cfc9db18493de50f", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163947, "uuid": "f1710fc8-4721-4d8f-9827-fe9df2ac3a96", "comment": "Malware payload (GandCrab)", "value": "575276a7286435bd768e2741cac7b0035385a36de130a50269479f0c89befcb014e15f746a799f4af85319f1cb2df4f7", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163947, "uuid": "f43574a0-a235-44b9-8220-3feb1bc72b16", "value": "T112636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163947, "uuid": "84ab3420-4027-452a-9385-2e68810d9224", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163947, "uuid": "e07871af-1197-4a68-aedc-2ce8faa682f2", "value": "1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163947, "uuid": "a185ae76-e58c-4dcf-aa21-f94aa2e7ba03", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163947, "uuid": "0f90c29a-d830-4ef4-ac7a-b4bf029291b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163947, "uuid": "072e3863-990d-45c4-8da2-6e1f7ba55e28", "value": "2023-03-06_a46142e7460a778d786bf28e475710bd_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1cbf36-bd20-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678218325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678218325, "uuid": "dba90dc8-6cf3-494f-a2aa-4ecc71186f18", "comment": "Malware payload (Loki)", "value": "623f47e0d12ef91f34a49f0f09bf7930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678218325, "uuid": "ea1c32e9-456b-4ced-a04c-41124e4b4a53", "comment": "Malware payload (Loki)", "value": "4dc9f5e24cafd056269fe79fdc3a34fb06c5944fc6a217af2b90ed67ae1fa410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678218325, "uuid": "d064ecab-a997-4109-82fd-a2a66dc341b0", "comment": "Malware payload (Loki)", "value": "2c1a09ece0a1d17928cb420faf373295c4ec56bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678218325, "uuid": "8540d01f-2ffc-485a-963c-164ea15190eb", "comment": "Malware payload (Loki)", "value": "7bd2db12d7d9d08406f5b9d210b9aa84929de725ec60f8772f903f350e3ef7b111f09b2babc970e447366d3e3d66e4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678218325, "uuid": "ab23ab8d-3b63-4f4b-8ea7-4e7cd15ccdb7", "value": "T1D764CF327690C0B2E45B4934C414CBA4EB7AB43197B5C98B33581BBF5E332D19B6E35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678218325, "uuid": "1dfb676f-5e17-45e3-96bc-e61ec9518d3c", "value": "3dcdb6b03575fe1a857d23b1ee4d81a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678218325, "uuid": "1e99e4b4-f719-4b60-8865-c1b819e4daec", "value": "3072:WoXrTkWaLU8p5l/pTEveZuB1x1B48CYX47u34gN6XT96qa6wHw:bXrJaLv5N2e61x1BH4c4fD9P/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678218325, "uuid": "5e38d9ba-f928-44d6-8bb7-16fd6fdbd452", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678218325, "uuid": "78959619-5ec7-4250-b0d8-1d0cef4e31ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678218325, "uuid": "9df53634-d1e9-4075-a2a2-9d602faaa50c", "value": "623f47e0d12ef91f34a49f0f09bf7930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2527c3-bcb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678173790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173790, "uuid": "fda0a415-fc14-483b-a29c-cd66d515f2b0", "comment": "Malware payload (AgentTesla)", "value": "1d3f9f9ccc968453e6cdc3594e3e66a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173790, "uuid": "a3743539-4e88-4edf-90d6-bc59b3a0f56c", "comment": "Malware payload (AgentTesla)", "value": "4fc9ad5496662eb995b8912b235779a4504a4b98a774b6c7d44a71d2f6259803", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173790, "uuid": "6dabd0a3-a7b7-436a-af19-6b9b939496db", "comment": "Malware payload (AgentTesla)", "value": "5d2b75092691d833b50e1446ebfcc07172018c57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173790, "uuid": "238a827b-6719-4da1-8458-6603f21735c5", "comment": "Malware payload (AgentTesla)", "value": "7333536519d761f6c149bfa1aa7420a35ab5e7b51db6a20de7f9766d3b6adb9e21881fa50deefb2de9e6a94aa3eedea5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173790, "uuid": "a3a49854-e601-4463-92d7-26b54c21c02b", "value": "T13215AF9132B0D4B3F5CB017560287ACC2D7CB147B6D9F24B6A777AC09601ABBF698E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173790, "uuid": "c140073c-f35b-4a47-b09f-705d6849193e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173790, "uuid": "c3b58245-4d91-4cb3-817a-6b9c768dbef4", "value": "24576:41Qwe3cOQwt+c4ibhDyvam8NFY4YEPL0Z:4B6iibhD0lQe4fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678173790, "uuid": "d53465b4-c646-4c81-99bc-8938af177ed6", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678173790, "uuid": "a32fcdb7-dbe7-4210-a158-6a701c5680ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173790, "uuid": "7671fc5b-ba50-42ac-a300-54a18cebf540", "value": "remittance $111,480.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324c3c50-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175629, "uuid": "857938c8-8bc2-48d7-87d6-71cf83561372", "comment": "Malware payload (Mirai)", "value": "b682585c0fa2007d4b3f9470976ee301", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175629, "uuid": "94786ca1-978f-443a-9745-636b061d6a1a", "comment": "Malware payload (Mirai)", "value": "50ad8890d9aa5634f771a28c77b9ebff48c88120e659ca9d595456fcfc1fdad9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175629, "uuid": "8115fb4b-1d2a-4782-843f-a116ea498789", "comment": "Malware payload (Mirai)", "value": "7daa492915137a636351ea0375a27cdd0067c80f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175629, "uuid": "a3b41994-8473-4291-a106-2ba4577dacf3", "comment": "Malware payload (Mirai)", "value": "cf3e7ef7a4636fc512d4523ee3fef2bd5d5ad34fccc852c47d0816013b26f9d601b9805240a82f9c72c1b81d512a8cf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175629, "uuid": "424ebf9e-4f7c-427d-97e8-c7bab1ee167e", "value": "T17C73FA86BC818D11C5C9137ABA2E21CD33126369F2DEB253CE116F147BC692F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175629, "uuid": "5ab34ee8-6acb-4745-ae9f-6431dca4472b", "value": "1536:vNnOjvLZACTPzkF+pLL4XciEfC/6+QOBuDD/zuIjiLZHpmcs:EjvFd7YF234MiEfEvHZHpmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175629, "uuid": "394deb0c-bd52-4eac-852c-054ce5ecc99b", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175629, "uuid": "0c6c77a2-8808-48f1-b84c-1c2d474d8046", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175629, "uuid": "181771db-be53-4f87-b586-fe9d6631a91e", "value": "b682585c0fa2007d4b3f9470976ee301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79c8da5-bc87-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678152660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152660, "uuid": "099a1976-e813-4c51-bc3f-885f5a50615e", "comment": "Malware payload", "value": "ff8f0ed872fe827badb582be4f21e80f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152660, "uuid": "85025ace-1e07-4262-a5fa-de9af75e53f6", "comment": "Malware payload", "value": "50d11744999c974f75515aed3cf4e86e33f3eb2c26063358f4fe9f02fb0b9150", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152660, "uuid": "1237573b-28db-4d99-8fd5-0022644b1942", "comment": "Malware payload", "value": "45211bc6dc5e0dd6cab5df9970b69d1e5b191f30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152660, "uuid": "d0b7a2c2-268a-4931-938f-e717819641cd", "comment": "Malware payload", "value": "180626e5ba72f03936ec36b2986ad7d41795b21ea5d8d3091b9e997639f35edd40645fd1922cf252432ee7582b40f6b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152660, "uuid": "a1aaa9ab-9f5e-4482-a55f-6e28a41cb759", "value": "T156D4011677108403D86273F214A95A911D97BE5019B8B20B73717F5C3BB2293FE2EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152660, "uuid": "e6fbc675-25f4-4c73-a5df-1f4983a30929", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152660, "uuid": "2a32c868-4a0f-4cdc-a8e0-4f2b4b1c286b", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqgi:2YtZCkDkQQAO8h6mZvrg6NEOqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678152660, "uuid": "fafc45d0-870d-4f72-8083-ca7c85b3b6f7", "value": 612608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678152660, "uuid": "b7a0ec5f-a4c7-456a-a4ef-fbed708a7a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152660, "uuid": "36d92bfd-d907-4f3a-8d48-ea1fcdadb4ce", "value": "ff8f0ed872fe827badb582be4f21e80f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7252e611-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678192487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192487, "uuid": "eefce994-d31d-45a4-bb35-0b1ac200c5d3", "comment": "Malware payload (Heodo)", "value": "d7e47631ad707afed1eb1f1db03a89f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192487, "uuid": "b7c4c327-f24d-452b-a443-db037015ea84", "comment": "Malware payload (Heodo)", "value": "51f1fdf15170d27b6c36e52407bc57e614400179e93fb406eb8e8d6a1d3ecfa7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192487, "uuid": "ae43a3d3-670b-4924-84f1-184baec01d80", "comment": "Malware payload (Heodo)", "value": "67aa77cf0576662a8224a251c720b18ea6f63ebf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192487, "uuid": "31245b92-acb3-46fd-805a-4922154ba8de", "comment": "Malware payload (Heodo)", "value": "322a26b47bf54f1953bd9c03c573c206c0a51155669d42a4b4c044ded1268dcf9500acb0a41b2193edbc4c27c3d40c2f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192487, "uuid": "4b8766ac-ad0b-430d-850a-e5f4b18c494a", "value": "T19AE412B1F4AF3319ED21F57811EADC470381B47F03C005D55EA8897EB2BE12A765A8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192487, "uuid": "b24a3787-bd63-43ea-ae28-c08cb364d13e", "value": "3072:C1lsI//z4a/hGS0NclN3U8XKp5ZuoWkQQhl0GEzal3Cj:C12c/z4a5GLNIp1WMkd3tCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192487, "uuid": "b01f60f9-12ab-4b62-9ff9-1a168fa1ba69", "value": 661383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192487, "uuid": "f9042f7f-41a4-4160-b2cf-42b485628e4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192487, "uuid": "e8c29382-bb57-491d-8b0a-8fd5929fb425", "value": "INVOICE N L96505 03_23.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e998e627-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678196553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196553, "uuid": "625298b0-aee2-4698-8a9b-e311b747d240", "comment": "Malware payload", "value": "09261d127f3407d4922de8acdbea7bf1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196553, "uuid": "f3044609-7133-4526-a108-c3ebcf93a531", "comment": "Malware payload", "value": "52b1327689928bcc98cf7b93f56f0313347ff30bafb0c8948a857c71c7295ce8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196553, "uuid": "ed783d70-af8e-437e-ad8c-3992342e4dac", "comment": "Malware payload", "value": "113bd5d3e7117f5202707c3157b4b18815f85ca0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196553, "uuid": "2b30eaea-e094-46e4-b193-37615eaee3b1", "comment": "Malware payload", "value": "75e34e2d9b2547ba67defe8492567466fbfa986b6dc51a91a413a21cd5d259f99004077988d51281b46102a846d1db9c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196553, "uuid": "aba429d8-85d8-4112-8bd6-6cda4c44c2f8", "value": "T1DA55F1039238AD4BD106C3BCBA2F7559120E7C3671D1E98A364DB70B1732FA65ABF109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196553, "uuid": "6fe907a9-a539-4abe-a925-df01393de1cf", "value": "24576:TLKbBUtHlxoWQmmav30xQSBBdptHlxAWQmmav30xz6FC7HlYBEzQBZcLfS5R:TLKb879QmmQ30SS3l7VQmmQ30t6g7Fd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196553, "uuid": "9c54c574-a51e-42d2-b1b7-3c7bce377b4d", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196553, "uuid": "2386418d-4cad-4dac-b999-b89bf7b59c12", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196553, "uuid": "5ff42d63-33ee-4079-93cc-59779afc8038", "value": "Swift Takip_92be67ab-e027-4955-b6fc-64bd720b2ba9.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f127ec29-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198713, "uuid": "db3404d1-a0d9-4b94-ace0-cfda39b5f368", "comment": "Malware payload", "value": "d780533ff0e19e743d81ba7675989dde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198713, "uuid": "f3f9f55a-9b17-4b19-a66d-b6365ea236bb", "comment": "Malware payload", "value": "547ab2e26b0967289b9cca09500e4d5e9091647a4821ebf54ff14a143d7b83fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198713, "uuid": "c1162543-7210-4800-bc48-946f1b56b28d", "comment": "Malware payload", "value": "8227f37bc96e4181171b0ec97ed229a18a6298f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198713, "uuid": "9e250eaf-56ef-4eca-98b2-366560eee9e9", "comment": "Malware payload", "value": "e0ed3cc210faf68c3deb54c6c53bba62bd67c77b4d7ec0435936c00794a70496e6af659858601346267dca1f807e1c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198713, "uuid": "0ff92820-2034-4c84-9387-887307b2166b", "value": "T1DC752AF090BB45CAC40F8D801EBCFDE5167672F3D8E509B5436DB6085E2BEE47A4624A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198713, "uuid": "8febf9dd-7b2b-47a8-a1c2-e5b43a18e711", "value": "12288:+g+LKtHUB7lceAvSDlpXHXYSi61Li3KVLwJLodSIdW1PT5O9wcPB5c4yf+JMsHF2:R6Ni3KVLwyc9oSMHvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198713, "uuid": "50935994-6639-4a2c-8c08-ab99dcf6c3ac", "value": 1636140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198713, "uuid": "e08bf603-a802-4b41-9bd0-fc76567ee147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198713, "uuid": "236c30e5-9f79-485f-9ae8-65c525fc31a3", "value": "d780533ff0e19e743d81ba7675989dde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166ca3f4-bd2f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678224545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678224545, "uuid": "7e00fcfd-2b6c-4685-8a09-367d032c42d6", "comment": "Malware payload", "value": "8b3ffcae0ff6eace561dd374813ff489", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678224545, "uuid": "0b506909-7f7a-4283-b4df-9f2c7007e5b8", "comment": "Malware payload", "value": "54e7f557a38a4e034e32b36f1311fe0288fa2ad2e1b2434af23a5e0ec4f86e7f", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678224545, "uuid": "78f71a17-6e3f-465c-9c34-1d4eb9a66149", "comment": "Malware payload", "value": "d023074d20d8e291e96e9db750a15c41f497e05c", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678224545, "uuid": "be0a101f-ea95-4779-bacd-0f281a5fb1d1", "comment": "Malware payload", "value": "5fe95dbf53d5320dff9455d073738c363946c8edc4e6b2d1a428d830035f08bc215d84e64ff575d497e1b973388ffea3", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678224545, "uuid": "2375e5ac-e1b2-4e67-9f3a-6baad5e26941", "value": "T18DE63316F179227117019B2F1262F0867128388A48DE7A36F7E48A47C56F6FC87BBD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678224545, "uuid": "18787976-641f-4dcf-809f-37fc40e4d57b", "value": "393216:X/8KfHxviZbK2cifnJ6ihRd6qFcSVtx/q40/LRjSMD:XzR92ciBDgwqoMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678224545, "uuid": "b46631cc-21b6-47d7-8038-cf56ea207aa2", "value": 14162206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678224545, "uuid": "5e29b637-3455-4700-8e43-5faea84a7795", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678224545, "uuid": "6a00ce3f-801a-4fc1-8d3c-23930d78a2c4", "value": "Pure Land Metaverse Alpha.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0c9be1-bc87-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678152696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152696, "uuid": "9061c0e1-c461-4b9e-ae38-a4b23f8ac839", "comment": "Malware payload (SnakeKeylogger)", "value": "82f5467cabc16c8d60c5562457a98aa6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152696, "uuid": "5b1c89cd-ef06-4a20-8902-df0bc63338e9", "comment": "Malware payload (SnakeKeylogger)", "value": "5530ff47d492c4b6ed90750e9eb25b3342450b572a78868492a40e60a982920c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152696, "uuid": "f18c7151-561f-48c1-8ed8-1b2007dc17f7", "comment": "Malware payload (SnakeKeylogger)", "value": "fc649e0d8563baa0f3fdca84a7baeb382909d022", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152696, "uuid": "9b907c49-618c-4901-acf1-9449ad4b8b91", "comment": "Malware payload (SnakeKeylogger)", "value": "aadb1023bf2b997bb3cdc988db33ee72a3d3d29d1d3c4b4403c2ae79e14aec979ead4b24441a5141532f0206579f1d81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152696, "uuid": "da1fd2b4-fe39-4186-93e6-371867e8a9e4", "value": "T19883D62CEEE8FD16E8B91B7AE83144EC97F5E55BD823E34E04812896092D3D85C116F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152696, "uuid": "9f2437eb-3d9b-4023-bbee-bec1eabe84b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152696, "uuid": "cd60a842-baab-455e-837a-36729323058d", "value": "1536:C4o2hEJ9TeD95Ogc3Na35hkXri9FdyiHCejnHbS1rrMBGoyD5v4N5Fj/90ERv:no2WJU7ObNM39jnHW1XMBGn2NrL9LRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678152696, "uuid": "11f23d0a-214d-4efb-aa47-763ff0b0d164", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678152696, "uuid": "f3d6deea-9bb2-4d4a-974c-8f06be3ddad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152696, "uuid": "fd35e8fe-d6ed-4ab6-8b66-c676f902687e", "value": "82f5467cabc16c8d60c5562457a98aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b71c82-bcba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678174566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174566, "uuid": "b3744950-e03d-4b19-8e36-11325a517cfc", "comment": "Malware payload", "value": "3cf468ef45c3df9ce4241eb38e723711", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174566, "uuid": "1800afde-d88e-414f-8c8b-c2b789f5a87a", "comment": "Malware payload", "value": "559ead7f1eaa98c717c6d285c30b23bd7ce6e40b532010fc60ccaf926a0564cc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174566, "uuid": "7c1b1c6b-3e7b-4689-98ef-abff395754a1", "comment": "Malware payload", "value": "a1cc593473a4356a31dc600f179bd6882425a911", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174566, "uuid": "cfe9f0ec-802e-4d47-a846-5b5e049c4a1f", "comment": "Malware payload", "value": "7ccf6196f6d218dbfedea87fa26482fec2a34778705f65d0452ae813fa088169d90c71871eceb7f0a209357b15e349d1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174566, "uuid": "d1eb4409-716d-448d-95cd-f9cc742a284d", "value": "T16D8423D0011B5E0FE91C6C396E8F8E30EC59F9DF495629453B4E52A748C59EE09C63E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174566, "uuid": "369a25c9-dbce-4728-a3fd-5de3e329d682", "value": "12288:pa6MaEt5k9A1pfj5DPKO8MQoyOAW7Mz18th1W:w11k9AbjBPzJhy67Mz6dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174566, "uuid": "50360c1f-70cc-4f2c-9d55-0c745a9639bf", "value": 401371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174566, "uuid": "769eeff0-a1b3-4410-9e53-aa5c1b9ceb52", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174566, "uuid": "9adb6431-6145-4e0c-8a55-ccb582cb405a", "value": "Buchung fur Flitterwochen.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44f46a5-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1678209751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209751, "uuid": "bf8d150e-840b-4971-9198-6295fa46b782", "comment": "Malware payload (Vidar)", "value": "e2965f4a75314662d3d07408ba5202e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209751, "uuid": "47b1315a-e178-49a4-8e16-6a8acbcb4420", "comment": "Malware payload (Vidar)", "value": "563b4ec92052a7a150d5f93413498e715ecabdbba2e828e4ba446755b6ac3852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209751, "uuid": "9a9a3380-26d6-4339-8bfc-2bc195f178b6", "comment": "Malware payload (Vidar)", "value": "4af3496b4df78deb6d952b0982bfe5a080a55f17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209751, "uuid": "cfef81a8-9be4-441d-9aa0-b7b00ecc4daa", "comment": "Malware payload (Vidar)", "value": "06d3b8ec8346a39c68672a51ee3a00d5150776ef0fa723f980de3e5f5bf3ae3d5103a2fa63d41100c1ef5eb38cfcbbd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209751, "uuid": "5734b08c-9869-43dc-bcb9-2ee6b124d04a", "value": "T15DF5331C43D2C42AE94F33780E43C93BF46869697D656D4C35137AFAC439B46AA0E3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209751, "uuid": "4150dda9-1094-4c9a-84aa-e43eb28a390d", "value": "0cffb4e1ae2718727fd935ee5c72f195", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209751, "uuid": "28a51688-e482-4a84-871b-105d7b038361", "value": "98304:vZgX8moLlTX2skgdcYAfnGJES54mm4dAK61vP:RI8moLlTXGSA+Jf81vP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209751, "uuid": "7da90184-25d6-43e2-b702-ad2d15d68d5f", "value": 3379712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209751, "uuid": "38b63f71-8dd4-429d-88ed-1b74da2014ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209751, "uuid": "fbf1e932-897b-4ec4-a1e4-573cc9135833", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea85dd7-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231672, "uuid": "9db95869-6e37-4f7b-9a1f-262971470cc6", "comment": "Malware payload", "value": "895a2e959f0242ec2dfa0878d026ab4c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231672, "uuid": "f73ac19a-b9a7-4df9-b1de-6727a3943c38", "comment": "Malware payload", "value": "56adcfaaa46ab38cc415c049da359cd94e605299275ebdd458a95abba0edbc2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231672, "uuid": "76fc5b5c-3a6f-4100-88a8-35fd30aae6e9", "comment": "Malware payload", "value": "d98d5cf5bc802a4fef271d917bbfa7d90721677a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231672, "uuid": "106b6d01-dff5-423f-bba7-a7f4421a0798", "comment": "Malware payload", "value": "ca97c327963f08f095c412a405e0b4bc08dbffe2453f01cc5a2a0e4f71f605f789144543b8bb3b43b7ce662ca3bb43c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231672, "uuid": "5d0f386b-cb8f-4bb2-a8a9-999836f66cb5", "value": "T1DF235D6358A500B3E3CA447155969B3BED3E6B502FE404C397F788A36D65FA0762B20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231672, "uuid": "55ab1006-5ab9-4f7d-80a8-2b41361ec92a", "value": "79b797185d880d3b599ef4a3d683677b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231672, "uuid": "ec855bf1-1d10-4978-81ef-7179216bd92a", "value": "384:aYX5wgE9uJ/vZ75T7UROnuPVrhTKdrrcvGcmlP9oRodFyKcGs43iu2p0onqi/ggA:aYXvT7UpP5hTKmv7odFvzRW0oqcKIEo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231672, "uuid": "6f891f74-c867-4dc9-8984-cd0452cfca52", "value": 48552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231672, "uuid": "255a4ca1-c97b-4d1d-9d0c-457976369820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231672, "uuid": "78b4e805-1e11-41f6-ac74-ed1336f7688d", "value": "SecuriteInfo.com.Win32.Ramnit-CY.13362.6197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd5ca7c-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198711, "uuid": "dbb491a0-ea10-448b-8baa-6781c4852457", "comment": "Malware payload", "value": "13e8986974962124ff9c8df2fe20b082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198711, "uuid": "a3f1d99d-6997-4aaa-8f55-c857722a269b", "comment": "Malware payload", "value": "56c9d1dfdbbfcd3a3f99771196b6d9f1e82552907bc8512f8ec4cbc5d1426599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198711, "uuid": "2fecb588-d7a9-4d40-8c31-912f94fb3735", "comment": "Malware payload", "value": "fb8ae888d5b82edfac62bb5a9cfccf073d490fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198711, "uuid": "4e20f0ba-0bf0-4f69-903f-21881b9e8485", "comment": "Malware payload", "value": "7a8477456726639a0e9be5f3cbdef1cb994274b278a597170f9c493e1536933716c50c46150026c70d3e7556d90728df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198711, "uuid": "936a20b5-7438-47f6-b785-86437aed4ec7", "value": "T189D4011673108403D86173F214AA5A611D97BE5019B8B24B73717F5C3BB2293FE2EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198711, "uuid": "8f18f3ef-1b4e-42df-857a-1c5fd3619ef6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198711, "uuid": "a4ca4a97-806b-413e-b11b-47114e1f4074", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqg3:2YtZCkDkQQAO8h6mZvrg6NEOqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198711, "uuid": "297c682a-c779-45ee-b7e8-41b0feb8dea3", "value": 613424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198711, "uuid": "b527eaf9-deb9-4f5c-8a1d-d86a69feb6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198711, "uuid": "8d164315-a84c-41eb-81a9-5be308756b75", "value": "13e8986974962124ff9c8df2fe20b082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ecc78f-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176340, "uuid": "cd874ceb-5a53-4b98-9488-238449123a60", "comment": "Malware payload (Mirai)", "value": "c574f2e9a2490ac87371b7526e9cac81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176340, "uuid": "105f8aa2-7289-4aae-b632-73d921ef853d", "comment": "Malware payload (Mirai)", "value": "58880b88bd9540da7b3e3220f0d501018c7021b75af99b52fea83dc0a35065a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176340, "uuid": "8033a81b-a2bd-4aeb-83ea-890cdd5d3a51", "comment": "Malware payload (Mirai)", "value": "28dff3c2b271140f65ace5e0c8cdd09181ff2dd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176340, "uuid": "0a77a538-1871-4b80-be52-07b5873cb213", "comment": "Malware payload (Mirai)", "value": "00f602753c06391d6005c818ff2732920ac3d150c97e55af429e586458b16544409ee297c9052db2e107b6cb4554f5e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176340, "uuid": "498bc257-5625-462c-a492-7499d8811862", "value": "T1C8530782FC81D906CAD4237ABA6E50DE332173D9E1DE72079D116F503ACAD5F0DAB192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176340, "uuid": "972d1114-ac59-4bfe-9f51-137b10ca96bf", "value": "1536:vKZoKEpvsDAMBXc3j4QsVhwEZ296FWsPJXW:vKmKEcc3Ei+pPJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176340, "uuid": "2f6edb81-3414-4b98-a28f-40fe73957624", "value": 66556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176340, "uuid": "636419e2-83b3-4092-95a6-546193abf102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176340, "uuid": "ed5c26b2-a856-487b-b48f-7c63a625fc6c", "value": "c574f2e9a2490ac87371b7526e9cac81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0401bd-bce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678190844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190844, "uuid": "f1773b42-bc4c-428f-b578-349ff3317c01", "comment": "Malware payload (AgentTesla)", "value": "234abaea771438b5dcba3506dfc75e9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190844, "uuid": "d6323f7a-1b46-4962-b3be-948369fc1c81", "comment": "Malware payload (AgentTesla)", "value": "589459202b13d455eb66686b0ad19c3dcadc8b7b915515fced84ede742868c10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190844, "uuid": "057f69d2-8e1f-4f0b-8ea3-77572cda3606", "comment": "Malware payload (AgentTesla)", "value": "46a984952144e356888f6da9a35514cc6c9c5140", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190844, "uuid": "09b46c0e-c175-49f9-a181-b63aa60c3d48", "comment": "Malware payload (AgentTesla)", "value": "be35e44e3493cfff539a82c8f9bf8bbfd4ce9c8071ff2d5ba71abaf7c6e733f5ebdfbd1316fd8b1b8044bbaf9a3b9291", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190844, "uuid": "d8a3b73b-1a25-409b-b0b6-87b151fba36e", "value": "T1C705AFE42F5D7263F786B1B318052AA7DBACB95D6917C0081EE200CFC1CDE6C5652EAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190844, "uuid": "d01b58ff-7c09-4e0b-94ce-3ccfd97a8d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190844, "uuid": "a8037df0-2952-4b64-99af-c0ce2a68d470", "value": "24576:nUXFrT6a2IrjaxR3beTuE7d1bf+e3k7PMO/:OT6cWRyuE51wES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190844, "uuid": "7b857aab-6555-4996-8022-56e84bc380f4", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190844, "uuid": "db49acc5-b556-46a6-9f48-54dd2f1dd34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190844, "uuid": "dd476450-e1d5-4178-a3a8-ffb00c95997e", "value": "rAwb8457108962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbdc054-bcca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678181423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181423, "uuid": "31b51b3b-ff66-48ee-abed-64d87f496af2", "comment": "Malware payload (Loki)", "value": "d011b434687c1aa8736f4dbc232d6f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181423, "uuid": "0b030f26-bce6-4922-8599-6936354c26bf", "comment": "Malware payload (Loki)", "value": "594a574211cffc47d78817221315092ab978403b71e1ff43922286ec9f60e188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181423, "uuid": "cc05d4c2-b3e0-4aae-bc0d-2ee3a35dacc8", "comment": "Malware payload (Loki)", "value": "4042f420e2e6e5f4389580b0be4275c9358d1ef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678181423, "uuid": "ae45f1f2-97d6-43e6-98db-d4ce0d82bf14", "comment": "Malware payload (Loki)", "value": "fb953bd93027bc4d35068ccb96b99a2396b904c81620acfb7914f9ac34dc103a16d380d3a87cbe64d697e6cbfe131617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181423, "uuid": "d91e380b-54bc-4af9-8063-8c6f019256c5", "value": "T135159DA56F196257E7C5A1F31804ABB6EBAC7D4D2427C0883EE13D8FB0B9D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181423, "uuid": "df946d1a-904d-45a6-b40f-6c32b44697c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181423, "uuid": "a4693f93-77e2-4d9d-8a1a-2486fb2824f8", "value": "12288:l1X3CBVmNUfqBe4EKCjOt5pN81edRBgg910ZyzdrK4ppYVDW0Ig6XIQ11:TcYNUfqBpcI5pvd0g96ZyBrnpUphMIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678181423, "uuid": "9dd46e70-795d-4a85-ba66-be3626bb1011", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678181423, "uuid": "8d2bcf9a-e432-4b73-8693-b89d2d72384f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678181423, "uuid": "bd4b6c5b-615e-4ae9-bbd7-97c53d8aed3a", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ee56ff-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213456, "uuid": "70d8c485-37ec-4b2d-a64f-bb4c41e21f3d", "comment": "Malware payload (Mirai)", "value": "1f1a88a2787f16ffab70064e750adf9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213456, "uuid": "0aea0f1b-86d6-4ccd-ac5f-b37a88ce92f7", "comment": "Malware payload (Mirai)", "value": "595e77bb36f1ae2988f20592bc814ee243683c55a64240dbf3241fdc4bdd4bf5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213456, "uuid": "1aadaeb5-f5bb-4bc4-9ebf-7aac51f069b1", "comment": "Malware payload (Mirai)", "value": "2da9835191e4608cf7e4823560be65fa235c3c7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213456, "uuid": "f3964d31-c377-4938-a822-3ebac26aacf1", "comment": "Malware payload (Mirai)", "value": "abaf304450b33ca4d53eeac30b3ddc172171f71897064a29e2f848a26f4726b803d05c51c7619648ba7921132c309a75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213456, "uuid": "38065ba7-00cf-4104-b9d3-1a5947e191bb", "value": "T1FBA3F84178815A2AC5E423BAF6BE558D332073F5D2DF7127CC222B12BB8551F0DA3EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213456, "uuid": "10b25dd8-367d-4a14-8f35-42db985a38ba", "value": "1536:GKfVKK/QI6QkicpXNhXk3FxDYptzgNkLPejTNxBasaHeRDzqA0mpcJf6za10+wba:GKfVKmCQkicpXjLca7AcJf6qdwbZn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213456, "uuid": "e0acee7d-1927-44d3-94f3-6299785532e5", "value": 105364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213456, "uuid": "8ae7de0e-b13f-45f7-8ac4-2e3a850b04c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213456, "uuid": "8db44b13-987c-4ddf-9dce-50e18336bb97", "value": "uYtea.arm5-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dffda00-bcbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678174951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174951, "uuid": "363f2406-a7a7-4d68-a6c8-42576cac401a", "comment": "Malware payload (AgentTesla)", "value": "816adc8e7411046db48fb63099c3dc17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174951, "uuid": "b71d4267-1b05-4260-82da-117322da6233", "comment": "Malware payload (AgentTesla)", "value": "5ba1e3c6bcbc847eedf8fcdab3132ae456598718997fa4173f110c22ec48c972", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174951, "uuid": "f29dc86a-674f-452e-9e55-1ffe758f5b73", "comment": "Malware payload (AgentTesla)", "value": "61cee8bd06cc6502313141718552ef8606614cee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174951, "uuid": "f2ea9be2-4f6f-4f35-9bbb-c5fbcedb0cf1", "comment": "Malware payload (AgentTesla)", "value": "b71496c8dda6422a7986fae3c56d33489f1f08280038725db3c32fd6b252b020e8b3befbba19b89a826d825aeebf3690", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174951, "uuid": "3593fae7-a35a-4948-a587-ee3300ecc952", "value": "T16B4423D24CBCA45EFBBAC0CE7806669F259CA0E415DDD6E039DC25CD431A7E88981D8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174951, "uuid": "668b184f-3fe7-4741-9d68-1831e3484bfe", "value": "6144:sGLLe9BWdESIAMqPgV2QqOkqKFHUSqdU+wfSjNvQH0XMzQe9aM:sG3qMdAqjzNd0S0rhQUcV9aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174951, "uuid": "4e43de35-a652-4331-b381-ae701a5d31a8", "value": 260664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174951, "uuid": "898fdb30-aeb1-4816-912e-2795286d8c9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174951, "uuid": "1f66e3dd-c223-4f40-adf7-66f3685a289c", "value": "R F Q -74Y8HEI990-S.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fea6ed0-bd01-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678204831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204831, "uuid": "eedf1ab2-939d-4c64-a0eb-95ebecb51c94", "comment": "Malware payload (RedLineStealer)", "value": "03cb70c1e24b4ea666d9aa2c935e109e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204831, "uuid": "77e41203-6517-4aed-be28-c561ede3a0f7", "comment": "Malware payload (RedLineStealer)", "value": "5bdf181c629182a48ce6810cd0987fb0c1242ded4c9e73501df59481dbe6ec3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204831, "uuid": "008cfd01-4b62-42fb-8887-538ce95f7357", "comment": "Malware payload (RedLineStealer)", "value": "76700221ed0f2ec68b07d0855ad046ab46e9bafb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204831, "uuid": "418f3854-74b7-424c-bf7c-6a54c421e5c4", "comment": "Malware payload (RedLineStealer)", "value": "a212dc587cd7c925f6562a80ce69fe280180530715a1592fde397924360cc8913879bb749c8dd1a6e4cdf0ef19e54395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204831, "uuid": "7067eecd-849a-4229-824f-87331d69b745", "value": "T104145A44327B5F13D378ABF924B0140047B97D5F6766D6F81DC2B0CBA2B9F044AA1A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204831, "uuid": "86b0bd35-6b08-4d53-8d54-43ace1554ea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204831, "uuid": "56d10f4d-5729-4aee-9cda-7f215f906822", "value": "3072:taHIi1V71HVwJpXoNER6BuAurHMQlshQuQiFrtjrXf+gt:0GJp4i6isQa2uhFrtHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678204831, "uuid": "40225cfc-d61a-4d10-9b6e-12d1d85edea2", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678204831, "uuid": "c8df77bc-02ee-45a0-8f70-ee9fb1f3ace4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204831, "uuid": "99e1145e-9eef-4842-803f-30dd60d59452", "value": "5BDF181C629182A48CE6810CD0987FB0C1242DED4C9E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778fdfdb-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678195502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195502, "uuid": "8838db6c-c329-4738-8efd-b6f5e20c5119", "comment": "Malware payload (AgentTesla)", "value": "3e328c4c8bd1dc10d30f4df6d2bddb47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195502, "uuid": "7ad56917-edd9-46c7-ab76-260f44dbb836", "comment": "Malware payload (AgentTesla)", "value": "5c2bc32996df975e28c6fceae059056842e17a21dded09bfc3546c89793d253c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195502, "uuid": "9e2d263e-dc0e-4c42-b7fe-fb75fbe87c36", "comment": "Malware payload (AgentTesla)", "value": "8924d7766c2cd46b6098f651cb9886d385338059", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195502, "uuid": "99b0240f-4739-440a-a228-60cfae53a2aa", "comment": "Malware payload (AgentTesla)", "value": "e6814210bdb6493ad3dcbe796f8675b70afcd8c073d92a77369e963e240f07a211b820cdd57aca3c971999bfed062e8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195502, "uuid": "06fde373-707a-46b7-82ef-de0c40fff8f6", "value": "T17B1533BB201CB8F1C546CC19ED8AEDE9ADFA179D43AFA9D90203D14607AC53D4BC846D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195502, "uuid": "f3fafd29-13c8-49c0-8070-7f26f8ac5305", "value": "24576:1c1RP57DTF7srf8ivWhJ7bDq5uv30lZ7l0zN:1uRR/JvivuJ/Dq5A30HJKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195502, "uuid": "11524f77-7e1a-4218-9e79-982a78581c09", "value": 880885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195502, "uuid": "aa9b552b-2c83-4675-abbe-279150108fc0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195502, "uuid": "e4922a2f-56af-4f18-86a3-68d80863d129", "value": "fattura 22109.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f67e5d-bcd4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678185599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185599, "uuid": "ed82bfb8-49a7-4243-9e37-9af831d82f9b", "comment": "Malware payload (AgentTesla)", "value": "4fa5a54c68b6be2ac6b4bc0190d4b83f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185599, "uuid": "f70cf954-4011-4c29-9cc9-b2b3dee684b1", "comment": "Malware payload (AgentTesla)", "value": "5d8d91bf6396cac55661371dfbac9ccd9cacaa0a6004383880a6baddcd5d0fd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185599, "uuid": "3c8bddd7-c857-461b-8f7d-744f754f1e4e", "comment": "Malware payload (AgentTesla)", "value": "dd805bf5810cbfcf603887a9a537b49286f36415", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185599, "uuid": "6f0cc4ee-b286-4c7e-8f55-2294a52c3832", "comment": "Malware payload (AgentTesla)", "value": "cde8c2f629a67fbbe0c5fb59277c36b4d4555c132f09f44bd62d6a7fec1471c06abf14ddcb37405356d00bc2094bcfd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185599, "uuid": "aebe271e-3614-4bf1-a4e0-c43b6fc5c687", "value": "T1D025AEA56F196257EBC1A1B31804A7B6FBACBD4D2427C0883EE13D8FB1B9D2C1111E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185599, "uuid": "cdad3ee5-9230-43b4-ad00-64eba43b5311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185599, "uuid": "b660f74a-4634-4526-a863-5cf69885805b", "value": "12288:1UX3wBVmNUfqBe4pvY3U7Pgx9E6wYcSZtmLdCvD4gke2WmIn1tYK:AuYNUfqBpvwE6wYcSZtmLdCrT18In1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678185599, "uuid": "4b5c494c-6bfa-4ab1-86ad-9a76e396afd7", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678185599, "uuid": "d3fe5299-693e-40ab-8b21-e56e0d4bea28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185599, "uuid": "f269d1a9-a581-477d-a66f-3b69b0c2a74a", "value": "kredi Karti Hesap- \u00d6zeti- 4508 0519.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a4842b-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678196249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196249, "uuid": "e980226c-e6b4-4bb7-8edc-869e8e126395", "comment": "Malware payload (GCleaner)", "value": "4f91267891bbcb4d8800ece961d93f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196249, "uuid": "3a8220eb-5eab-4075-b626-e42346691f2f", "comment": "Malware payload (GCleaner)", "value": "5e0687c0c3822213bb9710c1499e6b57d87bbe12285dbf059fbb4750294c070f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196249, "uuid": "83535ab1-a3c6-42cf-926d-b7727f410514", "comment": "Malware payload (GCleaner)", "value": "facb2ec17ee80ec70a9c2072ff895e9070d5bdc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196249, "uuid": "e8514263-e4c9-493a-926c-c4efb6df4b18", "comment": "Malware payload (GCleaner)", "value": "5a4c20b8d3a33fc678abe9e61dfab624893768b514fbad993b2861644d95c054448bbf3ef97618276f0c0d99eba1f0c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196249, "uuid": "259a94b9-7071-48ba-b521-0c769ba9462f", "value": "T15D84E03179E0C072D5AB25744875DB682BBFB822A634C5CF3BE41B6A5F213D04A3539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196249, "uuid": "8d50c09a-ffb2-4f70-93ec-23bd7067f2df", "value": "e0796fd4d2678f1ac0c3dc6d4697501b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196249, "uuid": "a1eea367-3ae5-4d97-a089-419735cb0374", "value": "6144:mkArCLEiyQEw4fhXgdRbAFBr9eTRN4PzEk+S662w0:myIiyQFIh5K47pJvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196249, "uuid": "ba472f19-04c6-445d-87a4-ec272afd8a7f", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196249, "uuid": "d95aa259-3300-43fc-8b89-43abad71999f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196249, "uuid": "991b6248-5802-4f5e-b522-e1de9c6a26a3", "value": "4f91267891bbcb4d8800ece961d93f42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07a460d-bc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161694, "uuid": "bf79b4ef-36b7-4a09-8fe8-21770885440b", "comment": "Malware payload (Mirai)", "value": "78d82bd14962c473df9f2361888cd67b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161694, "uuid": "8f780787-30e0-4ec9-81d2-92276ca7b4e7", "comment": "Malware payload (Mirai)", "value": "5ed222fbb1b317bff7727ae127332f0774095a4fadcadaf512411c4328f73b3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161694, "uuid": "266201ba-1866-4a8b-98fa-cd18614b9895", "comment": "Malware payload (Mirai)", "value": "e2a63f63540b8921f8ce1b851fa2d8ca5de3e05b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161694, "uuid": "663ff38c-7e01-4aed-aeaa-58c675986fc1", "comment": "Malware payload (Mirai)", "value": "8d224913af410ac96d0c7c798b4207359d7158bad5247422e09e8168289ee96700630862da234c0f8334d8cfcca673cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161694, "uuid": "250a99d9-7032-4f3d-863a-3bc841efb0ed", "value": "T1C5A2E01572632D56F3AD1C3DC96E8367B9A71BFCC0F632B669045920C90D21B2E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161694, "uuid": "446582ea-8d27-476f-9fba-772304cc3464", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjgd6hymdGUop5h0:UvQn4j+ZO5fKAlxFs3Uozy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161694, "uuid": "127b9322-199e-46db-ade4-66b8430851a8", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161694, "uuid": "ed0298c7-16ae-40ad-bea4-d7c0414ad57d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161694, "uuid": "2d63e309-e0c6-47c9-9df5-eecf8c6547e7", "value": "78d82bd14962c473df9f2361888cd67b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f811cc21-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678196147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196147, "uuid": "66d63bad-749b-4eb5-aa93-f69926b17d24", "comment": "Malware payload (AgentTesla)", "value": "ff4786d91299e7fb7e9221997d204098", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196147, "uuid": "e2510515-2342-4805-bfde-a27f1328b9e8", "comment": "Malware payload (AgentTesla)", "value": "5f0ac25045091660d4c19a11ef3fa4c75ca597a69bde1ccbee3a99135fcb1832", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196147, "uuid": "6acb61f6-151d-4663-a23b-3054ad90d10b", "comment": "Malware payload (AgentTesla)", "value": "6a07dd2ce387a3b76a46270ac938a9bc0af1a982", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196147, "uuid": "7a3f30bc-5ea5-42ae-9827-4e1994454d0e", "comment": "Malware payload (AgentTesla)", "value": "cdbdcc5f3ea0c0ef3c4af9e15f892bad31e8312e624c6cb60a7986e6d5c2863fa3a5fc832085b1e276fccbd25a3a990d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196147, "uuid": "ed77897b-af98-4fe5-822d-922e01fbdfdf", "value": "T110F31A689E899B56D72D41B4C56401090EB2A2435E3BEF5D0EE0DCFA3F767C3323A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196147, "uuid": "ceaa48c7-118f-44bd-b5e5-6bb62a03e93d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196147, "uuid": "41e0c1cf-7892-4a7f-9a2d-57732a203f09", "value": "3072:5qMR6quprwiK1+DbPqiAwbfepFxVVkO2YkoBPPCPlrkOzchHsW51:55upsiQs+iAuCFxm+yx2HL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196147, "uuid": "55db3d68-01b9-4264-a430-3f8ecb1293b6", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196147, "uuid": "45461a66-8046-43b9-bf83-e1b97048c08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196147, "uuid": "d2dd3666-d8c6-436c-8539-82529e6290e7", "value": "5f0ac25045091660d4c19a11ef3fa4c75ca597a69bde1ccbee3a99135fcb1832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219043d3-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198794, "uuid": "c81e7589-1628-4fc8-ae16-fda682c330b4", "comment": "Malware payload", "value": "3e0c7ad78d0768634c7e0e99a828c699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198794, "uuid": "505cdb0d-58d3-49be-938f-69833b4a1695", "comment": "Malware payload", "value": "5f92ec5feab5e1837d50aa27c2d2e38545badcd611c3b6cfcbb034eca0f05f88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198794, "uuid": "08f77d51-8eff-4f42-b0f8-28406301a4ca", "comment": "Malware payload", "value": "fbd878fecd4d45593f3cde2b776607ac59a512f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198794, "uuid": "97f6eaa7-5ce6-476c-8496-6c404c975711", "comment": "Malware payload", "value": "a6ccf4b3e49143cb2efbf54daee56a7270d317d5655da91fd1cdc92f86d3a5f49e30898b6b2903facff7691c7a38002f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198794, "uuid": "a32b3323-9490-4464-86eb-bd8d9c61f4b4", "value": "T170D4011673108403D86273F214AA5A911D97BE5019B8B20B73717F5C3BB2293FE5EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198794, "uuid": "5160032d-8fb3-4d78-8fd6-c6e9d985ca72", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198794, "uuid": "730fac21-6562-487a-ba3c-389966a098f9", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqgh:2YtZCkDkQQAO8h6mZvrg6NEOqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198794, "uuid": "a7c41544-09cb-4c3d-8d07-7c1e92965b27", "value": 613800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198794, "uuid": "bf63797b-ed74-48ad-996b-1cffec3fb65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198794, "uuid": "0a03368c-4fa8-46ee-9976-a9e84f42706d", "value": "3e0c7ad78d0768634c7e0e99a828c699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831d5aa1-bcb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678173617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173617, "uuid": "c76abe81-0436-4f82-af9a-b335b80ccfac", "comment": "Malware payload (Amadey)", "value": "5aaa9d6ec23bb2fba71c9582fa960617", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173617, "uuid": "6f108fbe-1a08-4010-8489-0d9f7680006f", "comment": "Malware payload (Amadey)", "value": "5fce87d7f9cf4e75b8a64b251a1aa2c7d60edda88efc346d8ddfefc56f58b5ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173617, "uuid": "76bf6111-f43c-4ab6-8b6a-90d8d63c4db7", "comment": "Malware payload (Amadey)", "value": "20a07697562bd20d4071560895e14475d533a2e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173617, "uuid": "90601eeb-67b6-4436-af30-47ceeab68deb", "comment": "Malware payload (Amadey)", "value": "67eaebf7e4a2d9dfb0fa7b61979618b06ce21b7ff1915e2ee6a97d45953fb168bb760d4ff207a8018aba6d03d3042aae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173617, "uuid": "a3e5d623-6b0f-4212-8de0-d6579883b4ba", "value": "T10144E7607D22C031C560617729B9BFF2C19D78259BB049DB7B800F7ADA122E67A70E7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173617, "uuid": "08c0d17f-90da-4722-9248-2e9603744a64", "value": "53ba325a46548c46e5a260a91003d321", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173617, "uuid": "b468872d-591f-490e-ae69-2a544fe8045f", "value": "6144:mz0iMriTgp6CZayUG8DbNcLYwUuFylfA9RGOjp:1TNHUG8txwUuFyl49Rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678173617, "uuid": "a63da1fe-cacf-46aa-a849-58f6cd754061", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678173617, "uuid": "9cfd347c-fc81-4ba5-9e3a-e3774a9add4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173617, "uuid": "2ab16a11-c0f6-4e6c-90dc-050398ddf621", "value": "5aaa9d6ec23bb2fba71c9582fa960617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d744eca-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209954, "uuid": "98245c58-6b09-4a8a-b117-8de0368c2265", "comment": "Malware payload", "value": "643afc83ab3476e75d3db503aad9550e", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209954, "uuid": "4240aac4-22c3-4c32-b053-7af379102acd", "comment": "Malware payload", "value": "5ff8b467d69f22d3119d2834cc1c0bbbb367b515b14ab697ad997e8acbcd5955", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209954, "uuid": "bc1c6553-ebd2-45c1-b902-e5b9315b4722", "comment": "Malware payload", "value": "8e544c6b237da88467028d315012bd4c71e03c71", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209954, "uuid": "049062df-0bf2-4011-b4e2-653bf257ee4a", "comment": "Malware payload", "value": "66af631b032bd6619988f8f5008c167afa1c951ffa57ef40ccfedeae1374fb0ca4cc4963734351180b935fc9de1831e3", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209954, "uuid": "f586265d-b25a-426b-9c0a-1063a9a3f8ac", "value": "T173464C95BC1DA812D7C86BB07B6583D17229FC488F818327AA16BF9E9CF275C9F11311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209954, "uuid": "09672aba-18de-4f80-9497-72957ef31ce8", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209954, "uuid": "b86afcb0-582d-4f16-9226-7285357e66dd", "value": "49152:i+iMrNvfVw+YqAwIPwOdg/H7E+CtdPt35ECDRrR1C3Agv/Jj71:vigNvfu+XAwIPwOdgv7E+CtdE9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209954, "uuid": "7e80bd91-10e4-43f8-8f7c-04bef4969b2f", "value": 5778432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209954, "uuid": "0365c6cd-e3af-4760-95e6-ca6f5da712b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209954, "uuid": "6f959f5c-32e4-42a2-81fb-10b372cbd1d5", "value": "d_win_arm64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b806779-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191992, "uuid": "6e96a60e-9595-44b1-8ab6-e8b4865c525b", "comment": "Malware payload (SnakeKeylogger)", "value": "74ad2d4df4613a50a25d8d36b5d967d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191992, "uuid": "7e5abe6f-9b07-4c9c-b145-802d1b281af2", "comment": "Malware payload (SnakeKeylogger)", "value": "606157eb85fa1f90ad5b6def0cbddc1445298156aecb9da21bcc925e6cd7638c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191992, "uuid": "470dfce1-3770-4200-a962-fdf71bfde23a", "comment": "Malware payload (SnakeKeylogger)", "value": "b6b1c4615032e51310c00212c51e9c2aa3b81cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191992, "uuid": "e6e8cdc2-e669-4cde-b1d5-0bc1d750361c", "comment": "Malware payload (SnakeKeylogger)", "value": "cc3ffef072f48ed7de1044a51489ee21a99f4719d80d5bfb0182bf653ab04310a53bc9d84a4cf2dd9d2599903010f30d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191992, "uuid": "a953fe49-c8ba-458b-9ea5-e5db5a501806", "value": "T15A358DD0B6449897FB8B45F37C1A693165DABE8C5465C00C1AEA370FA2F3B15209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191992, "uuid": "13b70155-62cd-4d8a-acba-5e8e11088e26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191992, "uuid": "6c6fbea2-44d1-4d1e-ab11-8b57c5a5199d", "value": "12288:6TjXpV6cXhpUFycG+XQTHkgf53alA0Rho7/GyDGDYvdi9P:6TL3teyc/A9alZj6wDYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191992, "uuid": "a2145c49-c86a-45c5-9b33-33490e8f0b65", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191992, "uuid": "376ddc4c-0299-4d0a-b1da-61fddd223daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191992, "uuid": "a60ca870-ac48-489a-84da-6c1e151739f0", "value": "Belge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0819c8a3-bc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149789, "uuid": "1f51973e-a409-4c31-81d2-dbd6a70376b6", "comment": "Malware payload (Mirai)", "value": "b0cfa02e6be8bdf2a8bb3b9e850ac382", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149789, "uuid": "7dccd2d4-eef2-45f5-b901-0d9458e236ab", "comment": "Malware payload (Mirai)", "value": "6087a9468a0fc0810f56bd469c84d9f848983ae68a08d0914aed93d3fe5bb669", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149789, "uuid": "d2c51330-a8a7-4af1-842a-57163ddee746", "comment": "Malware payload (Mirai)", "value": "538602e4d30234cef992c3bab9988fff800bd7d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149789, "uuid": "f0cdcb48-1f6f-47b7-b3b4-9f1ae70c95b5", "comment": "Malware payload (Mirai)", "value": "272dab9940dcde233c055336e5d8e35850c1aeffe5f81046109cdfa749cad115858caad00a179e79558ec1c851c3f12e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149789, "uuid": "3dbac210-1bf9-4a36-b3d2-48e0f47dc480", "value": "T1B413F11E94566F31C9A2287BC2B301C987482FB2C5E7B781354183366DCB9DB73EB456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149789, "uuid": "656e0045-91e8-4119-bbb1-fd474effcd53", "value": "768:kKjh6AQdv6kGBEVco1Lxy+KRarQPSGB9q3UELF0Ab3tGTPfFhYRIPaIbVwiZe:ke6AJK91HG0LTcfFhYRIPNVwiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149789, "uuid": "9317bb36-7a09-4d18-b9f6-8a6d51fc0afa", "value": 45048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149789, "uuid": "e8ec24ac-315d-4dfd-b981-71410113e6e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149789, "uuid": "304d4f07-117e-4ecd-907a-a261fe0abc9e", "value": "b0cfa02e6be8bdf2a8bb3b9e850ac382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82944445-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678198527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198527, "uuid": "4fa0694a-eaca-4be6-ad38-44206af7f1ba", "comment": "Malware payload (RedLineStealer)", "value": "50fddc318d1e8d0f139f62cbf4f7de3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198527, "uuid": "3c4d5edb-0440-4cd9-aa3a-84a87df2ae51", "comment": "Malware payload (RedLineStealer)", "value": "6122bf939accef04d0acffcf417e6f72ecf0dc713fbc0578940eaf4e04cb5bf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198527, "uuid": "1ccad962-d8be-4cf8-a73f-8c3839845ff7", "comment": "Malware payload (RedLineStealer)", "value": "ace1ee0cdef44a196177d7d9a404800baef59918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198527, "uuid": "c585b62d-749e-4a96-90eb-8424aef33fc8", "comment": "Malware payload (RedLineStealer)", "value": "d2049b4fc9b61cbd4b72af34b48120fefddc9120ed29a36effc71464eab333de0101c4998ae335e33ac5aa60f028025c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198527, "uuid": "23aa587b-c579-4334-9161-e7a7bb4f07da", "value": "T12B74F12276D0C437E6E709705434CBA51E7EB8362635928B7B782BB91F203D1AB76317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198527, "uuid": "041f962d-0e49-4c52-866f-360bd8aaa1bc", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198527, "uuid": "9b0f64fa-619a-47f4-a57b-d78a28dfe761", "value": "6144:NL6CsH5B3H5rUknIj3BpeHSTjItzQjQRmx/Y+Ia4eZ:NmCsH5x5fI7BpeHSjItzYQRiYNAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198527, "uuid": "322dcf0a-6ac8-4814-a298-7d7e2b1d68ac", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198527, "uuid": "aea49200-317a-4d23-8299-0597ec271468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198527, "uuid": "16a52eb1-2c75-4aac-92f2-c861abb12b7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eeb42d5-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175624, "uuid": "114bc139-7583-43dd-8b68-f2659d3c3e26", "comment": "Malware payload (Mirai)", "value": "3f3f4e736543bb5a24e219b4e122a4c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175624, "uuid": "f8df386b-223f-4b29-b26d-e867d53a8af3", "comment": "Malware payload (Mirai)", "value": "61dd46986a02c4ab21c0917559041d3f35f294ad313e61d900659fca3de0b4fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175624, "uuid": "2d05b21a-8559-459b-a996-a6841050e50a", "comment": "Malware payload (Mirai)", "value": "2471f056f35c273e83ddd506a10045e9a8e072b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175624, "uuid": "d0ad5298-fea2-4bca-ab12-91c2aaa53aad", "comment": "Malware payload (Mirai)", "value": "76143155ec570dc10f645e6225efb07bcedcef8b0ef61777b2de09bedc37e00033cece27bad4a9e4d2cd9c01600ad220", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175624, "uuid": "4dcb52a2-9ff1-4b86-9f18-003f332d777d", "value": "T12753F884F88B81FACA1B4D3051B7F23FCB31E9798170966DDF9A6F35DA27D029112189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175624, "uuid": "ad1d6924-d70e-4e24-a825-261a95a5c79c", "value": "1536:P4iNX9n15IItceegsVfPaZlVJ2MRLwJY7JhyvWWuP:AspbtcePsVfPalVJOIJAvW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175624, "uuid": "5e881908-9fea-4e73-81c1-55a21ddb6ff6", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175624, "uuid": "06451296-04fd-49af-bfdc-1d382329e667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175624, "uuid": "557a4563-ca94-4d1c-9d83-3cd5cb328260", "value": "3f3f4e736543bb5a24e219b4e122a4c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56265878-bd0b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209190, "uuid": "a57be84c-806d-41cd-8970-54e606779ae9", "comment": "Malware payload", "value": "c986136d713f71449ad8ba970379d306", "object_relation": "md5", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209190, "uuid": "5e4f0be2-bccb-4802-a20f-b5b3d40dd3fa", "comment": "Malware payload", "value": "61f0e80b2a74bf26d2089e09e779b0514b4d7e324de6f968bb224cbe6f2fab91", "object_relation": "sha256", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209190, "uuid": "50580c27-6327-4246-9db0-a07b8b3e86cb", "comment": "Malware payload", "value": "36b5522a58e8f8fb90921e400e974fae35b33374", "object_relation": "sha1", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209190, "uuid": "be41bd16-221f-4d53-b913-31bb50f1a79f", "comment": "Malware payload", "value": "7bd4d6986ebfb559aa91bb1cca45375d42941d005389d06aab6a1afb957e60752855e59fc1672254035808de77c10b0a", "object_relation": "sha3-384", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209190, "uuid": "6d3dfb67-e930-4cea-b9c6-ce59a15007cd", "value": "T1B6F2D0E2A69C4C9DD5C3DB36A122716E987DF1924AF9B2D5B47F08D1E047C4CA9C20B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209190, "uuid": "2b76b5cf-5a9c-4c3b-aaa6-0444625e3bf8", "value": "768:4GaPo4baUePJRryPOeEXcze7sYELJiC+He7mzQe5Q:4GaPD2XyPpEMKprHe7+Qe5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209190, "uuid": "12db22f5-d5cb-468d-9ba3-6489c248acb4", "value": 34606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209190, "uuid": "002b33c9-6e37-49cc-92f8-18db828484ed", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209190, "uuid": "79b8349b-a8b5-4821-908a-a3a044f6a5ee", "value": "61f0e80b2a74bf26d2089e09e779b0514b4d7e324de6f968bb224cbe6f2fab91.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cc1083-bcdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678189478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189478, "uuid": "941d1256-3148-4c19-8fef-04c8321e306e", "comment": "Malware payload (Mirai)", "value": "fb437037373f80602f30b44697050c5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189478, "uuid": "c996ab1a-d0b6-4c69-8771-6aef168113ed", "comment": "Malware payload (Mirai)", "value": "62f2b47b47ed337ebbab3f5f36299f757b75a82ba6505b61494cf8cda64497d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189478, "uuid": "8106bca3-04c0-4f1f-9c35-2d12d651988f", "comment": "Malware payload (Mirai)", "value": "a1e988950dee1e565af60b4f768d78c14adcd49a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189478, "uuid": "754b5819-cb44-4a5a-b5fb-67b516d794d1", "comment": "Malware payload (Mirai)", "value": "a402ead6ed3b23665ec22fac8b33b1b55e60e64e906630e1260cb8a895686722eb3b68882b1c8830b80166b39df599ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189478, "uuid": "8ff2b632-969b-49e2-8d93-290faf655472", "value": "T17063B40ABF650FF7ECABCC3709E91B45258D661A21A97B397D34C818B24B25F05E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189478, "uuid": "1dba9319-a27b-4135-bb82-020bd8629b77", "value": "768:eV+Ux5T+DbyI4slYfeJuIzO3QpQyEXh5O7ej8ex5eBW6YTGNXipQS2SBls:eV+U5yfyI4s+5Gwh0i8k5eW6Yaw20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678189478, "uuid": "596670bf-ee1c-42d4-8bb4-ea11206fbfdc", "value": 72460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678189478, "uuid": "e5021b91-b76c-48ca-b7af-b90b49a66a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189478, "uuid": "270a95d5-4a46-460c-94d7-8c908e7b5280", "value": "fb437037373f80602f30b44697050c5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0174c856-bcee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678196593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196593, "uuid": "8c80f689-4e57-42da-999b-d0fde86b4947", "comment": "Malware payload", "value": "c3bf1c1dcec8c45b9930f7c4597eaec6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196593, "uuid": "68a549bc-7540-4a62-ad22-ec1d862488f0", "comment": "Malware payload", "value": "634cc40211de869a2e54d7df15a1dec5ce736608315236f9c8d95592c015db6b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196593, "uuid": "183cbbb6-212d-4306-a4e4-fe9e56017ce9", "comment": "Malware payload", "value": "e1a7cc41d4a2165bbab0f84e52dde1220d80874e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196593, "uuid": "6849be77-cb9e-4ca0-b9e1-c75105c72ade", "comment": "Malware payload", "value": "070662773d605e479860d9540170db2d390cdf764e3de0b4df2176ee273b5e312b7f5c57ae87abaa75593ae8d89095fa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196593, "uuid": "89a054cf-fceb-4d92-a4f7-f4c97d8c71a6", "value": "T19955F10392389E4BD102C7BDBA6F7559020E7C3671C1E58A364DB70B4733BAA5ABF119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196593, "uuid": "792a4c34-6ce8-4f94-8bf5-d2428e9564b4", "value": "24576:CLKdBZ3tHlxQWQmmav30xGBAAtHlxCWQmmav30x36WXJi71p82yJM:CLKdt7lQmmQ30UCO7HQmmQ30R6Ei71pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196593, "uuid": "080e6fe0-a442-4471-b8aa-6b7e218d2d21", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196593, "uuid": "96317e39-51cc-4cf8-8832-52d9db61e257", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196593, "uuid": "fba0db1d-a355-450e-9c98-730a44694867", "value": "INVOICE 0875.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83587886-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192516, "uuid": "8ec3acfb-3def-475f-b318-f44980ac8ac8", "comment": "Malware payload (AgentTesla)", "value": "5805a7f49e4d24c01576d88142c03db9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192516, "uuid": "cb6059ad-f2c5-4f90-84c2-15ec46c95580", "comment": "Malware payload (AgentTesla)", "value": "63731c22d9643f286c19af3d6d65b455bad2a2fc1397ce00e5ef8eb6c632c7b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192516, "uuid": "05d0be4a-06e1-4e0a-946c-c41934673b53", "comment": "Malware payload (AgentTesla)", "value": "20c787eadd533f4f58692004d10fa34f9798e592", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192516, "uuid": "c7120293-1904-4065-bae2-5756b0e3508a", "comment": "Malware payload (AgentTesla)", "value": "733750d6a621774073b241f3c27313c79afb5669d0033067ccb273e2a3f956dbfa76f9f737fa54c6eaf152c2ec121c01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192516, "uuid": "56965157-0879-4f55-89a9-dd36ad4bb613", "value": "T127F3292C92DA8E11D72D8374C4B1114C07F69146961BE76D4EB0BCFB3E867C3762AC66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192516, "uuid": "043f8aa9-77ce-4e8a-a4eb-054845568750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192516, "uuid": "888c3652-f7aa-403d-a3f6-f747b06969b2", "value": "3072:X0w9yl2qHcEXOl5kPc13x4ILDANN/K0PCB:9+HIacV7fAXikC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192516, "uuid": "cb57b652-06a7-44c6-a7c4-9858ff3fb663", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192516, "uuid": "f92ecfa7-d265-4b88-b759-1d3da03127d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192516, "uuid": "a280e0f9-a344-4688-a3ae-0dccd3773a32", "value": "63731c22d9643f286c19af3d6d65b455bad2a2fc1397ce00e5ef8eb6c632c7b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a938063-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209520, "uuid": "24c27326-386d-425f-b910-1d7e181db768", "comment": "Malware payload", "value": "f40c6670af97d3755edfb8ff1b3176b9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209520, "uuid": "b894f5ff-5941-4745-9f79-4f9969babda3", "comment": "Malware payload", "value": "63b9f8c530df2ba68fb98764471ad063e2fa74a25334c0179dccc83a549dee3f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209520, "uuid": "270c5949-9dce-42cd-8a7c-0bb177938a9e", "comment": "Malware payload", "value": "6fbd22844b5bd3b09e1c99fa917f0becb90a4065", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209520, "uuid": "83a005c1-c31d-45d4-b92f-8cb162caa8fb", "comment": "Malware payload", "value": "2c6019e9dd066e7dfee9a930655d741e1ce082077a1f647737fd4478412509cd091a9b8bf0626f72ee642d73e7f3cad2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209520, "uuid": "5730ddca-c73b-4b2b-a207-1873a3101bd2", "value": "T18982D0FACB2AD0E084510ED74C4855B33B6352197E33969F1ECDCACB60249CB07FA462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209520, "uuid": "77c707f3-d97b-44d7-9624-af9772b55ee6", "value": "384:vQRF6Nyp8j6NKEtay454mcBlDCKT3MEiv/:oRJ8j28OmKT3R4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209520, "uuid": "9c29dad8-3df7-4823-bdf8-8852ca62d7f0", "value": 18378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209520, "uuid": "831ab4f7-a1eb-4a69-864c-c84e0d7b1214", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209520, "uuid": "558141d8-efc9-49da-bd7f-0554395b543e", "value": "07f86bd9-e982-489b-7698-08db1f277d2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54b41ee-bcb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678173782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173782, "uuid": "c1f847d6-f357-461e-83b8-ea37b764e52e", "comment": "Malware payload (AgentTesla)", "value": "0bd9ad185fb1a3e5a52865387922c7a6", "object_relation": "md5", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173782, "uuid": "dc225962-8678-4c47-bd74-0b2169ff66f2", "comment": "Malware payload (AgentTesla)", "value": "64127db0f46ebe9f64bf2aaefa4ab47fd4818c1a6a72a4ca11ef97c566081bc5", "object_relation": "sha256", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173782, "uuid": "fda04537-6764-4eae-9125-daff382e6a02", "comment": "Malware payload (AgentTesla)", "value": "dc59220166bc6e698a1601bddd3a3866cdcfbd92", "object_relation": "sha1", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173782, "uuid": "ee415fee-5812-459b-8151-55e758d2e8cd", "comment": "Malware payload (AgentTesla)", "value": "7866478b8ef28e9d43053719d98a018e68706f205af0558e79e7e5d61bc9200d25167d0501390b1c92de83c069b5ac06", "object_relation": "sha3-384", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173782, "uuid": "6b6579ca-3e98-4868-8d5d-b3061736bb01", "value": "T143F4335E5C9DD9919347133AC31ABF9BB79FCE9E8C84D98E870AC22305E538DD48E019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173782, "uuid": "6049255d-ed50-4a6d-8041-1b65061812cd", "value": "12288:r7hGZbAulhJI6kCc5nzPC6MsIY42oUwLfE71V0ial6OJY8dHQCuBIjd1NR:r7hGZjlhi6kCQzPvL9ccpV0iM7QXBgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678173782, "uuid": "6399f4cc-faa3-482a-a14b-d79eaf231d65", "value": 738050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678173782, "uuid": "6789dcf3-e437-4d1f-9fe0-993d4eb78e68", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173782, "uuid": "7f064955-2a92-48cb-9331-a1a51198190f", "value": "remittance $111,480.00.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015f9d9c-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192727, "uuid": "37fb7345-201f-4cd1-89b5-86aa39fc7e7f", "comment": "Malware payload (AgentTesla)", "value": "cc9165270dbf72f86af906f7ed22f818", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192727, "uuid": "cbd249aa-6959-4511-836c-b04323cc263e", "comment": "Malware payload (AgentTesla)", "value": "64a0c4a1d1873fc3ce4a089fb674bfb73bf8e05184b4c7ae25d58ea94e514d05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192727, "uuid": "e8d7461c-ca23-4102-b60b-77496f22c038", "comment": "Malware payload (AgentTesla)", "value": "ce10e92c7afe84339a8d955b2b6572ee23f07ced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192727, "uuid": "2fe20e33-a8cd-44da-b58a-0108408d43f1", "comment": "Malware payload (AgentTesla)", "value": "e2954181fd08ac33ae1470ed75a0c36dfba3755ed3e1d013cb045c66ad385a5a5212a4877d54070197dca90bad46a1d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192727, "uuid": "04b39d47-f5a3-41f7-8724-d26778c02c44", "value": "T1F0F32A2852899E62D32D4D74CCB11148C6B3A956C617E75E0FA1A8F63F067C33F2F896", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192727, "uuid": "5b26f665-8e9f-43ab-b02e-7f2f9bfd2f63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192727, "uuid": "ca1d727b-b1b5-474d-90ad-590641ae0e26", "value": "3072:62spuL9wKXqiCS2zAe41lVAzu3Q1hSFcuWA7fatrg7R8GMkaf:6JmC3hzAH1lwz1hm5itIHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192727, "uuid": "c703b94e-249c-49c8-94a7-312318753a3a", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192727, "uuid": "7ae167be-6e62-4a96-b38e-0aab40e26272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192727, "uuid": "9254e3bc-99e0-4535-a6c2-3643e694e4aa", "value": "64a0c4a1d1873fc3ce4a089fb674bfb73bf8e05184b4c7ae25d58ea94e514d05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de8e19b-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198868, "uuid": "b585e003-6c02-48ef-a93f-5a5716fb3838", "comment": "Malware payload", "value": "8c57df3f5a63ea44307948a2fde2bfd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198868, "uuid": "73a3cf2a-9c20-4673-8fb8-f82a2a994716", "comment": "Malware payload", "value": "64a6bf5c1588cc740b3821de03078f2bfbbf5642a8fed33771e44d250764bd98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198868, "uuid": "8a785055-f0e8-496d-9d35-ecdbce3ed4a7", "comment": "Malware payload", "value": "c7001ad09ed822cf1cf0a4d5ff346527074b819b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198868, "uuid": "929ef912-96ec-4ff0-bfd2-87c1166d8af1", "comment": "Malware payload", "value": "5e48e6397154434e339c0e0b32f2b49ba0c5a54bff3360b3491fe75721b5a4ca6a20ec1cedcdf6062a3b34e2146ff651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198868, "uuid": "40426920-7676-49c2-b5c4-af9893d645b0", "value": "T19AD58D32AB048132F5D211F1D90C1B6F894CA63413B940D7E2D57AE969E0FE36B36B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198868, "uuid": "f15d4776-d38f-45fa-96f8-5be1432a33c5", "value": "612edbc3b53f6e607818891b34ab969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198868, "uuid": "e14849ea-d9cb-47c3-8abe-c8994d5dfdb0", "value": "49152:OPqBBFCS9r+qBRO8lkiW1XkpZseM/F5LCGQp4eXELt2OGWeOpfefxa:8qB7C5vXKid/F5LCGItXy2Oacef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198868, "uuid": "e99cdeb8-95ef-4982-9a03-a329a8e898f5", "value": 2805248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198868, "uuid": "fd154e5b-4ff3-488c-bd7d-30a19d7b90e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198868, "uuid": "66106db2-5af3-49ae-84fd-87d7b74cae4b", "value": "8c57df3f5a63ea44307948a2fde2bfd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b36f28-bc89-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678153564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153564, "uuid": "07c719da-e7e0-422e-bf03-37fe2dc84993", "comment": "Malware payload", "value": "c7e20d9a8829b3dc579aa5e780b5a247", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153564, "uuid": "3373ff43-6792-41a2-9794-e9e13da1c84e", "comment": "Malware payload", "value": "65806b44cc62647b69f3d257f9f1ae07f046bfcc3d621c3e374aaaf019bba1ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153564, "uuid": "ff5d543b-7a3d-409f-8fe9-b0467b372d2a", "comment": "Malware payload", "value": "ea56ac3120ec8513f8044dc41746c22da1e1bf70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153564, "uuid": "78b1986f-c4c4-44b6-a6e3-54bb446169c4", "comment": "Malware payload", "value": "ba7062ae94a353338a21333ca75bb384ff7b2d0c184437b405c77707c3892779e49b772efa00dd911ad159a82f4ea4d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153564, "uuid": "e5d26c3e-c8a4-40f5-b3a9-58b4f3b10160", "value": "T14DD40122B151D49BD5A773F2097D0AA21B97FE112874A20E23317B5A3777143CC6EBAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153564, "uuid": "727fda76-8281-4c68-89f5-afeba0e11d9b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153564, "uuid": "ea6659f4-f9d7-4050-a8ec-c35d04582a8a", "value": "6144:2Ya6YVZVEJIXBqA2crL7urWI4yYNY5cqr:2YOVFxjrLaSI4yl5lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678153564, "uuid": "618cc400-f12c-4656-a1b9-ffe583a3ce92", "value": 613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678153564, "uuid": "da728ee6-6f6f-49b9-a0b6-8dab6e1ac495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153564, "uuid": "f556e16b-af76-44b1-b66b-9990356455f2", "value": "c7e20d9a8829b3dc579aa5e780b5a247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5aa38dc-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678193029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193029, "uuid": "868ce2ba-8a1b-4f43-b72b-7ecb3aad6937", "comment": "Malware payload (AgentTesla)", "value": "3e59bd63f046788d16a8c15f8487a7d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193029, "uuid": "ced5c290-4548-4fc6-81af-4924fc167d3b", "comment": "Malware payload (AgentTesla)", "value": "6629e8e3246464186a8b99c3319521045ec2260291ddd1be22a24997aaee1083", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193029, "uuid": "e7bb1b6a-b00e-4ae7-adb9-a3eb93902a9b", "comment": "Malware payload (AgentTesla)", "value": "022bc8eb233776360a295d20f6469d1d1d45b0e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193029, "uuid": "de28f8fd-8b3f-45fa-9364-6d1effccb2d5", "comment": "Malware payload (AgentTesla)", "value": "a157a92499639845e9fed4c448af6c2b00b3180a4cff85da44bdc40d1dbde5834d4d9fd5262230ecb8bd3b1c7688fa2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193029, "uuid": "9c4cc4f1-7a52-42ce-b16e-e86fa0b6e97e", "value": "T12CF3296892C5BDD2D32D4174D8A01358CBB299469317E75D0EADE8F63F467C3322B8A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193029, "uuid": "1c0f3873-3318-4456-9e9e-9bd8c1d592a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193029, "uuid": "18e9f62c-d015-476f-bafd-43c941416d56", "value": "3072:WUOijUt+BvyHN19V2RlVBLIcmTi1Km9KZVv6C0pC:R729V2zHMYKvn6xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193029, "uuid": "958d7c7b-0cc1-44d1-aa60-70221db4ec07", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193029, "uuid": "e39156b0-6bfd-4414-993e-6c5b85504dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193029, "uuid": "264cb1b5-7bf8-4e98-bce4-1f236f4093b8", "value": "6629e8e3246464186a8b99c3319521045ec2260291ddd1be22a24997aaee1083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21624b4d-bcdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678190204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190204, "uuid": "2d435db7-e66b-4521-9c0f-cc812cc6794d", "comment": "Malware payload (AgentTesla)", "value": "01d23b94d32d0b408ff1477bc5d2a749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190204, "uuid": "bded6210-d16d-4994-90de-d0bf3c6923f0", "comment": "Malware payload (AgentTesla)", "value": "67ad48248241d2c2eab1c3577523b39ffac1d22cfcc2809dbff73b5766da3e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190204, "uuid": "a9d3acd8-12d4-4d40-b563-7fdc0037d54a", "comment": "Malware payload (AgentTesla)", "value": "45dd381ab03212e97cae825b10312292d1810e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190204, "uuid": "2e474b95-060e-4ed8-9134-6953cab51b6b", "comment": "Malware payload (AgentTesla)", "value": "1002c4c4c8d96e1548c3dcbd6a70b1a3481b11b8b0b3cb7dc6d492ac41d755a3bd3c93e8ea80493e42863f6c0b0db7c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190204, "uuid": "af2785c7-d1ee-4c15-ae9b-b8091e8292cc", "value": "T12C25AEA56F19A257E7C2A1F31804E7B6EBACBD5C2426C0883ED13D8FB1B9D2C1111E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190204, "uuid": "2d214d49-c929-4b17-a772-4c5a541d16d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190204, "uuid": "91329f4a-ca91-4f01-ac64-0293c0a25805", "value": "24576:g0YNUfqBpCwpC7stgmV75xMntU/y8jctYecLo+C:2NHwkg4gtYecLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190204, "uuid": "d8a862ca-207b-4138-bad7-99edafa74d3a", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190204, "uuid": "f5b4fda1-d329-4589-8a76-87a0a20223c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190204, "uuid": "bfafd340-a6a4-400b-8aef-879f16ccc86e", "value": "01d23b94d32d0b408ff1477bc5d2a749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc5bfe1-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678192053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192053, "uuid": "9a038b50-d23e-4f30-ba97-5984cf19b192", "comment": "Malware payload (SnakeKeylogger)", "value": "792994ed5d7dd6883486d8a5e0a629fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192053, "uuid": "6e284a5c-07fc-4d3b-99e3-4665740c1148", "comment": "Malware payload (SnakeKeylogger)", "value": "67ecf11b3c85785797d599090dec86ec79cc4ce94095ad4a2cec53e15b48dc81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192053, "uuid": "2082627c-8396-4aa9-849e-71e1aca9ffab", "comment": "Malware payload (SnakeKeylogger)", "value": "420979ae0e23a0f43136dc7c1365deae69070963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192053, "uuid": "4f8d46ff-3c93-4d8e-bc61-98a14e650097", "comment": "Malware payload (SnakeKeylogger)", "value": "ba6714d709335061ad0ddf1c5e7839a8f7f24959ef968e327accfef19a556518cb97c5411619edde30eb338a7b236d9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192053, "uuid": "2dda12e5-b75d-455c-9652-f1186e9401eb", "value": "T13F353A82A02DC446F85F05F16E27273A3975EE5C5D62C16832897A17A173F133BCAF29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192053, "uuid": "427a9373-1eac-4e74-8786-b16b9084e575", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192053, "uuid": "704e2e6c-09ba-4ccc-ba1e-3ed6a95af838", "value": "24576:o6CCF1W6ZesX2vB9OLmnb+H9Z8vNuGLzKJGkwLKp:o6CCF1W6ZesX2vB9OLmb+Hb8DK9MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192053, "uuid": "f4cf04c0-3979-4fbb-8979-4a2574201c7b", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192053, "uuid": "4b17bc9c-e7d1-4e69-8c18-8701fe8778e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192053, "uuid": "855a03e4-e8ce-47eb-bf0f-4680b704c590", "value": "K012023000001886.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b19066-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209988, "uuid": "a6bba315-fd60-4e30-a931-aed725ec4ab0", "comment": "Malware payload", "value": "9a33fa35cfddf516ba032916714b0af9", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209988, "uuid": "2675061f-4e54-467c-a576-483d1b9635b9", "comment": "Malware payload", "value": "680a2f01fd134d4ce065aa8bcd5b9dad28fce2e11abbc8d7a637799de8b0240b", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209988, "uuid": "454da877-6f45-49ea-8daf-da4df375c645", "comment": "Malware payload", "value": "9b387e0ca5489f81b095f6719337d1fe13ebf60f", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209988, "uuid": "3d933352-f419-4312-bc72-379f24e1a4dc", "comment": "Malware payload", "value": "10a1d9c2c7d59e7740ed648565ec4336870baf9218b2a2078b863acfe753cd84edbcf578632fd53fcaf33a18a3f882ea", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209988, "uuid": "98b8e94e-7bbf-476b-9d81-166cfe0a5673", "value": "T12A565AD2BC0CA852E7987BB46B2483D0A239FC459F5196273A10FFAEEDF53589F11211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209988, "uuid": "6461f2fa-9b12-4e92-871a-58ac125bd298", "value": "98304:kuNsu7HbjBn1Rq7bKMrTfFEfLpVtcV6HyQutofgxY:Vsu7bRq7Ef9aTtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209988, "uuid": "6ff18333-210f-4cef-a8d0-3cf2f3345fe4", "value": 6100770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209988, "uuid": "6557b820-40b2-485c-ad5c-30e5dd49ce39", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209988, "uuid": "8f2e7b1e-87a8-4d9f-ac43-66b88e626a07", "value": "d_mac_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdda09bb-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678195728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195728, "uuid": "efcd3365-0aca-46c4-b788-58c89c524946", "comment": "Malware payload", "value": "6dac8c5381ae3101d911145970bdde93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195728, "uuid": "c21652d4-2063-43f2-807d-69cdd1449717", "comment": "Malware payload", "value": "6888c253f7fe673389ea592d69e1844c81eb01f313514df88f9dbdebad514aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195728, "uuid": "6ec0c155-2e64-45e2-915f-e396aeca1713", "comment": "Malware payload", "value": "04c1cbac48c640f3c54c0ec6086aa3eb181da696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195728, "uuid": "cba723f6-2cb4-49ca-87cd-edaa41545f05", "comment": "Malware payload", "value": "e097192e611ab89e0a0d599f61b5fbbe1066c76ed8656174b7af3db7a357f1afd6cad089bd19d8791e2c350da6bde1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195728, "uuid": "d224319f-a387-4a9a-8a1f-efb3d2ddf0b7", "value": "T16EE65B07F89191E9C4EDD130C63692A6BA303C495F3063D73B60F6B92B72BE45A79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195728, "uuid": "f9dd73e7-88eb-4917-880e-1f02ce0d39e2", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195728, "uuid": "2e2b2eb4-e8ff-43fb-9633-cac1d536603d", "value": "98304:4ivsPFrDUiYmacrsUj8f0AQvguuE5/4RzXDExRf00:nydUi5ac7j3A0gmKRzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195728, "uuid": "cc3e368d-84b4-458f-867e-a1a08b03aa39", "value": 14546944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195728, "uuid": "af0bff76-efca-4ef2-9441-0eb02868bd83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195728, "uuid": "348c71e7-2dff-4d80-a264-a19791d4753f", "value": "6dac8c5381ae3101d911145970bdde93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4434d3b1-bcdf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678190262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190262, "uuid": "f242e25b-b94d-477e-ae2f-2da2bde0a915", "comment": "Malware payload", "value": "31459198db44de15fcf7e277b1908e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190262, "uuid": "a7aaddda-66e3-4d61-8043-9f855f0f7bfc", "comment": "Malware payload", "value": "6a9b45b86fb4fa22a00feacb3bcf9fbe0219a79d818c1711bddcdd037de93703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190262, "uuid": "89e960ba-57fe-41aa-bc57-fa984a0e49b8", "comment": "Malware payload", "value": "de63bebe9a2ab71f5015b80b5d48a57e7f09e331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190262, "uuid": "5faeb2e6-bf74-4b97-9656-550156421b14", "comment": "Malware payload", "value": "cf085b5d9989ee707cc1c8bf4b20fe71e40b05c0980b386adc1589103d7b7e016385f32b6820ab1ceb506b29e19fc628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190262, "uuid": "891b6e9f-8c30-408f-8f03-1ccb203d8bcd", "value": "T1E1041220AF85D6F5E8A366F50BB2361FD121AC793E2063BDD3C41A5B84668306CD74BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190262, "uuid": "c34cfb72-0f87-43cc-b85b-f7f238c0fb72", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190262, "uuid": "c9ff4607-4092-4caa-bc91-de44f5282601", "value": "3072:AWyHH7NoDqdXrkcu8WVtCebfB2dUwAtWUOzzOoSAcINMYFJJeH:repm0bPqToS2yoSAcIN/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190262, "uuid": "9b2db9ac-f5c5-46f3-b08a-82ff22ee8973", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190262, "uuid": "ffa2bfc0-a118-40a6-9a25-e2939f66b2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190262, "uuid": "acdeeb01-f2bd-4b2a-97c8-b774f0230caf", "value": "6a9b45b86fb4fa22a00feacb3bcf9fbe0219a79d818c1711bddcdd037de93703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a9d5bd-bcbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678175390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175390, "uuid": "9d949195-3c77-41e9-8717-4d67f26a5642", "comment": "Malware payload (AsyncRAT)", "value": "95ac8bb99267f46e20857b7caf76a6e0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175390, "uuid": "2ae41792-dd11-4411-8fdb-12be3d6d7b5d", "comment": "Malware payload (AsyncRAT)", "value": "6a9fbdd219a7ccbb64cdc17ab06f17f2964414c3b4ed5dfe69dac4aafe308300", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175390, "uuid": "f94f76b1-c7a6-4a71-a5a3-0a1be177eb7b", "comment": "Malware payload (AsyncRAT)", "value": "3182546c9062b070561dab1962898a4c0dca6087", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175390, "uuid": "8b7efd08-1162-49f4-8786-ecc417b1b1c4", "comment": "Malware payload (AsyncRAT)", "value": "95b273731ff1062361469562bd3d94f2dd1b75076b82d907148e4741eb7391dd1d057de20be5b12331d764fc46033fe4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175390, "uuid": "36166934-5061-4642-a2b6-d3def0aefdb0", "value": "T14A157C942F79EE63EB85A0B3180436A6DF6C7D5D2526F0081DE6308F8DF9D2C5111EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175390, "uuid": "df980aa6-c156-4ede-9bcc-e9d7251154f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175390, "uuid": "cab9afcb-480e-450e-8876-bf24fe7883f3", "value": "12288:jUrXlUMk+/FF7phaWVLuIwlAfDbAbg5dMS7TYH5Z8h4R2Yb4cXBZ:jUzlUMkgF7pxVLxDj5dM1H5yYb7XBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175390, "uuid": "e0b0f271-daf5-4d82-9a9d-5fe96aba6bde", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175390, "uuid": "73b84025-754a-42b6-963d-fe7a16d81c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175390, "uuid": "f6aab271-9e9a-4363-ab48-ab8b07a2ab23", "value": "ORDER-MTC04RFQGENZAK1220637501220524622023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146a6060-bcee-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678196624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196624, "uuid": "b84b8e4f-7594-4960-9df8-14afe4e99b8e", "comment": "Malware payload (SnakeKeylogger)", "value": "d277b297cc5986346fe1f608334ec14c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196624, "uuid": "8b875be1-fe97-4136-b234-47d0dcebf967", "comment": "Malware payload (SnakeKeylogger)", "value": "6b544118a7359252a4583f8bc147fef52e5f3215efde28e7be580ded3c8923f2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196624, "uuid": "17b4499b-0a20-4e90-9d10-2eed5cee02b6", "comment": "Malware payload (SnakeKeylogger)", "value": "62e03daf2cd05569ed10c0f45e297748f33f100d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196624, "uuid": "207db8c3-725b-4923-9055-e8bc1c61c94b", "comment": "Malware payload (SnakeKeylogger)", "value": "3a0675799435ff35679f0a94cb228d79ad5a129b1391f814eac6a5899fa117c44c03171c4ed39bb3c88088ec439ecb23", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196624, "uuid": "e689a545-e51f-4667-8c81-585043a5ec0d", "value": "T1E655F10391389E4BE102CBBCBA6F7859110E7C3671D6A5CA354CB34A5733FAA59BF118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196624, "uuid": "9b7c3784-5d44-4d6e-bb19-c34410134dbf", "value": "24576:9LKqTB2QtHlxGWQmmav30xffFBDMtHlxLWQmmav30xC6FOo8XSL1kKtbTf:9LKGwe77QmmQ30NfF9i7qQmmQ30Y6RUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196624, "uuid": "dd25b6df-a7f5-4dd8-8524-725777484b97", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196624, "uuid": "d6d012ce-7c3a-4cd3-a253-186f5e69238b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196624, "uuid": "633acfd6-680f-443f-9c4a-bc200129c53d", "value": "Payment Aplication85748.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc510975-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678195725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195725, "uuid": "52c3387b-17ec-4d7a-bbba-07049474a398", "comment": "Malware payload (RedLineStealer)", "value": "311172506993092d19d2864223e5782b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195725, "uuid": "3780d73a-a416-4540-8350-646b38313b44", "comment": "Malware payload (RedLineStealer)", "value": "6b5f42c5333f844eab55e395ab585f8c298f70e52680947b9e58b4aae888291f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195725, "uuid": "a8d2b87e-d9b1-40c0-8b55-18255086673f", "comment": "Malware payload (RedLineStealer)", "value": "3c46d2571f9f9d279dd50d101eaa51142476fc75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195725, "uuid": "b4cb82b4-c668-4ee3-a75f-7b746707966c", "comment": "Malware payload (RedLineStealer)", "value": "50bdd418e7d232101a1a1e1e92cb79e7766c19b265f53b5322a637d3c5df19c26a6137b5a7aad918cc7c3aea5c62eda1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195725, "uuid": "52e1e182-4b04-4718-afc2-2d60402a30ae", "value": "T14374F021B6E0C473D6EB01706838DFA46E7FB8726E36C99F3764069D6D306D059AA313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195725, "uuid": "74ec0e73-c2e1-4a3b-ae0f-118efa7c331d", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195725, "uuid": "43051adc-f424-40e7-a153-e8500dd95bb7", "value": "6144:ELnKk9C5R7BKKC/7F4xpQt4IaNZ+ninBCes4eZ:EDKk9yjO4bQuIa/XBCeGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195725, "uuid": "dcbdfa61-efaa-4026-9d53-0e08a26ca3e3", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195725, "uuid": "f1a01772-75fc-481d-9a87-3c2cb7632683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195725, "uuid": "e3f89849-9e77-4146-b054-3810e8fc6fa1", "value": "311172506993092d19d2864223e5782b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d41a5c3-bc84-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678151139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678151139, "uuid": "b7b86b99-e656-495e-b797-457466f9b662", "comment": "Malware payload", "value": "3f0781068ba0307383f3c526f73914a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678151139, "uuid": "b49e7b9a-6d48-4839-b79f-bd896a34aff7", "comment": "Malware payload", "value": "6baf3ba246bd9be5693c717148398e11bd99e05931497a576d89a5010129192d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678151139, "uuid": "505babc8-2e69-48c1-afd7-b1445e7eb523", "comment": "Malware payload", "value": "f388b4dce44ab89bd615400595167a8b24ef93c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678151139, "uuid": "8a60aa14-162f-4cb4-8f83-cac29e9060aa", "comment": "Malware payload", "value": "34f3d1100fdce4a5475855bd818453fdb97aac892bbb7b07f9f227d0debcf9f9c4472bf0b72a653ab56dd1edafcfc786", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678151139, "uuid": "07442f9b-d494-46ad-a1fe-e6b8c07f3311", "value": "T1C112E95FBBF84A62F27F8770D9B185602772B985A923C75E1CCC814D5C723044BA0EB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678151139, "uuid": "b5f48519-27cc-44cb-a430-7f4eebdd9ca3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678151139, "uuid": "32e15308-4591-47dc-8095-35d01fff116e", "value": "192:CJsrHg8GMaQDM87v9LOaGzAThlzKgnuJoIsIWX8:CurA7k7vlOaIAThlzKgJzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678151139, "uuid": "175413c0-bd66-4449-ad23-eac954a8f069", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678151139, "uuid": "a53a47f6-d5c0-4419-a8a6-e952f08467bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678151139, "uuid": "337c7f9a-9cfe-4931-bfd2-e91f9f045bf9", "value": "3F0781068BA0307383F3C526F73914A1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1f9bf5-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198756, "uuid": "2e9c9335-014c-4196-8b88-786d922c7f9f", "comment": "Malware payload", "value": "ca175be84a9f3e7b4f485a2e4e0b20c7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198756, "uuid": "a20eca36-5401-4249-a02f-2e0c5d9e1a0e", "comment": "Malware payload", "value": "6bfa5b96a28c4e373b4a3ffef0bd7df9db4c0b32a3a15649282e31d2fd25b0fd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198756, "uuid": "2b5359a0-589a-4c95-b43f-ac0cbfb73d4e", "comment": "Malware payload", "value": "40574aa3e2be22cbbf0481ad6f0a3feafb2e2871", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198756, "uuid": "595d9500-6aa9-494d-b869-cda0211bb685", "comment": "Malware payload", "value": "32888f8f5da53c51760590fc18bfee9d5c1204ae30421b184e0a2780db18ab3219fde781a9d3b55f767a2001f3586913", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198756, "uuid": "1dea4df6-f5ba-4e4c-bf5c-8ce5624ed402", "value": "T1EAD47CB19D0C2551CA3E9E67BBC20DDFC7604F1422130D3A5AE8D6B95B4F248EB6B60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198756, "uuid": "507b7523-fc20-4091-8687-05f3adebfb93", "value": "12288:zFmUP93dRscmnHgqjBZJLpnmDwYihuVpOSDPNcLrA6xv/:zY7Hga1m9s+SI6xv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198756, "uuid": "0e881110-9022-45ff-941b-c5352154d551", "value": 642184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198756, "uuid": "4d0514d6-4878-46e3-bab3-c2004f224a6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198756, "uuid": "c89b542f-cd6b-4aad-b060-fae4256c04ac", "value": "Suministro local_signed.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb28563-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678196133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196133, "uuid": "f77b8e4f-87a0-43f4-ab2c-3b13fd465630", "comment": "Malware payload", "value": "91ba842bf6b70e34b3c1a2dcc3834a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196133, "uuid": "1816f635-e622-40f6-bed0-d43b605202e3", "comment": "Malware payload", "value": "6bfaba7f6d10242872a5616340c1e6beba3b2d285d59ed79b63272ea1f2c968e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196133, "uuid": "e53dffc0-5bc2-48f9-86d8-445433a29ed8", "comment": "Malware payload", "value": "31152f8de83caa156efde918d83c5c6597822ce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196133, "uuid": "55eadcf0-fc85-4d2b-891f-01f007c663ee", "comment": "Malware payload", "value": "11e8da8248dacf20b6a3ea607fb39e19b07cb3f52bb67d17254495ccf146eb8bbb824b6d43f25960efb964785332cf85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196133, "uuid": "290a8b70-ab97-4a69-a552-84e468f3ac2b", "value": "T10815AD1436FB500DF272AAB66BDCB5B58EAFFAB2153A74B6204E03064703D10DD5277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196133, "uuid": "06ce9bd2-e1fe-4bc6-a523-de3a359f4562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196133, "uuid": "cf7207d1-2d22-4ecd-8b67-6a8427fa953a", "value": "12288:pR9UGLKgfkQ+Bv+sZDmcGJefWytVjec9JX37o78J0AZOODDsr:+2RLXe9dfZhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196133, "uuid": "e464d577-630c-49c4-be66-1e9098786be7", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196133, "uuid": "f78c8281-b591-4ca4-9cd4-d5d7c4b4a52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196133, "uuid": "34ab5fcb-611e-48bc-8efd-e4c6aa4c5f6e", "value": "91ba842bf6b70e34b3c1a2dcc3834a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b10bfc-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155425, "uuid": "2aa63205-9653-4802-9bc2-6deb86bfdc28", "comment": "Malware payload (Mirai)", "value": "9f467c4b4273506e7f4c7115f8995414", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155425, "uuid": "14cc6e45-3683-4a39-a60d-6b1c6d29ee34", "comment": "Malware payload (Mirai)", "value": "6c7ff11eb264819d6deb5af1687b04c0816c21382f4dcf4ca53558a907a2af04", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155425, "uuid": "2f132d8b-5cc9-4720-9dfd-a657ce8c0246", "comment": "Malware payload (Mirai)", "value": "c724988b30c3640461ad95b5781bf13f827f4fd3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155425, "uuid": "327eb0ca-813b-4705-b2a9-637d588fa56f", "comment": "Malware payload (Mirai)", "value": "9a8bb2ff33eda4e4c7dfb9a4d9d6d990ecd8433f514a7a29f016c7720c18ea65c845068d19ce2516d3fd337bbd4cca5b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155425, "uuid": "ddf91be4-44b9-4ffc-a11e-14698f827f87", "value": "T129431955F8818F22C5C4127AF92D128E331367E8E3DFB2139E216B603B8696B0D37D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155425, "uuid": "c9d65030-82e9-40a4-a84a-e517407b3378", "value": "1536:V4nR2ibzL7lA3zp6ezfTTgwqzuIziLp+yhd/:2zvl0Mafjp+yhd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155425, "uuid": "1d11b62d-a896-4abe-8218-66069a9c6f2c", "value": 56168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155425, "uuid": "cf2f5a7e-4377-44dc-a6d1-ed54ac0c607d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155425, "uuid": "85e329f3-25f6-4185-8767-f7c2e814af20", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65e5c2b-bcd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678184870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184870, "uuid": "01b44943-dc45-4c3d-b881-703cd997c29b", "comment": "Malware payload (SnakeKeylogger)", "value": "4d5347cd6edbad9c467080f19bb542b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184870, "uuid": "6839d2ad-433e-4e2b-b746-f788dc0ce037", "comment": "Malware payload (SnakeKeylogger)", "value": "6c82b21664ffc3883933ae0a1610bd5b5126d1ace96e434bcdbbe40c78de6e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184870, "uuid": "9bee4d51-6688-4a1c-897b-9503d06a93c0", "comment": "Malware payload (SnakeKeylogger)", "value": "59c7ff6bd76d8e15e26d152dce5bfab744a30d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678184870, "uuid": "77cb4e34-43bf-4811-b81a-265c4ea462a5", "comment": "Malware payload (SnakeKeylogger)", "value": "4524f54fc63bde9bc05beae102478199011238bfa238a597d760b8730a42ba1a15212f01cda609cbe34a61a29e08c665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184870, "uuid": "f1f5f487-78b6-4de5-8374-10ecd1d66703", "value": "T155D33A45B6F9CAA2C3D82B76E9F144140B78EE86A417F74A36C832D74837B66CD42707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184870, "uuid": "8ca9ccf1-1d2a-4d86-8e76-ec1c9d67f26c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184870, "uuid": "dc72482f-9164-453c-83a6-486c70851bfd", "value": "1536:g3vki0es+8SPP/YntWWDXGeSo1utJcuKlKclVVNG6bTKW88BAeh6SdyPU5SA+Oa:g3vmSX/Yt/ieSqufzKtV66qW88ne6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678184870, "uuid": "cdba9df2-0238-4117-a97d-8e86915c4c7d", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678184870, "uuid": "e1d85c60-2f80-4deb-8307-7dab76393181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678184870, "uuid": "6f5f095c-b6f2-464b-b4b2-61fb4552380b", "value": "SecuriteInfo.com.Win32.PWSX-gen.10656.28343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caa0ec7-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678198839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198839, "uuid": "dc79f678-8b52-4815-ad2d-74c77caa772a", "comment": "Malware payload (RedLineStealer)", "value": "28ab6774e69dbd34501c56c4418d43e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198839, "uuid": "d4dfaf3e-2418-4fc5-ad01-e098aac3bd9b", "comment": "Malware payload (RedLineStealer)", "value": "6cb970a364762e0d4f96aebfebc096fa08059156ec5fdd9f6420d046a5e8bd55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198839, "uuid": "eabcb47e-8bad-4647-aadb-87a76a16a054", "comment": "Malware payload (RedLineStealer)", "value": "465b710ff73fcba0a2cd734ea02864f521c9a290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198839, "uuid": "8d6935a5-1a5e-438c-a341-47a17a1cfa5a", "comment": "Malware payload (RedLineStealer)", "value": "ddd225815109d7253fc7c1dce9b6c7e84c4ffb702eade5ffda60f801d25a59d15b5dcbb651a5d80043857dadb302c642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198839, "uuid": "65eb2b5d-0f8a-4641-a9ac-42cef21e238e", "value": "T152C511D21E88FF97E9C248B078E67B2A8934FF5A55CB035218273CB99974F05D28835D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198839, "uuid": "b9bbfef3-4cc2-4629-abcf-d04560f3607e", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198839, "uuid": "0cd9162d-b230-433c-8398-b89b8089cbea", "value": "49152:Eu2OP2wDefmF5hH0sIacQXlof/4LG9/aNIx4M1h+0whzrOkMK5Irr:EuRDef8hpofALG9/R1E0whzrOSCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198839, "uuid": "2822333b-18cc-4034-bb0c-c8ca2a67f230", "value": 2717488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198839, "uuid": "8c56f732-dd93-4301-818f-3f5f66ed56f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198839, "uuid": "8c9729f1-3d85-4f20-8834-2f5e1a7d9b03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932aa02b-bd2b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678223036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223036, "uuid": "76f756c7-9c8e-44b8-b35e-3dec73183ee5", "comment": "Malware payload", "value": "2a10eccfead0c89635df6177b1cfa325", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223036, "uuid": "57e46e67-360a-4f07-8e44-0e62a30d62bd", "comment": "Malware payload", "value": "6cc3f1d076d8c44fb55dfa11c94936fba23153c72402d0ff83733258e7c425c2", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223036, "uuid": "77e63dec-a5a3-4651-8c51-e05d0ae59fd4", "comment": "Malware payload", "value": "180974ded6a1eb48c2f658740ba55789ecf7c99d", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678223036, "uuid": "f4febd01-69fc-4722-bbe5-3d758504f53f", "comment": "Malware payload", "value": "61ced804f8d5818135c6def0fec1c4c69be0d7fc9302e8e1e9fff00855dd37a6e2f5b64f1429b876a1742accc9a73f7d", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678223036, "uuid": "7d1bb570-78d4-4956-bb4e-0ef6cf66eeb2", "value": "T18094235BD7A6E08A636F9F430AF349B003DF61F7655F1694B1871CED2B81C2839602E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678223036, "uuid": "a1ff2761-70e2-4460-bff4-4e8f782ee4f4", "value": "12288:ldasjTmuF0izskhNby8ofzEtj71hi+Pf3W1zc:lgeyQ0EhU86EtHO+PvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678223036, "uuid": "526dd598-266d-4dea-b103-6dd6f1007120", "value": 415746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678223036, "uuid": "24c00b26-fdeb-4849-ac57-de7f1fb5aafe", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678223036, "uuid": "8c36f734-bdcc-4257-9b23-cb89ebd63695", "value": "pureland.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40224e7-bc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678153594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153594, "uuid": "ef63e862-d7de-4c32-a1d8-f2cc38297264", "comment": "Malware payload (DCRat)", "value": "db1128cf32902770d5b0075772bfc0b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153594, "uuid": "9cb419c0-a279-4e56-a2cf-eb1adc0efbb4", "comment": "Malware payload (DCRat)", "value": "6ce245fd3d94b9991859e083846e494e52db165058269fea683dddfe0a07b245", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153594, "uuid": "85776ebf-a990-4c58-8f5b-d9edb3698f13", "comment": "Malware payload (DCRat)", "value": "f3cbd4f8d552b70fed20e3545e644f1e8263bd17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153594, "uuid": "cd721d1c-4311-4f85-b538-81b6bc9836ce", "comment": "Malware payload (DCRat)", "value": "5934590596b6db66d45e8f135c070d1f777e413821eda8e6d6fdedd1225b3a401e180121a14ec5c704e8a8f0594b9a8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153594, "uuid": "f1cde411-1d03-452b-840f-a26f97e1430c", "value": "T16565AF79FB0B9722DEE97374C0FF5C0C93A06F7352929B05288998E45F4D39A8705B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153594, "uuid": "7ce77823-7c12-45e9-97a6-9e3008c364e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153594, "uuid": "7c0ed1d4-1a60-4ede-af46-d5e7d2385d02", "value": "24576:wvWLTX42csMDyYfdJ0EkFXwP9h9ujRGb3o0j/Le3jverNrHoV:/Dvy2EE8ujRGpTeTANk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678153594, "uuid": "b84520ac-ed41-4e1c-8ce8-096ce4503bf9", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678153594, "uuid": "81dd59b2-6ec7-479d-b469-a8527f75de45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153594, "uuid": "69eff974-337e-4cca-9747-3952e37d5198", "value": "db1128cf32902770d5b0075772bfc0b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da537b28-bcbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1678176770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176770, "uuid": "cae23f03-2e44-4aea-b39f-5d3e0c164990", "comment": "Malware payload (YoungLotus)", "value": "34517f9ebbfdc93ea5590bdff48b8c0b", "object_relation": "md5", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176770, "uuid": "b5ac1656-1e98-45f8-aeb8-5820c75e211b", "comment": "Malware payload (YoungLotus)", "value": "6ceb50da4275db929de139517ee96a5617ca2a8dead8db120d4f43a467f2fbf5", "object_relation": "sha256", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176770, "uuid": "74172f92-5259-4b71-814e-4c265185cc64", "comment": "Malware payload (YoungLotus)", "value": "0b3bd7d712b9a620c862519b515d53636b19d0bb", "object_relation": "sha1", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176770, "uuid": "506c94a1-917c-4f70-a6da-cb8de7ed9a3c", "comment": "Malware payload (YoungLotus)", "value": "c5e730b304387b0a6c128efd0855e610f88b47a1893874d3ae080fcc0a49bd4c45fca6a1214ab19338c178f58e2b5467", "object_relation": "sha3-384", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176770, "uuid": "1154038d-ff79-4333-b11c-aa9373a0651a", "value": "T12E65E0519E58D4BAE3A90CB090E1E65CEB7568720D2EC8179BF214FC67BBFAC3C15241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176770, "uuid": "e9b8fc4b-38b3-4ac0-8c4b-8849e638f649", "value": "8f54c7f89ab7fb80e3cbd057af48cb19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176770, "uuid": "91598ed3-ba3b-4ee3-bab3-8744a2c84bf5", "value": "24576:z9Pdh1k8BKSPzr//PYp18m27hly2tjrPAU1th7ERmVts112HvUU9/JPrThakPTc:hPdhb9//M8/yEsCERL2HvUU7zFakPTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176770, "uuid": "2c6b2e3f-8f31-4c1c-93db-43c4113775a4", "value": 1445888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176770, "uuid": "a5b247f9-30b1-4f00-8714-017696ec07f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176770, "uuid": "e20bf5fe-0587-4df9-a4e2-f532f9db3f9c", "value": "358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22855970-bcb8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678173455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173455, "uuid": "afbad812-2ea2-40ff-8138-9aa6f1679838", "comment": "Malware payload", "value": "763392481eb7481b63f34271168821cb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173455, "uuid": "533bff25-bbdf-4aca-a900-e47dcd74d4bb", "comment": "Malware payload", "value": "6f7e57ed7239905fafc3947160b5fc89ad615772d2a694299999d2fe080453f4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173455, "uuid": "f037c381-0893-4dfe-9163-649d29206c74", "comment": "Malware payload", "value": "d6fc3b5cc2e8a4964c4858fd515e9566e28aa29e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678173455, "uuid": "74ffccf4-0033-429b-ac94-ab3ebbbf7745", "comment": "Malware payload", "value": "4769886b9878a58cc17c66494668a8fc7689fc94dcdae09ff06e46a89a9af95856de8945befcf3d1eddb2bfbb099986f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173455, "uuid": "2e6fc006-7620-445e-a37f-0d7673182a50", "value": "T1CC361243F7DAA92FECF3C3325775562626168C658703E6871904B27C18FBAC44A86FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173455, "uuid": "7ef3f0be-62d9-4215-85f9-f14487d7e608", "value": "98304:Av+dv9EEgB0Nbb3EX4cgY0RDNHApXnUdBtE6F428QdWET4CfhjCzOSr:AvC9AB0NvEXjMNHanMBtEM4cT4Cfoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678173455, "uuid": "332f7ede-d97a-4d3d-8b29-b66835a4e5c4", "value": 5171410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678173455, "uuid": "09a9396b-e3e4-4469-824a-4e71dff6b6db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678173455, "uuid": "f649aa0d-1ab2-4bdf-8a44-d680e4c406f5", "value": "Aras_Kargo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ba6e32-bd28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678221779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221779, "uuid": "ef45f280-3cf0-4db5-8449-b38a80033435", "comment": "Malware payload", "value": "928e37519022745490d1af1ce6f336f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221779, "uuid": "06026a7d-80ae-4a59-9a16-f4cf44535ba9", "comment": "Malware payload", "value": "6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221779, "uuid": "b442e960-099d-4b02-91e6-761b783a98b4", "comment": "Malware payload", "value": "b7840242393013f2c4c136ac7407e332be075702", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221779, "uuid": "9e5eec68-db82-4440-b13b-5dba1b40eb46", "comment": "Malware payload", "value": "c483d003a7b08a7387fd448476c01a2b20edab831112d6dad4c3a66bfe5d915635c76f43dad370d4dcc9b55be6bffb5f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221779, "uuid": "2d3598de-9d9f-4d1f-adbd-328284344653", "value": "T1B6C63313F5905A31D9522A308D79AD34653DBDA14F255E83AB71780D03290FAEBF83E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221779, "uuid": "96b30ff0-0230-4099-8ecf-0541c307267a", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221779, "uuid": "8b558b7e-2cda-48fd-be0b-258ba62af81b", "value": "196608:JZnMy97vfgla5NX7YaP6uIEJsp+jb4agYSUpHm6g90MrYmhZZoG0tLzr1+W:LnMy9rfma5NrYaVzC0b4vpZZoG0tR+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678221779, "uuid": "abb1a124-aab3-4786-839e-a3d6b16012b6", "value": 12056150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678221779, "uuid": "65c5d97f-05a1-4c9f-849a-6e5c4b3e97ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221779, "uuid": "c0afe06b-6a43-4f00-925c-7201b5974a78", "value": "TestingIndoa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbad9d6-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678192853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192853, "uuid": "4a14263e-c358-4ddc-b544-f3e44bb0165b", "comment": "Malware payload (RedLineStealer)", "value": "307ce80121e9db63857ffbcc6e6f413e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192853, "uuid": "6f09378f-ed80-48f0-bb66-515fcfd0a193", "comment": "Malware payload (RedLineStealer)", "value": "70b1cf50a59c123dacf50e8f9356e0b65c850e05aa2511bb8d5556b87ce12f8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192853, "uuid": "60b500a1-1ee2-4d95-a214-6f459aff2000", "comment": "Malware payload (RedLineStealer)", "value": "9721de97ac9d1ff4b6224fff96700acdc2a51984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192853, "uuid": "746d80f9-aa48-492b-9bbe-fea8d603e91d", "comment": "Malware payload (RedLineStealer)", "value": "0fc3c75eaad824502802007b9259de84a86614b0c860dd5aa64487ec54dbaa5bf324a90490ee9a3ed7c98bbb9de24471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192853, "uuid": "0d10c587-0665-486c-b333-9c9915138783", "value": "T1782412036FA4D477E1F61A312E3B8776EFA2DA036CA6960B13405F5572233528A1FF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192853, "uuid": "758daf72-b0e8-4ed9-b607-aa11e41259f0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192853, "uuid": "81dbac8a-87ff-4f59-bc9e-298876d43f44", "value": "6144:PYa6O699YTGIehAlmP4+LOmt4qTGu9E2kw3mP:PYA6OpeK+LO2TT/91k/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192853, "uuid": "d40647e6-cb81-4f43-8f3c-016e71526cf9", "value": 211627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192853, "uuid": "418f723c-4754-48ae-9f91-19e6ff037cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192853, "uuid": "c9fbfe06-8964-4670-8d73-d8fa196ff508", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4a709f-bc95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678158463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158463, "uuid": "5668e7ad-e47e-4d61-b2ff-22002bad4110", "comment": "Malware payload (Mirai)", "value": "7de96ce2f1c4f6a3ab9a44fd6be24ec4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158463, "uuid": "131e5313-fb74-4200-a2cd-c8876e48d4dc", "comment": "Malware payload (Mirai)", "value": "70d74e010963bd5e26b6f4a9262399f67760ae6582eb20d962e412eb11b391fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158463, "uuid": "7590a654-c3cc-4c7a-bfe0-910bc94b9e1a", "comment": "Malware payload (Mirai)", "value": "8994880c6e640eb42769a87afa7f820443fb2390", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158463, "uuid": "aeac6fe1-71ef-4ad4-b685-7255259a3f8a", "comment": "Malware payload (Mirai)", "value": "037b84c69d23336a56320b271a162df92636b2be81c99d218851e162457ce3b2a04ebfe1e1feb47274cc206089e48567", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158463, "uuid": "3a0615de-e901-4c53-9dba-f1b1c938f34e", "value": "T1AB232A25BA761E17C0D1A8B921FB4B28B6F146CE26D8CA4F3D720E5EFE619445403EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158463, "uuid": "de9b1c06-1b98-4617-b473-b26489cf18eb", "value": "768:hKo8Vs0oy20Iqbxvt6i8AP+qLaRC2eQjAO+75EY0wD:hKt60oyDb6i8AWqLijeQjKdfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678158463, "uuid": "a0079c1f-cf03-4163-9861-e95b1d7113d4", "value": 47456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678158463, "uuid": "caaffa98-47d2-4de2-9af0-e51f3a90135d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158463, "uuid": "670ed06f-4876-4bcc-be86-fbd43249bb6f", "value": "7de96ce2f1c4f6a3ab9a44fd6be24ec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c450fcdd-bcf9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678201644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201644, "uuid": "32531f15-6090-4dc8-afbc-02cc51e549c1", "comment": "Malware payload", "value": "01d648ecf27b3e9a6415af8fab167ac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201644, "uuid": "a057f87e-462e-4118-814d-eda0694f86fa", "comment": "Malware payload", "value": "70ebead6ea8cac65cb1fccb593f7751c6f9ca56333a828d7ce1f9b5c4e23f47a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201644, "uuid": "727447f5-6bb9-4bec-8cd6-9f2ef79db714", "comment": "Malware payload", "value": "f5dc1bafc8eb5bc34166d8a7beecc3f1e5f99d29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201644, "uuid": "cf34671b-a320-46db-8ba0-656975717729", "comment": "Malware payload", "value": "5456d47c85e637beb55763ec871e98299585faa44a8867c13c24ece6297b427a54329a223b1fcbc887ece1a232a63710", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201644, "uuid": "d9e6e024-755e-498a-b948-464d80a20a48", "value": "T1A6E4D63AAA1604D6F56C0AF006AD5EE1B86F1D3BC98108517FCC7C79A4B0EB782D4767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201644, "uuid": "f22cae8f-f8bb-4d8e-b20b-46c7d22bc76a", "value": "039032eedb13fb00811bf4343043c31c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201644, "uuid": "ff45ac5b-1085-4355-a756-5afd638d7803", "value": "12288:19HFJI/fb/r6WEc0YqxK72b3VrX05jtPXqRTLn57I:19H/I/fbuWEc0VxKSb9XMtqNLn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678201644, "uuid": "d387919c-3bcc-4e6b-911b-2a37b81278c3", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678201644, "uuid": "467489aa-87e1-4ef7-b8f9-a434cfc6f8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201644, "uuid": "1cbefe8f-5c1a-475f-a1f6-cddd8d355653", "value": "01d648ecf27b3e9a6415af8fab167ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e211ae-bcfe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678203707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203707, "uuid": "9d2b2eb2-0e3d-47d8-99fe-6d0293c1d5e2", "comment": "Malware payload (Heodo)", "value": "b4d9ac56942fb6ab57cc28b947c7d278", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203707, "uuid": "e186f76b-95bf-4af6-9b82-47cbda9f6562", "comment": "Malware payload (Heodo)", "value": "710709a200a5cda2a4293e9de521ab65d23170ab8bca04c8c7af22f86091d5d7", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203707, "uuid": "055c4b80-2f75-4e7e-a7ba-68d33bd57fb2", "comment": "Malware payload (Heodo)", "value": "171ab143af60b540b8aa0b1197c6a348f59d3627", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678203707, "uuid": "6556b9f5-d36e-4eed-816a-f408a15cc271", "comment": "Malware payload (Heodo)", "value": "5cc22fb2e3a9409957634a910590660ad92eb9f56be2e57dd5a2b24c160739b17b46492ddb9b90f3a0ef562899a3bc4b", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678203707, "uuid": "4edf2ec4-3d46-471e-9c17-b240ffd6150d", "value": "T190C3120D26C0901C1079F4ABD97373F3151FFA5F26BADC42A974B1696A83032BC597AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678203707, "uuid": "b1caacd3-f58e-4596-ad3d-4ce4b9db247d", "value": "3072:5WFzVmFLqGKCSGpu84arlZF3/FWI/GhdMy+EOikEefP6jWiY:YB0q6PMarfFPEIuD+EOiHefPWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678203707, "uuid": "c6716c8a-6506-458b-8098-92e4b1b6e853", "value": 126413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678203707, "uuid": "235c8a9c-b5b4-450c-8d97-9aa33ed4f39c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678203707, "uuid": "adb2824c-ef5c-451a-84c2-1629a83b7a96", "value": "INVOICE N L96505 03_23.zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d39b53a-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198545, "uuid": "c9b4dbe7-8111-478e-b9f7-8f59729c51fe", "comment": "Malware payload (AgentTesla)", "value": "f52ca7ec12ee4c905fd0c8888707076d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198545, "uuid": "6abcf797-1f18-4d3f-ba3b-49a753421d21", "comment": "Malware payload (AgentTesla)", "value": "71769693e34bd0116c96d55e1ec5f96090d8c1d38f1e037a83effc9de785f52c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198545, "uuid": "798bceab-8805-4f7e-963f-058730ce7081", "comment": "Malware payload (AgentTesla)", "value": "05a60c21dc8ada56b848dbf8487cf371a0d2cabd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198545, "uuid": "378900ec-f26f-419e-9089-209e775306c3", "comment": "Malware payload (AgentTesla)", "value": "b2fba360a63bce51a9441b3c1bc4d3c37476ef5efaa46cf8733309a459bbf762cc5d8bebab8e7f83cfcc147dd073f4f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198545, "uuid": "ea94e837-511b-4ed7-9095-729ed2225e9d", "value": "T110F32A6CB2C98B52CF1D43F4C5A4114806BAA1835707E79D4EF1A8F63E4A7C3362EC62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198545, "uuid": "e6d357cc-0532-4d0d-9d51-23e783091486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198545, "uuid": "7079d900-fbc7-4c18-9d45-94aef62462ba", "value": "3072:ttNfVyEUVz1KlZwToif4pqRFrGOda+5ERhdQlI2jsv:GEOZAGULqHimER7AJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198545, "uuid": "c589965d-6c94-44cc-aea1-aaae553f8bda", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198545, "uuid": "b6e9da4f-60a4-4669-9047-0017b7ad71c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198545, "uuid": "7ffc427d-b1d4-4a3e-b9c9-1cd6608677d2", "value": "71769693e34bd0116c96d55e1ec5f96090d8c1d38f1e037a83effc9de785f52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f0689b-bc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161682, "uuid": "f14e9db5-7830-435f-a0e6-de9f72488730", "comment": "Malware payload (Mirai)", "value": "014896e4fc89d10a9e120c05cfab8cd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161682, "uuid": "8f4bae22-b28e-4922-bccd-879395951d55", "comment": "Malware payload (Mirai)", "value": "72850984d5d647d398d40d55a017cb3d7f11361263833b815c9a7a649e05204f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161682, "uuid": "4ef2754a-e1d7-4391-ac2f-fc8893961135", "comment": "Malware payload (Mirai)", "value": "4533f48e031b429fab22d3168e1dd962475b6b7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161682, "uuid": "3afa61b3-53e5-487d-9849-4597cffd0eae", "comment": "Malware payload (Mirai)", "value": "439edc16952793c8d73ebeefbbee40f557eb4bd67afa879bb71377f23fa367436400bf5f97ba4b19d5f98724676ff615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161682, "uuid": "00dbb0a1-e3c6-4a5b-a9bc-00df971cc4e9", "value": "T1EAC2D0E07726F931C420AC3EE52B4D893A51067C91FE353754258C399FC1A9B63E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161682, "uuid": "1e66f8fb-8dc7-4bc7-85a0-ef2e7824a23b", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwr9p9q3UELuw:oKy4qfqoeJdXWg9cLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161682, "uuid": "f36d0813-6593-4b81-89db-82ac0fedab0a", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161682, "uuid": "a2a632b2-7365-4cf1-a1fe-e34b7ee8834a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161682, "uuid": "15414d1d-c358-43eb-b9d7-11c70eddb5f0", "value": "014896e4fc89d10a9e120c05cfab8cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ceebfe-bcee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678196627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196627, "uuid": "4176e573-03f6-4a4d-aef9-d1fca30f26d3", "comment": "Malware payload", "value": "7e324ad221a928e66e725c4638873b47", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196627, "uuid": "e610b5e7-68fa-4011-a473-d3e24adaa13a", "comment": "Malware payload", "value": "72ea1111e8a308b6bb63dabd041b1d4eb93ccea0668b8cc8feb992999b62feac", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196627, "uuid": "49fef6ca-82a6-41ef-8659-15d1fe0724b5", "comment": "Malware payload", "value": "8efee6f76f9a42d701b76d24d82a95c0b3cc5abf", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196627, "uuid": "05052fbd-36c4-4357-8873-cc2bbb9308db", "comment": "Malware payload", "value": "35e4259eb1fd2d7c3aeb6641ce77e7e2acdd601c3b33d100c48a0cb3abb1d2612b9c7dbe2a63e73fd2df97be17e23e70", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196627, "uuid": "d961fcd1-3ed3-425d-b3ff-6aca844ced4e", "value": "T113B4220372AAFF63E543DCF41CD9D58B9C68FFB4AE92801B3192B30FA5397015A41A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196627, "uuid": "158b81d4-1519-4e86-a4bf-e84cc745e56f", "value": "12288:0NTzbUne9nV2v/2RBoFxPeDS8nqHaToGiBnVH:0NvQne9nGKBXS8ua0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196627, "uuid": "4d41099c-429e-49f7-b319-97adc58f819e", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196627, "uuid": "d540bff7-7466-4fde-bd80-6bfec9e6ff9a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196627, "uuid": "bd2bfe1d-b4db-403b-b3b5-405c25eeae13", "value": "Hesap.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c69896-bce6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678193451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193451, "uuid": "0f923447-4493-4550-81e2-a45a2248ad13", "comment": "Malware payload (Formbook)", "value": "63897474afd6771fcdc9ef3493edb0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193451, "uuid": "89958513-2149-4c1d-be2b-0717e4cc609e", "comment": "Malware payload (Formbook)", "value": "73624ae2b5f9c832e8f71ff90cc73ea7c3c34ff7813fb1181659dc1202493ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193451, "uuid": "b8640c94-9715-4797-84db-1750fb73d3d4", "comment": "Malware payload (Formbook)", "value": "2bfebbe064739a51e0971db115c9a5b592bc8332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193451, "uuid": "97663a49-b026-4679-b355-cc041af87465", "comment": "Malware payload (Formbook)", "value": "0c58b3dd0ece89db2f53c624966da9359779f290a2ffb6fd839b685535edeecd8bac2dc6791be7427228de0d07dcffe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193451, "uuid": "0e457b0f-503f-4123-8d11-e88d1f4df5af", "value": "T1F0159CE972E1E239C8148230AAA67C3043F15DA1DD71E945FDDCFAD48930EF62F6164A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193451, "uuid": "9b9af877-d47e-44f2-910e-bad198bf97d2", "value": "12288:en7Wy8ptDBiyJwRgPtqcLhnu6+BsNHSyCXvpltbyJJygiBH8VHATX:0Wy8pt1iywgLL0TJy4yJJVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193451, "uuid": "694eb82f-433d-4246-88ec-a2bcee3b658b", "value": 923208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193451, "uuid": "794906fa-f802-4c66-b88a-e47c3faa0a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193451, "uuid": "31c3f871-7e39-4165-bd2c-c4db916f6c8a", "value": "73624ae2b5f9c832e8f71ff90cc73ea7c3c34ff7813fb1181659dc1202493ebc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251eb0bd-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155421, "uuid": "a7e2f23c-202f-4922-86d3-1b7d32b264b0", "comment": "Malware payload (Mirai)", "value": "5b489d589d24788565d7ba5a68b507d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155421, "uuid": "97917013-b086-4583-9566-379c35ecc9a7", "comment": "Malware payload (Mirai)", "value": "740c91739fd33093d8c8754fa5dd4fb87e4aa24f5e4a80ddfef5dd2e35997e1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155421, "uuid": "99fbb1d1-0712-438d-af40-f074f8208a8e", "comment": "Malware payload (Mirai)", "value": "89de69938ae571c2a14971566fa3f487f624e867", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155421, "uuid": "295ca984-55ca-4887-a5e6-51b85d402bc0", "comment": "Malware payload (Mirai)", "value": "53e3e70e3cf3f0d34ce1932ba1c1e7c126318faa42671a3612a996c7534a1faf777de1b551f62d3fd37f785f23b0d126", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155421, "uuid": "138f1a45-ad62-4a0c-860a-dddf55490d3d", "value": "T1B313D607F94285FDC08AC274476BB93E9C2A76FE1238F2A77BD0E7222895D215E1DC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155421, "uuid": "feba738f-aaee-4297-b9b4-8dc048e7f877", "value": "768:mAr99aONGXAMsoikTosgI45ZGl+ROX98AbdyMq/MTHNDxvG4A6Emb4Fs:J9oO4XAMsof0sgI45ZGl+RON8xxOFGx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155421, "uuid": "0f9b6804-dbfb-4a53-a56a-2369c2494765", "value": 43360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155421, "uuid": "776b3995-87f1-4f3c-bad3-b29631bfa994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155421, "uuid": "e620a228-a1ca-48b6-9724-29aa6ad0a81b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99be078f-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678196419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196419, "uuid": "92cf4e2a-4638-40cd-b1bc-336f84c4d6a7", "comment": "Malware payload (AgentTesla)", "value": "d78a9d6094814337deec16d021405148", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196419, "uuid": "98410773-b427-4ab0-ad08-73e0b4bd3e1f", "comment": "Malware payload (AgentTesla)", "value": "740e7b7c52b009a96ac47a0cebe652c6aa97803f0f2b73ace74aa4aa16d59cbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196419, "uuid": "f181b238-1aa1-4dae-ba3b-84bdecfcc575", "comment": "Malware payload (AgentTesla)", "value": "ff2acaf75cbb3db9b7e1752e635a19ee19eceb16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196419, "uuid": "b4a9eb3d-ae83-4a44-8692-1c2456f7809c", "comment": "Malware payload (AgentTesla)", "value": "0013043eb6fb21901be3741bff11fee91d6ecb170df2b63e9aceed2f7c45772adbd1b9658cc5bef921d156708d998739", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196419, "uuid": "d8b0dff8-030f-486f-8dab-de8bc0e37056", "value": "T194F33BE9928DD951D36D8DB8C8A1111806B2E17B5E17E75D0FB0A8F93F063C3762B8E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196419, "uuid": "3ccc1f08-df69-4b79-bcd5-34c5fbeeb1c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196419, "uuid": "987eb486-9bbe-4269-b818-57bb92ff0cf0", "value": "3072:CFOXnC+moKSjDVo9sUfDN9WYWMPtJ3175wGmJQNSrav2f:+OXFAS6LaYtFdwGmJcSGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196419, "uuid": "0c80628b-b8a4-4f70-8154-4d15e0f2b110", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196419, "uuid": "8aef10ee-a3f1-4fd9-85ab-a816dc33ee91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196419, "uuid": "3dee7e8c-9fb2-4e44-86c8-1a316ac198f4", "value": "740e7b7c52b009a96ac47a0cebe652c6aa97803f0f2b73ace74aa4aa16d59cbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199b759e-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175588, "uuid": "9d098ec0-c342-4152-a03c-22cb0c5afab7", "comment": "Malware payload (Mirai)", "value": "1992f7242ca8fc05adeb47a3ba6d6409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175588, "uuid": "0d42609f-4097-4af7-a1da-bc2bd90f19ba", "comment": "Malware payload (Mirai)", "value": "756f8a11ba1a15a98b305d9591b66c2148c9e5e59958b29d48cf5ec7ba963d92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175588, "uuid": "4605a547-b007-422c-8a72-706929c2cc3c", "comment": "Malware payload (Mirai)", "value": "ffcbb632a91d5d81f44e20e0c5bc0085b5764cf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175588, "uuid": "9113fafc-2152-438c-83fd-cb02fc2c0c4b", "comment": "Malware payload (Mirai)", "value": "1433a5967cefdb93c36f9672be4190c3e6ceeb89b16bfb8d9d996f97cc58c21865a03f60ea8e04eff8d9964afb8cc1e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175588, "uuid": "210dc406-f288-45fd-9b61-9cb8ab1cb4aa", "value": "T17A533B0137684F07C1665AF8292F27E4C3FEEE9010F4F584261FDA4A8635E37159AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175588, "uuid": "b645e936-20a9-4fe2-b105-d89d5c2d7f7e", "value": "768:gdovPjM3zJ2BSJkQR6BZRHCixlsRsJ7mcM6E+Famqc4+CmFTjOav5QUDaXAU6Pab:7S9P5wN7sV6E+FP7OEvuUWXtQme7Xxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175588, "uuid": "1aded9c2-20bc-42ae-bbf7-83780c20842e", "value": 62560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175588, "uuid": "8a2addef-a855-472b-8ef2-e6c4dd28c6f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175588, "uuid": "3d2259c2-562a-401c-86b3-7fc3f9d555a5", "value": "1992f7242ca8fc05adeb47a3ba6d6409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c1de25-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213458, "uuid": "d2e635c0-db5d-4c44-802b-84a3cebfd154", "comment": "Malware payload (Mirai)", "value": "5309281bd58131c3cc0c9e68bdfc6c5c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213458, "uuid": "4104265f-d260-4bac-bdf2-e38ef01739e7", "comment": "Malware payload (Mirai)", "value": "75ccb4fade3b19d0574d859667ef2d5ed6cf2071303a131aa8f8abb0fbb8852f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213458, "uuid": "d80ea271-c27c-407a-818a-d2a2963244ca", "comment": "Malware payload (Mirai)", "value": "2ddc0ac41c7a2c727190691ef0f3bd54b3abe2a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213458, "uuid": "f67b871e-4951-4eb2-92b5-461d8b10a522", "comment": "Malware payload (Mirai)", "value": "946ff1e298557adf79d322466c5d2a0ceba624142958c46b004d0dff07df81067ce8680b39f3dc6e4344c88750a7bcb6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213458, "uuid": "4d729f18-f848-47f4-9702-d9a2b7113a32", "value": "T1F1C32881A8824A22C5DA13BEF53D018D331627E9E3DFB1239D116F2177CA91F0D77A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213458, "uuid": "ab14f3d0-d0d8-4170-9447-0fa39273d4c5", "value": "3072:Hf/6rpkiDdPuEF9wZ9JwYweLOvChlNUGgaVvZNdwbZn:Hf/6lkiDdPuG9wZ8PeN5UGgKZfwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213458, "uuid": "8388ce2e-8a32-448b-9273-c37acd7c323e", "value": 125592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213458, "uuid": "fb69c46c-d986-4b62-b428-ba6a53ac5882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213458, "uuid": "d2e5b8a3-a29b-453a-8e3c-28e031b31eef", "value": "uYtea.arm6-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54c9e18-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678192707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192707, "uuid": "4b6a1465-4393-4ab9-bc5f-a311186c8326", "comment": "Malware payload (Smoke Loader)", "value": "8ccd0070c8ac5b05073d7986cd8dc95d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192707, "uuid": "51f8dd98-699e-4f2f-b8f7-15b081765503", "comment": "Malware payload (Smoke Loader)", "value": "779445f6c2102d76b0d4691aadccec01459495c0b09a451c084db77cd94403f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192707, "uuid": "8930235d-d2b3-4864-bb49-74600343fd26", "comment": "Malware payload (Smoke Loader)", "value": "feea58ed157c44fce624c9942e3d2cec38ed2868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192707, "uuid": "5f847f63-39da-4bc8-a8d3-b4a6b26c7806", "comment": "Malware payload (Smoke Loader)", "value": "f89873b3176996a82ba0238e96cb3cddbac2f786198f872b374f7a20893ba1426749361617b40699fa92b101bc20b9be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192707, "uuid": "2718633c-01a5-4bfa-87a6-9a0a30dcaa6f", "value": "T12244D02176A1C477F2BB60B099349BE63A7FF8322131C99B3794267E1E306D05A76317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192707, "uuid": "70c5ed3a-60c0-425e-8362-1432d7c2f71c", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192707, "uuid": "d1b50d89-bb39-455d-a450-3ad76c34f8d6", "value": "3072:PqYkGLi3sd8tdvvr3zFG3mMSIk9Vz/gIdE8cUVNIemICcTrAqoL43NzdyoDNb:iAL/StVmK08tVNIemMTeL49zdyMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192707, "uuid": "2472fe03-f553-456b-b980-e12232daca04", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192707, "uuid": "97568e68-57ec-47b2-8ff8-7b1c0cc637b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192707, "uuid": "2627cea2-1a65-4070-8234-a4e14153d148", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4003e7ef-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191973, "uuid": "cac5f76a-4f27-46ed-b41f-349f3a15d879", "comment": "Malware payload (SnakeKeylogger)", "value": "c9b3c3e7c687692fba6dc971847884ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191973, "uuid": "b198753e-db41-4a77-b9bf-a4ec9fa0ac78", "comment": "Malware payload (SnakeKeylogger)", "value": "77d6ae2c1312c08d5498931b983dc91a60721f86170ace8d47f9e3e33cc6bae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191973, "uuid": "9261354c-bfa0-4d4a-89ba-1995c5205e0c", "comment": "Malware payload (SnakeKeylogger)", "value": "f95d33866daf2231f99ff649b59ac1b6b34a1b5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191973, "uuid": "e438ec23-551c-4042-a047-4ccf4a3dd5f9", "comment": "Malware payload (SnakeKeylogger)", "value": "41afb82234344833362e94c50947d43664bf59360366a2b55c1dd50433d3d8ed47e8d60c55818fd57720c1f6766d52d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191973, "uuid": "52fc6efe-45aa-43f8-bb1f-0d5801a492e7", "value": "T101359DD0B6549897FB8B41F37C1A653165DABE9C6465C00C1AEA370FA2F3B11209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191973, "uuid": "db793985-17cf-411d-8a84-c8106f8e2f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191973, "uuid": "8227014e-6725-4333-9577-cb7c941125a9", "value": "12288:7+mbX3tcvZsmCkoKJ9vfV//7F5ttnWemGY5bQV7IaUbvO8Mak1Gb:imj96io7v5Bxn+rbdO87uGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191973, "uuid": "a1c2ce68-8edd-418b-a3da-21362b4d249d", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191973, "uuid": "9f2460d1-f26b-4581-ab8e-f46c4cfebfd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191973, "uuid": "7f069d9e-1db6-4f67-b0e3-e21af0da1aec", "value": "YPT23-99717 numarali Dekont-Ozkanteknik-20230306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ae0689-bcf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678197913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197913, "uuid": "2aa2b49b-8085-4cc2-be30-432fdf7ea6ca", "comment": "Malware payload (RedLineStealer)", "value": "e3b828c164900cb33105967ccc3c32b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197913, "uuid": "401af668-8af0-45ff-b381-39e732f990ca", "comment": "Malware payload (RedLineStealer)", "value": "79bdc1f0b3274af1e482a4a62c2530590d55e55851b1f18dc92593b63fee0a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197913, "uuid": "261251d8-b234-4499-a488-e18e8fab8f24", "comment": "Malware payload (RedLineStealer)", "value": "3617d0d3305d6e24b4933f8fd1ff8772305819a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197913, "uuid": "370cc723-c97b-4df0-bc11-49b2e0868377", "comment": "Malware payload (RedLineStealer)", "value": "c8f21d94fae98e4097cdbd36d7a58b1305df72e48a88cd367b47a685e7d5d163b4235c735a363f49b4359592d23c5df2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197913, "uuid": "9b6a7724-62a2-4914-868e-00294a78a149", "value": "T1A874F131B6D1D076D3AB02719534CAA46E7BB8722634C56F33782BAE1E302D15A7770B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197913, "uuid": "be7eb61a-3937-4538-91c5-be51486678a6", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197913, "uuid": "8d6e248d-5720-4ecb-b5f0-46ee67c94bb6", "value": "6144:YLIiSTP4s6PiUZrwN5eJDv3nnzaMrE4eZ:YkiSjL71HeJDvmFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197913, "uuid": "97cbd855-727d-4e2c-b886-59c330dea7f7", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197913, "uuid": "05b21abb-88a0-4791-b667-ff92c5da4232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197913, "uuid": "2b46c699-d0a1-41e7-bdd0-61c86823c175", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26de31bc-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155424, "uuid": "831fe4e4-99f1-4e87-9a05-626e56243c68", "comment": "Malware payload (Mirai)", "value": "54d7e391fe785a5abb80cfad50db55b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155424, "uuid": "f14e4673-1f8a-4cd5-be40-d957e9a2d1a8", "comment": "Malware payload (Mirai)", "value": "7a18040c0f4856e68be4d25e653a191fd7ffa5f2409590538908f929d8c173c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155424, "uuid": "d095f16c-a9cb-4817-b044-e46afaf6a765", "comment": "Malware payload (Mirai)", "value": "ff5d644ae1d74189cc5cec1eef9fdc111c2329eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155424, "uuid": "8a657e2d-9ec1-4194-867c-59d95dd1ea85", "comment": "Malware payload (Mirai)", "value": "b1f16294febccb6ef499ea8e00f32b3cd8d9af11ee39351aa7e12d3cfb705a08cbac89f157ac00f2696ac80132c53c01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155424, "uuid": "489c8374-ade3-45af-8fa4-a1458aed8ee1", "value": "T131031784F543E8F4DC5605753076EB365F36F1E92269E993D3A49A336C82702A60BE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155424, "uuid": "562dbbc6-504e-419d-948d-e9b69bd1083a", "value": "768:61BviJ0XfJWuXozlEGAnxfe4KX4zpxKsgb/s:g9iJ0XfJWuXozlEGAFeBQpx5gbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155424, "uuid": "3ad46470-534f-4080-b345-c2c7b04d6cbe", "value": 39312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155424, "uuid": "8c1a8196-9b7e-4edc-98cf-eea09465df48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155424, "uuid": "64cf5018-8c61-4cf2-afe4-140b32b94b46", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c698a17a-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678199500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199500, "uuid": "d0e16ebb-8d8d-41f7-a7ad-a258871318f3", "comment": "Malware payload", "value": "1ef32cb9cc07fa4ff8b89c2110b27641", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199500, "uuid": "c9e37b9d-bde3-40d3-a46d-094ca44bed5d", "comment": "Malware payload", "value": "7a6c29753628c124e262a59e39221a1b2433163340d8036cb212f202bec1903d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199500, "uuid": "e31e435b-583c-4641-ae68-263c2e4173d4", "comment": "Malware payload", "value": "19d1f97ea8fddd4c32fa20afbf9ea082acaf1b29", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199500, "uuid": "ddd65658-77d4-4eb1-bad7-8574951e364a", "comment": "Malware payload", "value": "37df9a2c271f09c532fbb9bca7d6dea7e000ef7d4a1f8f3901f1c2f97fc6fb7be0a9e8c38865e9ec85e1b9d7cccabd89", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199500, "uuid": "433c5f4e-2682-4269-a16a-c1e101e67fcf", "value": "T15A457DA1EA1B26194D1F27AAEC820D4585BDC46D47370239FD9E238E610369CD3BFB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199500, "uuid": "2b4f4e3f-7717-461c-a6e0-db923c56c37c", "value": "24576:4u5PAGMZdHCTaQBKkGZpLWJEA6SQjM3zEnwJjE6Oi2:Vyp8chH25A3yEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199500, "uuid": "cfa518af-22ce-4946-a4d7-acfa7333f582", "value": 1182185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199500, "uuid": "babee2c4-4e67-4a13-a649-c173f1accb03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199500, "uuid": "27c429be-b710-4c35-b889-ecff772b0738", "value": "Aviso pagamento_07.03.2023.025104938.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3115a243-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191948, "uuid": "0dcc69f6-79e5-4b30-a25c-aca8345db56f", "comment": "Malware payload (SnakeKeylogger)", "value": "8d450f9733d67b23e302452670d6a8ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191948, "uuid": "a7e64372-fed1-4605-b538-ab3d9c3559a3", "comment": "Malware payload (SnakeKeylogger)", "value": "7b53fa54edcb087bcabe64d2aef69860cf000d1739ff8d561c0bbdca14903186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191948, "uuid": "8171cc09-2d77-431b-980b-f60ba509a257", "comment": "Malware payload (SnakeKeylogger)", "value": "778cf22734e430f9241e65d08e2bd632369f867f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191948, "uuid": "8628c735-9b5d-4586-baeb-e8c152b82c63", "comment": "Malware payload (SnakeKeylogger)", "value": "ebd70876e2d0ea7ed7fe10214f1532522adf3d56262ff198d108c48da18704c684a25850c1f8289dbc58a7240c2d2e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191948, "uuid": "16dad074-432e-4e31-8e67-69e3fa746dfc", "value": "T1CA259DA56F196297E7C1A0B31804E7B6EBAC7D4D1427C1883EE13D8FB1B9D2C1111E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191948, "uuid": "cc34d4b7-c102-4c79-8e15-c61bf653e9c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191948, "uuid": "e0892c40-0e6f-4c25-a219-52860c170387", "value": "24576:3CYNUfqBpYdRbDSyGIyVXe/oLsNYwTUHUR:pNH8b+b6CjCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191948, "uuid": "8571825f-cdd0-4b66-bf2c-27b25790850a", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191948, "uuid": "1db294ee-dc29-478a-9e60-c98eb49cb2c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191948, "uuid": "044b8d7a-c94b-48eb-bf95-d8ffc990d1f3", "value": "8d450f9733d67b23e302452670d6a8ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68bf7bc-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198588, "uuid": "33751f93-c1f9-48f5-858b-14fcac89c7e3", "comment": "Malware payload (AgentTesla)", "value": "bdfd1a9b3393c93c6cbc3fdbe457f7fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198588, "uuid": "853821a7-a719-4523-93b3-75cec7e0a94a", "comment": "Malware payload (AgentTesla)", "value": "7ce0277082222d8a950e6e977e3cc0926ae1e3c917eed09a9e717a283d9e44c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198588, "uuid": "16a8d416-6ff4-4be0-a2df-c0ca281677c3", "comment": "Malware payload (AgentTesla)", "value": "1a1fde6e82a717d20599baeff1fe14d951e08446", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198588, "uuid": "84ff5625-297b-4135-9b5d-6f749474d85e", "comment": "Malware payload (AgentTesla)", "value": "6720ec47ba285aa0b14b45dd35dc59191442a7d316f5d949f2102c1141e1df1ec857af31b05ac90c8a9fcfce7983da48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198588, "uuid": "4412dfbd-75f6-40f9-a615-bc082f5bc815", "value": "T17E25AEA56F196253E7C6A1F31804E7B6FBAC7D4D1426C0882ED13D8FB1B9D2C1112E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198588, "uuid": "2dc65517-68be-41fc-91ef-94a4abe43a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198588, "uuid": "d1ff6b30-20cf-47fa-9538-8ae26eb70849", "value": "24576:dUYNUfqBpGwp0iCcS5ipeMoQuOU2VYZ+:BNHKKNGTOrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198588, "uuid": "4f72ed18-5166-4bb8-966e-0c9578c08fb9", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198588, "uuid": "ef5f5772-8d3b-4d56-8acd-fd6013ceaa77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198588, "uuid": "b6109079-96f2-4ca8-8b5f-4fd696ba49c6", "value": "DHL_AWB_NO_#AWB 2450847453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34149a1-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678192703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192703, "uuid": "c4aa90bb-bb21-45d1-8811-f5caff83a375", "comment": "Malware payload (Smoke Loader)", "value": "d928fd4d1871b145f8ac5e522cf4ee10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192703, "uuid": "36b2f349-bc4c-4a20-9b19-70424accabe3", "comment": "Malware payload (Smoke Loader)", "value": "7d4ed405992f3e2bddb0e4401eb3a1c1306474e09ee3b680f006d5967d12756e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192703, "uuid": "b88f0dfe-8530-444a-9588-d0c28bfb740a", "comment": "Malware payload (Smoke Loader)", "value": "e508d3cf0c2bca37c0ecb7a415c2fe7ac5e5f3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192703, "uuid": "5ab56f5b-62ff-4aeb-b2c3-be33eef667f9", "comment": "Malware payload (Smoke Loader)", "value": "ce37a47baac86a14ee31f08312cde7ca3b37f7420d89190225231884262a7867e32ee0a0161265db1e7b80f1e10617b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192703, "uuid": "370178d8-2d7d-48f2-a34b-76c7bdf660ee", "value": "T17A44DF6177F0CC76D6AB01705465DFA4DF3FB8712220869B736877AE0E302D159AA31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192703, "uuid": "c45ac577-7a3e-40e1-b363-1d01e2db4913", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192703, "uuid": "25fe6e1d-94ba-4dda-92d3-c781da9b31df", "value": "3072:qWYs2Lu3IRoHT/3fFG3mkUPWI0n/5JrpXGP3yE1HSx+fF8Py6m9k4PGVoDNb:94L/aL6JplE1ygfD9kKAMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192703, "uuid": "04105337-5a34-4b93-8d26-1d9aa716bcdb", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192703, "uuid": "fbe01bb0-6c0f-4946-a81c-63341612fb34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192703, "uuid": "207671ee-27d3-4c8e-a4e6-e6ce55e7f01a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e78f648-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198440, "uuid": "74ac05a7-f9c1-46f9-bfd9-d2761117a5e4", "comment": "Malware payload (AgentTesla)", "value": "758eff13f238fcfe7df32a6631686554", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198440, "uuid": "8b902816-bebd-442d-935a-30e2f7fd2b86", "comment": "Malware payload (AgentTesla)", "value": "7dbc0b5c09eb413386e058b19533073b670d7dc71929115fa6e29bee7520c1e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198440, "uuid": "e30a2f8e-55d0-4113-ae60-65e5fe4d67c3", "comment": "Malware payload (AgentTesla)", "value": "0ea57e063ab601ea48d3a956673b21b7fa070e49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198440, "uuid": "7044f6fd-0b2d-4f7a-b78c-3ceeec146018", "comment": "Malware payload (AgentTesla)", "value": "b2901cf3cca836a4f74933d0a7a6699acac60192efe4b001ce10b37b575b350e670928331917d32b92fdeec5b143196e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198440, "uuid": "941e45f9-4b02-4acf-8770-72126e39e3b3", "value": "T129F33AE892CA8D52C32E8074C4B1135816B2EDC79617E75D1EE0A8F63F4A7C3762BC65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198440, "uuid": "34ec37c6-1509-43d8-9190-910510f5bbf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198440, "uuid": "f8e128f9-407f-49c9-9f99-c7830de3e266", "value": "3072:mwGrR6onOCNS7f4+PosPr9e/sE/sclMj8i0ktdrIKFv0TDZHs:mwVUOCd+wsPr2l6j8itdrPy1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198440, "uuid": "92d2ec2b-341f-4e95-8130-71d0c8061887", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198440, "uuid": "ae202e0b-1bd8-44fb-9ce4-d9b0d960560d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198440, "uuid": "00dad5de-9317-42b6-be14-5a8d9237332c", "value": "7dbc0b5c09eb413386e058b19533073b670d7dc71929115fa6e29bee7520c1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dc233c-bcff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678204167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204167, "uuid": "e904a028-b820-425f-a3a3-58bb4053b4de", "comment": "Malware payload (RedLineStealer)", "value": "e33ed3f118c2a4bfadaf94e64d2eaf99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204167, "uuid": "7121170d-a8d8-4af8-aca8-16dfea015cf5", "comment": "Malware payload (RedLineStealer)", "value": "7fa53adc326d8a45b36a04c69a7fbc8f5f1651d1cac4fcc9a03fd34ef4aca914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204167, "uuid": "04b435fc-f971-42dc-903c-0721f3c8c37c", "comment": "Malware payload (RedLineStealer)", "value": "b52fb7bb46af636962e3f72ce134803e072c153b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678204167, "uuid": "9560a675-e52a-45ef-97dd-6c29dea366d8", "comment": "Malware payload (RedLineStealer)", "value": "bcf6c9cd5194624640157d9808aa9ce9049b01e9e6b2d80b85e5f30cbf5e0f52f94700b9eb35f0303d212d0f7bef546b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204167, "uuid": "cdc1b138-9173-48b5-ae43-8759e086afad", "value": "T1C674F131B6E1C073E6A794345437DFA45EBEB8B2556186BB336812AE5E303C19E67303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204167, "uuid": "1441c797-5aae-4229-bb55-cee43d095a3f", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204167, "uuid": "54b8df2d-a058-4ad1-9553-5fdc083d826d", "value": "6144:2LPm5P20MWkWVd/CAHe1nfCXjbKe9FXgwheAISd7q4eZ:2LmtddkWVd6zfCXjbKiXT7QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678204167, "uuid": "20c9288a-6821-498b-b4b7-a9ca53065fba", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678204167, "uuid": "60977a9e-01a6-4afb-b25c-45d05d3a1468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678204167, "uuid": "9893a85b-a55e-4e75-b7c0-43afceeb770d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd73ed1b-bcbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1678176775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176775, "uuid": "eeeda83d-d41f-40e4-8870-4a9ea91a184f", "comment": "Malware payload (YoungLotus)", "value": "64c467cadb010b645ad1a04bb9ae000b", "object_relation": "md5", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176775, "uuid": "e4e43d7f-1cc5-45ee-8f57-e1e02855d449", "comment": "Malware payload (YoungLotus)", "value": "7fcde90bf1f4e6ec55e94000936f6264264990f16511c5fae5a2faaefd8400f7", "object_relation": "sha256", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176775, "uuid": "f9214c75-bf09-41db-bf79-eca38e5016c4", "comment": "Malware payload (YoungLotus)", "value": "70b4c4ee4c9fd5c1589140cb0eee13462f01e2bd", "object_relation": "sha1", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176775, "uuid": "bcedf8a2-fc35-4ad5-b5f0-a07a4e1e1051", "comment": "Malware payload (YoungLotus)", "value": "01273e2c96ba22b89d8db0e43f88c5f92affb7c1b7c354b3f0f65c79cc56ded97e6047d0f0e63766849bff9399b283ed", "object_relation": "sha3-384", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176775, "uuid": "15650be9-5560-4b5d-a251-7cdd726550a9", "value": "T1AF450184D82492BBC0A74E70547316BCD6713CA42C39E6EA43E7F6B07AB21F4D5E9163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176775, "uuid": "be158e0b-fe5f-47b2-b2e4-11e615c3f606", "value": "8f54c7f89ab7fb80e3cbd057af48cb19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176775, "uuid": "26fe8999-4ed6-4e14-ba50-cbce8efa2d7c", "value": "24576:YRXxW6iuh/6+hBbMOr71zBj3qsZw3HKzNf2/nLk/JN4iheo:YRA6iC/hBRv1zBj3q2aqzQ4/JNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176775, "uuid": "162bc66d-d366-4fdf-80f8-9359bb71f698", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176775, "uuid": "3370fb87-d557-41c4-b65a-85ed1fbc6bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176775, "uuid": "13b5b16a-00ef-43ed-b4fa-f29bb7021b08", "value": "diyige.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ffb9b5-bcdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678189705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189705, "uuid": "3d870597-de42-42d8-b2cf-ad4db0d3d8e9", "comment": "Malware payload (AgentTesla)", "value": "dc378b90cb922738ddc5da49bfac20df", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189705, "uuid": "61091862-903a-4319-a527-c40cfb46769b", "comment": "Malware payload (AgentTesla)", "value": "7fe618a09abc582483fabc3c82ce42297b70b8af54839349da606e5d6f20e656", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189705, "uuid": "5781fee0-32f2-4c3a-91f8-e60459ca289a", "comment": "Malware payload (AgentTesla)", "value": "f5ed07a2423ba17b5a5589493b58f15d6ba96869", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189705, "uuid": "ab73d152-13a6-4c9d-bd20-298455eb3369", "comment": "Malware payload (AgentTesla)", "value": "ab437f2bbe5453202fd3eca849ba35ab774c12c6ab32d6bccd259e92caea0562a63189ae0abf36260d523db387f8993e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189705, "uuid": "fe513af5-3975-401b-8099-766f105c0445", "value": "T1F19423EC281DFE54AC076497629A630EC033696313AF514163218F1DB16BED9A2A8FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189705, "uuid": "e91dd244-236d-4f64-a862-2bb3d722627d", "value": "12288:wk6lRQHpxS7CgZbmOVPZPBD2aU+vGIen7RkqWBpJ:N6lRQHm7CgZmOVPZPBSaUyGIK6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678189705, "uuid": "33111853-8151-4f09-acf4-0bca6ee265a7", "value": 431043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678189705, "uuid": "4bc1e7a8-f05e-4d3a-9355-f67ca69a35fc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189705, "uuid": "7cee47ec-b509-49e9-bf5b-95459ea91956", "value": "No.783006720pdf.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60eb28d-bd32-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678226128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226128, "uuid": "12108a0c-452d-42bd-b18f-d85b1aea5446", "comment": "Malware payload (Formbook)", "value": "2a6ed6aa7f8eb8a08e20fd4d5fca949a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226128, "uuid": "47a23bd2-684f-4c86-9794-c451c2d92e25", "comment": "Malware payload (Formbook)", "value": "80225cd0f5c3c59630d8d42320aeae18ad85006b640537dcc3d076f8ec96f616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226128, "uuid": "b92b7bfe-e4c0-4e01-8358-13b4234d90c8", "comment": "Malware payload (Formbook)", "value": "225821628d9f2832c6d920aa89ed233986c46c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226128, "uuid": "3074aeb9-535f-41b7-8a12-37f272307158", "comment": "Malware payload (Formbook)", "value": "43f95dc16e950ff5fa64e06c69bc8e567d20658dcef4a22814a377f23d60604703415908491c3553e2c76d88ad1825c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678226128, "uuid": "e17df2bb-fb82-45a6-a2f6-dc9a86031833", "value": "T127C5DF023E44CE61F0191237C2EF46088BF4985166A6E32B7DBA377D65167A73C4DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678226128, "uuid": "56318ae9-19f4-43e6-bcf4-a35a16433ea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678226128, "uuid": "585b54f3-43fb-41d2-968f-fd27d63700fc", "value": "49152:ZtiI2nk/ulngIWVTqEKWcZpaqkOijSHYPBlxyX4lDmPWA0a6qTiy:ZtiI2n6bTqEKWcZpvkljbPBmogWW6qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678226128, "uuid": "a2e71e4e-7c27-4778-be3c-578a85aa8c6a", "value": 2677248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678226128, "uuid": "0f44c933-8267-419a-8de0-b4bd07030f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678226128, "uuid": "4c735d90-a4bd-4645-9151-6988c02623bf", "value": "2a6ed6aa7f8eb8a08e20fd4d5fca949a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d01a27-bcf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678200088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200088, "uuid": "c69a5bec-b87d-450f-b41a-51edc1d4d147", "comment": "Malware payload (RedLineStealer)", "value": "5db671c35a06470434bd96b1bfb4c6a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200088, "uuid": "f20a42db-6535-4246-8abf-a0a4099876f8", "comment": "Malware payload (RedLineStealer)", "value": "8242fe18be8a66670797b718e6d9ac3d97225f0ea124e4934a3780ff3725cf4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200088, "uuid": "ae179f97-8ac5-4d48-aece-38cd095d7ea9", "comment": "Malware payload (RedLineStealer)", "value": "d6d1388cc512cfdd5e4e3435de0f5481a3a8e940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200088, "uuid": "e178bb79-30ab-4e2f-b7c8-96457a00c6a6", "comment": "Malware payload (RedLineStealer)", "value": "8f850c1e5f7fdc02b05a9e693443a65497eca9829d6a29cbd6c8f1931ded4bd7d2620df130c3aa1e433bf64aefdae2c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200088, "uuid": "1560fd66-0bdb-4d3f-b0dc-b52ba10aad98", "value": "T14445583420CE4471D9A22531C5ACD9B5892DAFB00A32B5EF13A68BFE0BE17D3D61D169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200088, "uuid": "ef973e99-f120-4bc0-9f34-6d79b52beb81", "value": "20db1e79c216f1d522f5cd084231f477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200088, "uuid": "cf275c9d-dfde-4b78-84e3-9c645aa414df", "value": "6144:xXpwzjiAtqhXlpuAOrmfVRs6D6+Fl2jX16BoChK/7tgJVY:xXpwzjYQIT6j1tCmsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678200088, "uuid": "d1d802ed-d2e2-49dd-ad89-31b964b423ba", "value": 1191328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678200088, "uuid": "fa3ade6b-b44b-4501-aff3-7d83e244e7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200088, "uuid": "5c647226-2399-4863-a65c-36e9449b481a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299b3701-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191935, "uuid": "0f1e5bec-e184-45ae-911b-22c6236f83e2", "comment": "Malware payload (SnakeKeylogger)", "value": "0020c8b3fa806a6d4ce39c6025bc6408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191935, "uuid": "ddfb73da-b652-42e9-90b1-12acf59b69f9", "comment": "Malware payload (SnakeKeylogger)", "value": "83fb7ab31f80c4dbd452fd04e4dfe6b4806c1639eb0b0891c3f08c0b9f0312af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191935, "uuid": "33f6c5ec-1400-475e-bb0d-9b26db464694", "comment": "Malware payload (SnakeKeylogger)", "value": "3f7eee52ff54c3eb26645e4516ca13ddcd75d217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191935, "uuid": "9ea53d4e-8d1d-4eef-abac-b394b3882db2", "comment": "Malware payload (SnakeKeylogger)", "value": "cca26db3523112c371271183dab033904b691e60210fbb5187348b3ad101a9f704948bbded65000bf02a573b06bb2a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191935, "uuid": "d8cc48c7-f341-4ee6-b35e-4ec8a4db0a15", "value": "T14D259DA56F196257E7C6A1B31804E7B6EBAC7D4C2827C0883ED13D8FB1B9D2C1112E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191935, "uuid": "b458f3f6-f30a-4f25-92e4-ee4ace0a16b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191935, "uuid": "f02730e0-406d-4331-a19f-15b983c47433", "value": "12288:r6X3QBVmNUfqBe41I3IL+4DCJb1S55OnK7mM2tAUKVO/ic3uFkt:wuYNUfqBp1m4c1Q7mM2tAb8/iqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191935, "uuid": "06dd4319-7d8a-400d-b418-88aae519d1b0", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191935, "uuid": "6c6b736f-77a3-4ae0-8d89-bde8179e7ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191935, "uuid": "13bf6b07-3974-4086-a256-d82940720a0d", "value": "DESSAMO TEKL\u0130F 07.03.2023. pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd164002-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678192639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192639, "uuid": "36579b67-c04e-41e7-8984-052202756fb4", "comment": "Malware payload (SnakeKeylogger)", "value": "5e24002533fffd697688675802b399de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192639, "uuid": "9a0b394b-6b45-4ce3-b034-183637a10b83", "comment": "Malware payload (SnakeKeylogger)", "value": "841e28ffde95b4af964f9d1c9faa16fcd0f3482aa76754be03e7c0bf56fed87f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192639, "uuid": "07febb6f-c208-49ad-b087-b937472bfc6c", "comment": "Malware payload (SnakeKeylogger)", "value": "29ed27dac230c426a34819fa1a10cb787a130fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192639, "uuid": "56a80a45-9131-4f4e-b956-24d73180e3e5", "comment": "Malware payload (SnakeKeylogger)", "value": "4afff8c9533eeeb73326390e8ecc1f8e6a7c7db5e39d89756b5bfcba6d737b8a7a61b02efd3b2783ac517c2a4918fa3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192639, "uuid": "33c3ad63-6f62-4167-bf94-332886933b26", "value": "T191B439C3F444308DF8DE827BB9DA8E26E1D61D5A0D43190192713F54BFEE98297C4AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192639, "uuid": "d9182489-16b9-4809-8ee5-4009f8440d4e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192639, "uuid": "35cd7a05-8e7a-43d3-a726-512809df1fe4", "value": "12288:5YrCRXgI9HFsRyuJqbDgAe6rOHTStmUTg:5Yr+w8HFYIgAFrO+tmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192639, "uuid": "3460f7f1-e822-426a-979c-4569df7949a9", "value": 503069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192639, "uuid": "f8e97a9e-bf54-4e3b-9f0a-383aeff4b21a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192639, "uuid": "25676161-2d9c-48cb-85f2-49208a881e2a", "value": "841e28ffde95b4af964f9d1c9faa16fcd0f3482aa76754be03e7c0bf56fed87f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5f6a3c-bc80-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678149506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149506, "uuid": "d3fd074d-2fd1-4863-af39-be7ea192616e", "comment": "Malware payload (GuLoader)", "value": "0ce73867f9818643cbdab796882bf6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149506, "uuid": "1884335c-259b-47ea-8305-d3d3cf44b1f8", "comment": "Malware payload (GuLoader)", "value": "848d294fb689302f7ccc58239f014bc2147d53f7f0d8670999a01738687bd743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149506, "uuid": "0ba02667-c3af-4f9b-b70a-8e737d6b0da6", "comment": "Malware payload (GuLoader)", "value": "7af68c95b7d3bc33dc002a7b30b5b8167b7c8384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149506, "uuid": "b0f72200-99d4-4c30-86c2-699104e78c56", "comment": "Malware payload (GuLoader)", "value": "81c0730f77e84d553d93b0da063462c4b94e46c3f8271fe19e3193aeb96a0cfe137997c15c65787538c92398cbc5485d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149506, "uuid": "fd40a62b-5d0e-44c7-a59b-f446129d6145", "value": "T1C5E409A790A04111C9524AF31A6FBF794F1B1FBC97141C1A907532AE66B7BC3DC33A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149506, "uuid": "6e5ed727-d249-4b01-9522-6e7720d34b52", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149506, "uuid": "4bd2a429-dceb-490f-af31-5dfe4f719989", "value": "12288:0bV7K1f4pvNYYD7TabeslVSLuPb8iwmw1wImM8Ao/o:0bV7K1f4pv+YD3abeslVSLuPb8hadMBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149506, "uuid": "2271cfb9-deff-494f-9316-55b80ef44665", "value": 664144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149506, "uuid": "382c46e6-b34c-4ea8-97bb-67e5ec8ad8e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149506, "uuid": "e7024d6a-43b2-426f-9a5a-51a70e1e3157", "value": "0ce73867f9818643cbdab796882bf6ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e61120-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1678192701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192701, "uuid": "554d39f6-997c-4e7e-b985-f221d4c8ab06", "comment": "Malware payload (AuroraStealer)", "value": "a8a106555b9e1f92569d623c66ee8c12", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192701, "uuid": "2f8a192f-fa6e-4140-adc7-09943b666a21", "comment": "Malware payload (AuroraStealer)", "value": "84aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192701, "uuid": "4321dab8-134d-4718-9c76-36a11791a06c", "comment": "Malware payload (AuroraStealer)", "value": "a5080c26b5f5911c10d80654c84239a226fc75d1", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192701, "uuid": "d1b61504-2a9d-4b90-85f5-c730a39151dc", "comment": "Malware payload (AuroraStealer)", "value": "5e563948862e7cb9b17ff43febdf5da34a199b37776fca158948d25bf33da9dd9f09ad3416467e3eeddf6b18a805b05d", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192701, "uuid": "75d2db1b-4fb4-4b56-b8fd-30db24543f3b", "value": "T1A1E51990FEDB04F0EA03297114A7627F27356E099F35DAC7D9507F5AE833AE20A32519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192701, "uuid": "c4dd8e93-eae9-4a4a-958a-cc988aaa0e8f", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192701, "uuid": "fe2e182b-6d46-4fad-8663-8305296d55c1", "value": "49152:3WjN903V68U3f1uXAlL/EUSiITRf+EGg7dyvUCUDaB5+Tc6k1HFm:3IrIVbUYiLs4vUCU5T0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192701, "uuid": "1ad0dc8a-652c-487b-b68e-b6f00434f098", "value": 3192544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192701, "uuid": "6cb50145-b44d-4c9e-89fa-4d875d35fe1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192701, "uuid": "d5e6fb0c-716d-4276-819c-a33d22dc6ba5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f9d134-bc95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678158474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158474, "uuid": "4bc9ac68-ebd4-454d-ab69-368d8207e808", "comment": "Malware payload (Mirai)", "value": "a37e404d9e86d0894489bcb331c5bd3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158474, "uuid": "e92578b4-9050-4c8c-afa9-dabebf1b2403", "comment": "Malware payload (Mirai)", "value": "85e6cf04227256af53e6e2d3c02cdbbd07aa6c84e2db711e1a548dbc7fa9e114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158474, "uuid": "81c4f4c3-9955-4106-b679-00746fb88e29", "comment": "Malware payload (Mirai)", "value": "f0952f3b04a7ecc7ca1756e2ceca421d4fda0867", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158474, "uuid": "c6cdfa55-b50d-44b8-8d26-bbfc1408b66a", "comment": "Malware payload (Mirai)", "value": "d8f9b1b1f598ec1d215f48cbcb964d4661b0b990431e339e1ca0c52b4ca7bf963df42eb50663f94ab739549bc18ea82d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158474, "uuid": "f6738c0d-f6aa-42f3-8c59-77475cd93d0a", "value": "T1F5131B52721C0F17C4A35670253F5BD08BBEAAD022E4F289756F4BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158474, "uuid": "05067e86-a0e8-424a-9730-de4c62e864d5", "value": "768:MSMg8XqnORZYRAgRcNmVQH5QCnO0YzFeoIdSM8L5NwA:NMX/8F+HHVoId8LUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678158474, "uuid": "734e3fac-aa7a-4f37-b56c-7511652ec050", "value": 42276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678158474, "uuid": "9536db97-81ff-4b36-b28e-1925668d5a4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158474, "uuid": "e4ab5c17-b4eb-4372-943c-5f4f63b5c3e1", "value": "a37e404d9e86d0894489bcb331c5bd3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc0622e-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198786, "uuid": "2524356e-1034-4a5a-ae17-b29ebf7eeefd", "comment": "Malware payload", "value": "2d4178a3ac7445cc234b699e04afc031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198786, "uuid": "82549572-e77d-4e5e-8b14-8d1c2c2517ab", "comment": "Malware payload", "value": "86045c094360c0a3f304166d548158d64d4c3c205329bfded659c15aba2b6ba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198786, "uuid": "068de035-2690-46f6-93bb-894b5ff11755", "comment": "Malware payload", "value": "7e0d8bb8b6ecf993f58e4f7ffb62030f49c04204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198786, "uuid": "a8a8b5a4-79d1-4624-a8ce-f0c2b6f4473c", "comment": "Malware payload", "value": "c61a912d6a0b255957979b461e7b39eb15ab4556e6aea5939fd42261f544fc511df0a310f00b9b2ab31ba3bf016be419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198786, "uuid": "be1af193-80ba-41bb-9dc0-926059f1cbfc", "value": "T1E3D4011673108403D86273F214A95A911D97BE5019B8B24B73717F5C3BB2293FE2EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198786, "uuid": "d1dc712a-6f9f-42fa-9fbe-4b441fc38a10", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198786, "uuid": "7fe233ae-41ab-4d41-8540-1586b2239fd5", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqgf:2YtZCkDkQQAO8h6mZvrg6NEOqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198786, "uuid": "9ee7246a-d719-4c8e-afd4-eddabb5a827b", "value": 612992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198786, "uuid": "1cde6c02-baa6-4119-8bde-b7a6730f96bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198786, "uuid": "8572a02f-fc09-4310-91a8-07d39942dbda", "value": "2d4178a3ac7445cc234b699e04afc031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fb1c49-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198429, "uuid": "2c11a82c-6841-4587-8ef2-d03ab04bd5ed", "comment": "Malware payload", "value": "36f7cec6ace3364ffdd53e23ed42678a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198429, "uuid": "37ee5efd-6572-453d-b23e-6b94e3bb84ce", "comment": "Malware payload", "value": "86d4eb6fda3255178ecb8b72f945ddd95aa18eca39884f1518401ad1f663d2d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198429, "uuid": "07259a03-eef8-4637-b57f-8f25268a330c", "comment": "Malware payload", "value": "f096b06d29f33eaff0d67cd52e44a50fd6e6af8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198429, "uuid": "62f8c9c5-d987-4db3-886b-af62c7e48ee0", "comment": "Malware payload", "value": "cc885569d755148600916b4012045dfb7e5bbc682bbc3530a047645f2d0e066ef3e583000ac81f52fa1bf0261d940c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198429, "uuid": "5d4f40a2-bf8e-4e1a-8ebb-a9315f5903c7", "value": "T1BC65210067BB4608F172BBBF56CCA9A59BFBF6F22635A567291E13460303D50DE0632D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198429, "uuid": "9be98729-0ef2-4127-8374-c50e33f83b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198429, "uuid": "0a2f531e-c19e-4322-8a3b-73c1c60039de", "value": "24576:8rRq5+5umA1U/ty72v5e1WS6O8deXe9dfZhH:8Vqw5umA1U/ty72v59S6O8N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198429, "uuid": "7af7af13-9841-49fc-a223-cf72bb79b419", "value": 1527296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198429, "uuid": "7885253a-77e7-428e-9668-d14d26de54c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198429, "uuid": "15f7d64a-90a2-477b-b6d4-5ee49c6468c6", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e6f95d-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198828, "uuid": "b15d9079-face-4f2e-8821-6c8df46bd083", "comment": "Malware payload", "value": "88059628dae21bb2f5485f976ec704ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198828, "uuid": "704f525f-e305-42de-95e5-a0d758071ae2", "comment": "Malware payload", "value": "8965941988602e4ac58a0e8842344becbd0df3c700b294fa95489e247f333110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198828, "uuid": "db8dca9a-efdd-4635-9cb9-e7f5ffd409e1", "comment": "Malware payload", "value": "e967dd1b54c6f3a38fe112d4f684138663c5ba72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198828, "uuid": "d727898b-452f-4d2f-8318-48d8a2c72a90", "comment": "Malware payload", "value": "8a09fff6f84e561e50023cd2b7f112b7b498162505933c82e9cba39172a4ef6e4d5991a11dc42d6d720ae1d6deb26a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198828, "uuid": "ad4959d8-5eab-4a2f-bb80-72be62f70b6f", "value": "T1C1D4011673108403D86273F214A95A911D97BE5019B8B20B73717F5C3BB2293FE2EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198828, "uuid": "db0dc11e-29c7-44c8-bc58-fa117c8461ee", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198828, "uuid": "d9ca8527-bf58-43ff-930a-9bbb55edb765", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqgT:2YtZCkDkQQAO8h6mZvrg6NEOqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198828, "uuid": "cffe38fd-872d-4ec0-8606-be8d9df50fd9", "value": 613048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198828, "uuid": "90ff34c8-8347-4f1f-a5c1-085d3ef8c252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198828, "uuid": "cf4e7a54-00d4-492e-acce-af9bc57e5ebb", "value": "88059628dae21bb2f5485f976ec704ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe6a39d-bca5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Conti)", "timestamp": 1678165552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165552, "uuid": "6eaf4c68-4b4b-40b4-8e91-dc70a29a8ca4", "comment": "Malware payload (Conti)", "value": "d27a6fca4044aa663fee95587670ad30", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165552, "uuid": "db2e61b1-8be8-4315-a81a-7e5e42aa97a2", "comment": "Malware payload (Conti)", "value": "899cc5dc068f9a88fff19c92c4538ee8c464496ff6f83398c359dd3dc3926dd1", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165552, "uuid": "ba8a36e7-9a27-4a2b-ad83-ab13d8d4a608", "comment": "Malware payload (Conti)", "value": "affc479462c7756ee00c4cdf3e12459116223a1b", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165552, "uuid": "300730bb-dcec-47c8-8cfd-0239d70b0754", "comment": "Malware payload (Conti)", "value": "70b920b77c346b493256ad1014d1613e15a429a3f2ae538121319f024b34145d36fd64187229d6be457988ac66ca07ed", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165552, "uuid": "528a047a-870a-4176-96fa-6e76cb2f5d92", "value": "T197244B20F6888A6AD9A50D3625F83FF39078A9783B0F8DE7B7DE492D15705E12120F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165552, "uuid": "d2f922c6-ed0b-44a9-bed5-3f105eabcb14", "value": "52acd2ce9ef75b1d800d1f9954cd3c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165552, "uuid": "222917d6-60e8-45bf-89ce-adcf07a64e28", "value": "3072:C94lojxktL3x6HTWL8aKQAt7mPnFp/nj8F56K/N7o:bsIkHyYa5Qy/FprcF7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678165552, "uuid": "24922c93-7709-4485-aa52-79f22cbefddc", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678165552, "uuid": "77198442-636a-46b0-807c-66a5d07fef33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165552, "uuid": "d05e8b5f-c36b-4768-86e4-618711346ca4", "value": "899cc5dc068f9a88fff19c92c4538ee8c464496ff6f83398c359dd3dc3926dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7115418-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192146, "uuid": "96d3f7ea-511f-4c9a-9442-e385a8e1c81e", "comment": "Malware payload (AgentTesla)", "value": "1b71cb032f4f8a2ca0004c0d57553974", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192146, "uuid": "5f18e1f3-77b3-4ab9-b5b1-7d8a671b3967", "comment": "Malware payload (AgentTesla)", "value": "89a0e99ef4a97ea1ad4212d7f539c9e851b97108f93a6ff64bbb0b5a5e8997d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192146, "uuid": "31a0015a-8d36-4252-8d6d-5031ee48c940", "comment": "Malware payload (AgentTesla)", "value": "5738e00ef9f37a76c1416cec3af4427e28d07ff3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192146, "uuid": "c96ec5f7-7708-43d7-9028-6f9207411043", "comment": "Malware payload (AgentTesla)", "value": "29b9019f4f62e69de3ef3f2a7998dfa438bdd383165684b2a6309f9a5d1c10b6e14c3a5dea594f551e95627f9daab979", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192146, "uuid": "a9392c59-886b-42d2-a1c2-18b1368ecbfc", "value": "T11D4412517265D293F87B4F715DFAAB6B6FA7D0392CB8D20B2F004A0D7976142C42EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192146, "uuid": "66c6f779-f913-4c6a-a064-29832abc799b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192146, "uuid": "f3ac6eb0-e0a3-47c8-935f-5e521c80c5e0", "value": "6144:/Ya6tqbIlkemg8GoGhG+D8KwTKMU4vOzriVFzZ2EaRhcM576kf0:/YXoN2oHzKwDKrWFzoRhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192146, "uuid": "e7c76dfd-220d-4aba-946a-d8a138e1b7d3", "value": 275015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192146, "uuid": "ca741313-a2b1-4ed0-9351-279b196f0e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192146, "uuid": "3276eaa1-adfe-4478-875e-c9531c232e77", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469e6ff4-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213459, "uuid": "15b97a2f-aeab-40af-a4d0-1e83dbc81d66", "comment": "Malware payload (Mirai)", "value": "985b52008ab536acea9079a32bdcae8a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213459, "uuid": "72cda9f9-e06e-4f65-84e1-ef80103ddce5", "comment": "Malware payload (Mirai)", "value": "8b649049cf939071c93fadbff050228b5cfa31b10a922c6015903016ec96c3de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213459, "uuid": "e2a3e06b-a881-4429-9d49-8f0442e38f2b", "comment": "Malware payload (Mirai)", "value": "f302b311a22ee1ef7a51737248fe712b8538980c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213459, "uuid": "c582ea2c-fa51-44fd-8423-af3f4838e5ba", "comment": "Malware payload (Mirai)", "value": "a44edc3c35940e161f839f84e3414bf6301c5c46d8cbd140e1b8e39ae27312fe1ea0720f759db8d95c34c10fbe276596", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213459, "uuid": "24957af5-4134-4e85-bcb5-b50b785116da", "value": "T187144C82EA414E13C0DB137AB5AF018D3332A7A5A3DB7217D9146FB43BC665F0E63A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213459, "uuid": "9a7548c5-ea3c-4f15-a486-eec93ad214ed", "value": "3072:1ufUQD2FYAK9xEtyZFcZxehkLT/uazSPLNBa7gJ0K/bdwbZn1KTKyM/9Vg/mBwdy:1ufUK2FYAK9ityZyzeOLDzSPLNB0g5/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213459, "uuid": "378a8580-aafa-451a-b148-40177729c7ac", "value": 191470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213459, "uuid": "f1bf8d79-8fa3-45fa-b5b8-a74ad46faf8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213459, "uuid": "cd2cd635-ccca-4c1b-b14f-9959db9a6b89", "value": "uYtea.arm7-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff89a36b-bca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "cd52a6f3-d503-476f-8ccf-5d44d8fb1129", "comment": "Malware payload (GandCrab)", "value": "fc32e27c83ff0b953902d68fdf30b556", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "1bd2b77f-dd48-4ac5-9a54-96389502a3fe", "comment": "Malware payload (GandCrab)", "value": "8bfbbf3272caa5f86e956166a6ca33cfa0879eb9ebde99a579e6676f432a4130", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "e5e710da-4676-4ae1-8fe7-70f23c2fef74", "comment": "Malware payload (GandCrab)", "value": "6bca2af94f4f899aaf6e39f5aaac7e795296e9e5", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "5b1eb86e-e7f7-4ce3-9cd9-118344301f25", "comment": "Malware payload (GandCrab)", "value": "d8a08ec7aea814f81aca20eccc699cdd84bcefaa6ba61f1648379dce6d762f3833b0d0c5a07686b53aaa8856733c7b48", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "d24491fa-76d6-4d28-b845-3ddd742ee02e", "value": "T1D6636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "dfdc10e4-6ec6-4e7a-8b23-144f19eaf0f5", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "43f7e7e9-0639-41b5-9e1f-9d8daef775e3", "value": "1536:UZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:rd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163948, "uuid": "e8dff2d0-aa5e-47f8-9220-8d5f33c3e8ab", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163948, "uuid": "a62dc57a-d2ce-43af-9424-f901095ab71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "4baf340f-4fa5-42ad-a39e-85ad44e65051", "value": "2023-03-06_fc32e27c83ff0b953902d68fdf30b556_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fe8da9-bca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163950, "uuid": "d6f11a56-1cc7-4f34-b9e7-52821dc06232", "comment": "Malware payload (GandCrab)", "value": "ede2aff357cc3dd6c0496bd06e856e5a", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163950, "uuid": "02191cb6-d88b-49e8-898d-56ad9ac6fec8", "comment": "Malware payload (GandCrab)", "value": "8c413d31eadfd31e58f66d6241389d1bd6897e71b2d4cfceac549aa2488a8d52", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163950, "uuid": "8e829940-b68b-46ce-ba61-7615b490fd1e", "comment": "Malware payload (GandCrab)", "value": "5988e76f860e42430540f05ec7b4cf896faeda05", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163950, "uuid": "a1ffd9d5-6c6d-46bb-bfea-3747631307cc", "comment": "Malware payload (GandCrab)", "value": "f9e2a83852b04d908d7eedee671988a384bc15eef4c057d95a82fa2708c9f05ab01c80a469a829cad47912ba863cf217", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163950, "uuid": "7220cda2-6a12-4f17-8b9e-f52940ead19f", "value": "T111636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163950, "uuid": "c82b5727-54b7-4341-aebf-742bb7908bed", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163950, "uuid": "36f3fe04-adc3-4121-8e5f-70f6801b0f84", "value": "1536:rZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:qd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163950, "uuid": "d786ec24-e17a-445a-8ba7-209444129437", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163950, "uuid": "22e628dc-5db7-4276-b90c-49a68a028875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163950, "uuid": "d248db4f-4831-43f5-9b55-42f6927df7ba", "value": "2023-03-06_ede2aff357cc3dd6c0496bd06e856e5a_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4390661-bcb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678174183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174183, "uuid": "438f98a6-be8d-4140-bd25-5e8643242b5f", "comment": "Malware payload (SnakeKeylogger)", "value": "1dd8d52497f7455fe2c56a864366df1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174183, "uuid": "15564e34-2454-4326-aeeb-a5cd1b2b5f23", "comment": "Malware payload (SnakeKeylogger)", "value": "8cd4a7811293d4bde527b605becd5b1cadb2e9758921e2b81332fdfc3bc2ad35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174183, "uuid": "16923e48-a2cc-4aa3-8ad9-8fbdf836c431", "comment": "Malware payload (SnakeKeylogger)", "value": "7af9222c6348653dcad5aa791850c69553d887d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174183, "uuid": "e4cb65b9-73be-4eaf-a20a-f454aed8f456", "comment": "Malware payload (SnakeKeylogger)", "value": "d02c18dc3ff72f8773e618fe95551b621066269b98d5e54e28a545be861a8b007fe6d4800cb25298c189eb221102f00c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174183, "uuid": "75dbba55-9b77-4f28-a406-60ad71f4b4d9", "value": "T1C8A36DD4A7FD46A7DBEF37B9E4B050000B75AE967022FB5EAA4430E61473B004B1676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174183, "uuid": "7c77065f-5147-4032-9eb3-8d34ab481b91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174183, "uuid": "9c6eca0f-17d7-4116-be6f-b7e1ff63a634", "value": "1536:qRcZUmDmHMWpkEfY2SYrLkde9hPMwg5AOoZAqRjAGInF3h5G9+zo:qGZUYmHMH7A9pBsAOoVeYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174183, "uuid": "d0082fd9-a187-482c-b8ee-c7cb2f132df8", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174183, "uuid": "24e3e224-ea1b-4aa4-8d00-9cad7a2ed8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174183, "uuid": "a0fc3886-8681-4514-8c69-223c0dd154ef", "value": "SecuriteInfo.com.Win32.PWSX-gen.14129.24907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17c9239-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198606, "uuid": "bd0a4270-6580-426e-988f-ece6e237637b", "comment": "Malware payload", "value": "65c6b20a71381300f06361a91f8a8600", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198606, "uuid": "192eb67d-61b2-4e06-a2d3-35092efd5db4", "comment": "Malware payload", "value": "8e202dd319e539c455245f36a616428d29551dbda507754eac6394131ed5efbb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198606, "uuid": "25d05ba3-31c7-4004-ac22-a720ad8981b2", "comment": "Malware payload", "value": "ad9405175b85333341975efc778190be711d998d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198606, "uuid": "2eb29fc0-fd27-45b2-a47a-00ed7ed6e359", "comment": "Malware payload", "value": "aa7baefb41ceff96bcba541d0b25f236fce7e8409eeda7e3f97771b154f49df36d0c51ed3fb97263776520bb8bbdaaed", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198606, "uuid": "0d5723a8-600a-4298-b0a0-0232283806b2", "value": "T1F4E45A9DDF15162C0F0B92669FF108D90FEB4FFF7612036B1A79027A172334992A96C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198606, "uuid": "f2e38048-0a34-40ea-8bac-3e707f82b76e", "value": "12288:PhBeNsxmLR4Bq/5QH3Oze+a0BiTreixCFnZ5l62PNEKyAKF3t:PbksmRbTzvS6HX5moKF3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198606, "uuid": "6efa66a2-7293-470d-aea5-7da824ddfbef", "value": 666859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198606, "uuid": "46cab590-224f-47fb-bf01-d1d0fa4c8c5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198606, "uuid": "83e7385a-753f-4067-9bd6-cc873a1d221d", "value": "JUSTIFICANTE DE TRANSFERENCIAPDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f264cea-bcbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678176617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176617, "uuid": "4a26aa08-5cbc-4fa8-b8e8-c700ccd1ec5f", "comment": "Malware payload (DCRat)", "value": "e06035d9f78c85fa4339323da17895ca", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176617, "uuid": "834692f0-56fc-494d-915f-8bd160a71953", "comment": "Malware payload (DCRat)", "value": "8e997bef9ad61722cb7b782da93b7373acd19dbdc4cb91b47e80280e2100b6a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176617, "uuid": "ea96035c-4ae8-4a67-8202-e459a1d7bfdd", "comment": "Malware payload (DCRat)", "value": "c9cf5f4ac2812052e237bfdd6d9773d7aedb4ed8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176617, "uuid": "33c18a26-8921-4f63-8a09-ab87e930e384", "comment": "Malware payload (DCRat)", "value": "c0c1458b0a21464857e3e507df4a9e7fc2ff931bf51552f003d4bc5d5db3212782158203f1cc767653f77abacac2ef54", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176617, "uuid": "9ddff1c0-18c1-4824-a32a-a1ccf11da08b", "value": "T13035338E45DD38FDD4DD30B71A8B38E55F821AA2A2CE713BA275C5C08A39F51872A15C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176617, "uuid": "2df67858-a233-401d-9f92-56cff91c3031", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176617, "uuid": "a1f9702f-ef97-4dc2-8284-8b54a2d66e05", "value": "24576:+3GsCi5zfuvprurPA+SSqcMNSESDzQSuRZi4QneAVxJwZEVftXEiAbbwK6:+3GW5KprurPAZS8NADteAVH3xA/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176617, "uuid": "679353be-bd2e-4ab0-a4e2-f8a88d788397", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176617, "uuid": "e1c22739-627f-40d4-b2e1-792297024a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176617, "uuid": "abf29b0a-3543-4687-b6e3-b3ad6f90d290", "value": "e06035d9f78c85fa4339323da17895ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccfd0d8-bcf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678197766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197766, "uuid": "bbc766e5-cb10-4d1c-a279-e22130a3440a", "comment": "Malware payload (AgentTesla)", "value": "744c250571669e39e44af8b29e72b066", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197766, "uuid": "3cfa65ae-1d7a-400b-a6ea-7af4dd17bbca", "comment": "Malware payload (AgentTesla)", "value": "8ef9b3c33587021301faa8cdabb00949dcaeaeb1f3cd98dd7908677cc23bff69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197766, "uuid": "53687f5b-b2fe-442f-9316-2f81666b0843", "comment": "Malware payload (AgentTesla)", "value": "06584869ced6e0abf7bd21bb9c715e194f18819b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197766, "uuid": "6a691510-73b3-4e5c-83c5-b88be82db945", "comment": "Malware payload (AgentTesla)", "value": "659fabd89c5a50da98a82dd9dff866aa83e6aac2ab5391c2b25a6e6ccdee9db0c741c85ca4c16aca0930184cd2d79304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197766, "uuid": "182ede88-bffb-4510-bdf5-9e84cfb6342c", "value": "T1A7F3292892C69EE1D31D4074C9B0315806B2A1C79667F76D0EA16CF6BE767C3722ECB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197766, "uuid": "98e7b0ad-a6f1-4d9b-b84a-df26748cb622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197766, "uuid": "fa156fb9-f0cb-40e8-bc25-d8a57be305c3", "value": "3072:f5i5miN9pQl9VXifMiYW0MV8zjyuWJf6ucGRJK2:xi5XM+cW0njyuWJCucGrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197766, "uuid": "2d63e561-dffd-4211-9650-e8575095d0a4", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197766, "uuid": "24a3dc9b-869c-44e7-9462-aad477e360fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197766, "uuid": "50e10b75-2c7c-46ef-8ff5-db61cd9e4ce0", "value": "8ef9b3c33587021301faa8cdabb00949dcaeaeb1f3cd98dd7908677cc23bff69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ac5fcd-bce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678191318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191318, "uuid": "fc78acac-c545-45c1-9f02-707877b979fc", "comment": "Malware payload (AgentTesla)", "value": "1a87b00d5404e20995189b4d9f525f2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191318, "uuid": "f307ec49-07c1-4dac-a6af-35cd6a40cc81", "comment": "Malware payload (AgentTesla)", "value": "8facc9232da36d8813cda98b5171cd425925436f99534effbe571d3762849b3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191318, "uuid": "cffbccb6-154c-4633-85c0-4390cb314ebd", "comment": "Malware payload (AgentTesla)", "value": "3f4e5f31ed10357c26035e0ee169f08e60da7e1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191318, "uuid": "10cbfbf0-ec23-4f50-803d-6fe365e77099", "comment": "Malware payload (AgentTesla)", "value": "05dbcaada09d20faaeea552f97e5f9df9c0c33b3a9010ab3acba687900e4bcfc391c933a269687ebddb3084af8ebe6c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191318, "uuid": "6b3781f6-f6ed-46bf-a538-8cdee23a1af9", "value": "T1B8442371E084338C69E0A9B7473C60FE4F36CC1B4B56D2D4AA09C3FC6C9611DA5AD4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191318, "uuid": "d26281d2-ed33-44b3-8c99-6a86aa4161e9", "value": "6144:fStvsD60bLO5sNZjXMl35Y0u0YEusRl4WmCa3DVFaTk:Ktk+0vGWjo62usH9aTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191318, "uuid": "37ecd150-acef-492f-81dc-a23db6745c3e", "value": 259862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191318, "uuid": "aee34b55-2d1f-4947-8de1-a10cf20483b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191318, "uuid": "07b1eb40-288a-4667-a2fb-5c6cef838940", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1521817-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198659, "uuid": "9ca31d87-56eb-420f-9777-2332360ab715", "comment": "Malware payload (AgentTesla)", "value": "569ef44d486d4161655af3633d73a5ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198659, "uuid": "1da3a7a9-c058-443e-a626-5739cff1ab77", "comment": "Malware payload (AgentTesla)", "value": "901bdc59c476cc6bb91e7bd3716436f972c176094c4479a8309e5560362192ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198659, "uuid": "7878f813-d220-4fd6-99f3-2495bc35c4a3", "comment": "Malware payload (AgentTesla)", "value": "8f280d6e650835cdfeb60d406a9b81fcaa0a0f33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198659, "uuid": "697ea419-f0a0-4580-8db1-bdb5274190ba", "comment": "Malware payload (AgentTesla)", "value": "032b1b112565b7a31ef0473606f8a0c25c06aac3e6df86922dbc179c7fb1933bdbc5068ba522286334668123783d9230", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198659, "uuid": "7663458b-5c95-4206-a02a-bb07fefe8ae9", "value": "T1E1259DA56F19A257E7C1A1B31804E7B6EBAC7D4C1427C1883EE13D8FB1B9D2C1111E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198659, "uuid": "5b8467fb-d6f1-49e4-80d1-166caf07ed82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198659, "uuid": "7e58c774-8530-4ba0-87f4-964d296b1cab", "value": "12288:dHX3FBVmNUfqBe4isYJCM6KV9ZGOY91hb1udYjUGUQ6MPRAhTymycFdNDWnL6:9zYNUfqBpWCiVv2931uCRPRgPyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198659, "uuid": "8b30bda4-eec2-404c-9f6f-91798bdbda96", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198659, "uuid": "aa22ed72-28c5-4c5d-aba5-ab60d6f215a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198659, "uuid": "1e52f482-8d89-48f4-b00f-69cce1146c5e", "value": "569ef44d486d4161655af3633d73a5ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ca4bd6-bd0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678209428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209428, "uuid": "6b7a06b8-6f16-41b9-afcd-aa1dfb882b73", "comment": "Malware payload (GCleaner)", "value": "e6c19bff7f580f6a93a810b1712c1935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209428, "uuid": "e012e9d5-1d54-42d0-b1d5-61925ccd9dd4", "comment": "Malware payload (GCleaner)", "value": "901d0d19ba4a552a8fd41451dd2143a6338376b15b37ed0adc167da496d547b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209428, "uuid": "ca8edd4f-3ad7-4102-a7ca-dadd66a15261", "comment": "Malware payload (GCleaner)", "value": "f1b09fd1320ceb0fa94a8d4b55bbbc7afb25e6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209428, "uuid": "696ae4f7-b83e-4d7f-8a12-1b090f601827", "comment": "Malware payload (GCleaner)", "value": "40c39e6cc0ee7e5efa36afdbf3f078bda294ec9b8b96770ebd4ab9fe801a6168dd6f242fef09f6954ff6f126fb4382f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209428, "uuid": "1aadeb90-8ddd-40ce-b041-f9dca309a60f", "value": "T11FD5339532A8C8FBD174B6747D6C58141F63AAF18CB44DAA73EE89067C3BD904287378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209428, "uuid": "b8bc824a-5369-45da-b2de-434482664b91", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209428, "uuid": "044cfe81-e267-458b-aa4f-09e43a3b974f", "value": "49152:AG/V2zHBtIf4tq4v6lGQ+VMuoLTm071rVl51Hjx0grExnDHzhOKz:d4zHKhC6l/+9ouslvDnruDHzhOKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209428, "uuid": "2f90b691-7f0c-4afb-a2a7-226555ad52af", "value": 2941496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209428, "uuid": "b7be89c0-01d4-4d54-8d4b-f9fe03e023d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209428, "uuid": "194e5148-b743-4348-8da5-3a436664b8a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571085ca-bcb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1678172255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172255, "uuid": "10958a81-b97a-44bb-85f6-9d3347082416", "comment": "Malware payload (Kutaki)", "value": "2287a63b7406f43f915ab259853cf379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172255, "uuid": "d471f8eb-7212-4afa-b2c7-ebd62b06bd70", "comment": "Malware payload (Kutaki)", "value": "9091c765b6802d70470fdd828c8fd81e4659fcee760a81f727bf984845fae484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172255, "uuid": "877e68fc-e0e1-478d-9cfd-8ecaa6d9d266", "comment": "Malware payload (Kutaki)", "value": "f69f36f5e9c00e48628c4d8eea929a95e9ac4ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172255, "uuid": "c249dbd3-a740-4812-8822-1512be18b9dd", "comment": "Malware payload (Kutaki)", "value": "5deb42f870ccd75df335f9663f2bf3c76f6b27aea09aca74c11d1da23e147002d29f67a3da0f84e27019702a01bf1972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172255, "uuid": "b2fdfdc0-07ea-4108-a522-1b43deaf8dc0", "value": "T1E9D4BF13B7C18F42E96E26322ECBD6B052A3B95D4B4703433141737E2D72EA29D6974B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172255, "uuid": "8d6a05b6-e8ae-4192-88ed-f5f24f467d84", "value": "8f7cce2b64e9230bf385963548b4597c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172255, "uuid": "8d757426-a610-4cf1-acb6-e4574aee95a4", "value": "12288:K2AjcRQn03vF46A9jmP/uhu/yMS08CkntxYR66L:K/QRQbfmP/UDMS08Ckn3F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678172255, "uuid": "c9e1ca0f-9440-402b-bf89-99cae04f39e5", "value": 632018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678172255, "uuid": "16012286-7f17-4ccb-a359-1e69bfabc82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172255, "uuid": "f472ad7b-8617-4ad9-a7ac-d25c2707f6c5", "value": "Tax Payment Challan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93b4db4-bd42-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678233032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233032, "uuid": "ccfa14d2-dddd-4b7d-86f5-7e9efeab4536", "comment": "Malware payload (RedLineStealer)", "value": "622779b345a28c3999e46f3d5a6a5ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233032, "uuid": "569b5b80-ad45-4023-aef2-b52dd026300e", "comment": "Malware payload (RedLineStealer)", "value": "9097957ef74a711ac6380a85776aff304b66a2555b395f012c24b8c753ec72eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233032, "uuid": "733e6714-3ca8-440c-8fc9-81a2f2c46a06", "comment": "Malware payload (RedLineStealer)", "value": "21a4dc3be99afa3fba8ac935edaf14e6e59e43b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233032, "uuid": "8e121b3e-82cb-4857-aeb8-3a7797b2f567", "comment": "Malware payload (RedLineStealer)", "value": "7bfed043128447ae83bc0279ba617b64d81da9531b2fe2f596ca121e7349bac6cf2ea4f7163c5c30ca86e2b9d818d5a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233032, "uuid": "96955e11-bc10-4d46-b189-486eeba92a22", "value": "T10134F8217D16C031D56051B629B9BFF2C19DA825ABB049DB7B800F77DA122F67A30E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233032, "uuid": "7fffe6d7-0d5e-4c06-b55e-b37173a3a0d9", "value": "2017e441801511e85de5448e96ddce01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233032, "uuid": "690b5ed4-cf66-4991-a853-15a746e3aac5", "value": "6144:raKMNkZYYYRHqz5yetq1+Gvuli30oU9ci68:udayF1tuli3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678233032, "uuid": "2c639db2-ae77-45b2-a8c6-0ef3f0e5615c", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678233032, "uuid": "1bf89fdf-b217-4696-b91b-f31384752430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233032, "uuid": "077af86f-eae7-43d6-b5a3-fe2c56ec87d8", "value": "622779b345a28c3999e46f3d5a6a5ec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c4ce65-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198430, "uuid": "60dcb4a0-fac3-458b-86ed-86b9b17e7ee9", "comment": "Malware payload", "value": "68aa4f34a072419ae905d1cde1f95657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198430, "uuid": "ea030495-63f8-46b2-b256-5f62e6679b35", "comment": "Malware payload", "value": "91317464f677d1408e609d2296203b84cebed70ebc9aec92b51734c52db5bb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198430, "uuid": "729e2216-1331-4333-a22a-d2cf67f72c0f", "comment": "Malware payload", "value": "eed899d2ae028a58bbb8bfb27c18282c26b2acee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198430, "uuid": "716817a0-833e-42ec-9635-6cb2c837b7d2", "comment": "Malware payload", "value": "c961d4298dd528b9372e59482fa284307d9e043054b350f1370d5cc7965f9a1702d88b6698f08375b694bf0dab0fc1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198430, "uuid": "a638b83f-e0eb-4c99-8641-f27f61171672", "value": "T1AA461C292EFA402AB1B3EF555BD474BAEB5FBB633B1A445900C10B4606D3805EDC927F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198430, "uuid": "51ad892b-0a7e-4db1-a924-82994fdb988c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198430, "uuid": "76d8917f-9084-454a-aecc-67150dbbfbd4", "value": "24576:aSKuD4f2v9Y0Z8jmzN6epIou2dua0acpXXc0GoK1D4f2v9Y0Z8jmzN6epIou2duw:a2cIZ8h4OsoU1cIZ8h4OsoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198430, "uuid": "b99e3705-a26b-4e5e-8852-4aad45402df3", "value": 5497856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198430, "uuid": "f7911141-edb7-4343-a014-2aee3c67fbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198430, "uuid": "8176ca26-69dd-47f9-b118-dcde5b7556c1", "value": "Fund-Notifications-545pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfeaff9c-bce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678190926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190926, "uuid": "6a062351-5951-432c-b0aa-bbfeb5363dbb", "comment": "Malware payload (RemcosRAT)", "value": "8b8a1d0a78303a4b65c72b9cf9ac31cf", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190926, "uuid": "2eebdc39-b3a1-4499-ac39-5f95c94261e0", "comment": "Malware payload (RemcosRAT)", "value": "9182ab817d37f870217e3c3edada625eb6b2ce179f054e12d8b593429cf93d5a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190926, "uuid": "8a0d39d3-99ef-4168-be72-02d2e39b63a8", "comment": "Malware payload (RemcosRAT)", "value": "06670933aae060bc1c025fe528a95941f11df9e7", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190926, "uuid": "f9d4284a-d805-4b94-9e86-b5352a34bfc5", "comment": "Malware payload (RemcosRAT)", "value": "b2cd2294ef08a187eb272df16c96463aad67a0a65dbdc896ab9aa165f30271c7ac3c686cfa6558d58be637ac090bf014", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190926, "uuid": "b6953121-c0f1-4560-b376-059ae7ce5283", "value": "T1B7A5335DBC73AF503FE09ED057CA1FBA42C6D28331A6246D18AF56D9C8433992941CBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190926, "uuid": "6a01974f-8868-4ec5-981b-cc07f35e4433", "value": "49152:5t5GzHW3pW+QHoyPzGwdDibtLTMdQazBo2MWAQgS6aGxF4:FnHQHoyPhdDwGKYi2oV8GF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190926, "uuid": "13bf3cc7-4b89-4bf5-91fb-c32acb99b5a6", "value": 2102227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190926, "uuid": "eaf3b6a8-b1a5-46d6-840f-510d3a9ea765", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190926, "uuid": "66282b94-ebe4-44e6-8ae8-da682ed8a7c5", "value": "0028200282 - INV_pdf.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bece499f-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678196051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196051, "uuid": "033e7356-4011-45c2-959a-2c72e487b9b0", "comment": "Malware payload (Formbook)", "value": "7e327c64c485a1b5dfce14b87c62f86b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196051, "uuid": "c63ff947-0726-4c7f-ae98-8e9c1e3ff59f", "comment": "Malware payload (Formbook)", "value": "925dafd1ddff7befe38bbf594da2c625cc877ea7e69315d4e8fe357644dc0f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196051, "uuid": "a635f72a-aa86-4be6-8060-c3b2876386ce", "comment": "Malware payload (Formbook)", "value": "0681306ba0835dd630942a824da90816a5fa24e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196051, "uuid": "7c4d52b4-6277-4c02-81ee-70c5b53fd751", "comment": "Malware payload (Formbook)", "value": "4735ad3c35ab4733e7ec06dc3edd7ce22b186891b7badd7ff1906601e3cb1e0e531d745776cf49f575e48d8e1dcbef1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196051, "uuid": "05fbc865-3979-48de-9b7b-f3fe7214198d", "value": "T141E46C8DC5BD4312EAFD0F79B19F29480DA0044A266D4D3B97E7F880E17322AB17E65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196051, "uuid": "f734abe3-9af6-4afb-9208-b7eed8c2c0b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196051, "uuid": "f3b16167-e703-4a42-b05c-be8cb561f5e4", "value": "12288:8Peces8JOyvnQvwJcCeZbJ6WW/P5bhu5CUhBwi6C8:Jces8JPvnQIaC7W4VfCBOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196051, "uuid": "b4144c3c-ad85-4730-bd09-3a66988554dc", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196051, "uuid": "d96e6fbd-a258-4e3a-aee0-0f2f3b0c89d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196051, "uuid": "9617f57c-497e-4ecd-bd9e-1b1bbd275e3b", "value": "925dafd1ddff7befe38bbf594da2c625cc877ea7e69315d4e8fe357644dc0f81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfb4823-bc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149798, "uuid": "37f5c656-1673-4a55-84e5-4e11f24470dc", "comment": "Malware payload (Mirai)", "value": "a1a4066dbe2c72cd0555e9b3cec525b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149798, "uuid": "9fefb82f-7535-4c44-b703-017bf60e68fb", "comment": "Malware payload (Mirai)", "value": "92f8184c7cc9402ec224c2c42a5130a790f9c4e6c47910400232cdd6ca9d32d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149798, "uuid": "abe5d88f-7dc4-48b9-bb09-2767c75a9ff4", "comment": "Malware payload (Mirai)", "value": "c7719060c849f53fe11f2b497fda6df586f893bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149798, "uuid": "4684e607-81e2-4c36-8303-686ba79b1dd6", "comment": "Malware payload (Mirai)", "value": "ecc05f4fa9adb1676026316d0a7eaf840d14fb4b2738ea578c3058188f7a843100daced609a83ea31bb4e16e288a082d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149798, "uuid": "02b49d08-d9ff-4845-88b9-919b4c5955f8", "value": "T1AC92D060620A6974C3B01838DEE5428B269B2E74D5FD70331DA14FD4B9D2757706CFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149798, "uuid": "26850ada-c9ad-4e17-9fa4-5fb6ec370239", "value": "384:NrVv08UIlGAzekhRgbaAFr81HiObDWPYSUQTT66AGvMJ7wNwhymdGUop5hz18:3bUIoAzekhObaKr89BxSjqZoMOCs3UoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149798, "uuid": "8b0f0ac2-508e-4cfd-a3c7-3975f10f58fb", "value": 19992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149798, "uuid": "55c3b032-7cf0-48ed-90a8-1747a961d0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149798, "uuid": "b3f11e08-c5a2-4106-952a-35f76f8f99ca", "value": "a1a4066dbe2c72cd0555e9b3cec525b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d208aed-bcef-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678197069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197069, "uuid": "efec010d-1575-4592-8085-27d3e6b4b258", "comment": "Malware payload (GCleaner)", "value": "a3a0d99fa3ee1ad33f109e74e83ff869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197069, "uuid": "4f1b66bc-27fd-4c43-a415-8ffe1f73e7fc", "comment": "Malware payload (GCleaner)", "value": "93cb045c691341fee5fe4b5aae26233c3bdfb480db20a904ef7f7749db2c6e86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197069, "uuid": "5867c9eb-4f4c-4de0-8867-19d3a207419e", "comment": "Malware payload (GCleaner)", "value": "affaba631a5a20feae1184b6a78f52b665868ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197069, "uuid": "25ce1bc5-23d7-498e-a3ae-7718c7ae6212", "comment": "Malware payload (GCleaner)", "value": "58f3c9443e1a3343c91bf35e01f2587bf1e226a0f73c2894e2b890046c83668ffb7e3827a1b64d4926a0e32ef1222afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197069, "uuid": "c658d2be-98ac-4f4a-8fcc-a23e7e28cb80", "value": "T151D53328AFD65C72F0B25F347DF4180C0F57BA17CA39C09AB5981C5B6B458E064C9BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197069, "uuid": "8a5b46a9-ba0b-4feb-9049-0cd295945539", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197069, "uuid": "586b6c7e-9609-4c7d-8b76-1ba39a8f5f8c", "value": "49152:AGPe3orJeXQUQbitHC5QBEPZm/cVfGqjcIDqsnIlfaaIxvTPuS2lUsRAiqGH/2Uz:dPe3QIXLQ2tcQ6ZPvjcIDP8jIxLb2lUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197069, "uuid": "723224b9-2b45-496e-9314-92e06a738001", "value": 2952535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197069, "uuid": "5ab0d5ee-aec0-4a06-a6d0-ce0c81653a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197069, "uuid": "b43878b8-9fba-49b7-b0dd-d0931e4f3ed5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00a3624-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231675, "uuid": "71309351-5ef5-4a83-9030-674742b661b5", "comment": "Malware payload", "value": "71b5779612656f5aeac1fcc9ae8c4591", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231675, "uuid": "23683bf9-8f38-4ad2-bf07-efb312dd94a3", "comment": "Malware payload", "value": "95a14cc17b3dc4cb9e6f4576475e3ac4bcfe502837e44be3c4c07b88a83bc860", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231675, "uuid": "7be66746-eb83-4151-b56b-acb4a718371c", "comment": "Malware payload", "value": "53faa66e42c846c41bd8a6950bebf861667eed58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231675, "uuid": "a9637f68-cd7e-4c89-a219-db3b7cdc61a6", "comment": "Malware payload", "value": "cdc277f13836e1b4180f1c031969472f13d9b63da6985eaca521bee94fbbc27635473b36e72fe767702bde578eb4e3bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231675, "uuid": "e2ff49f1-fc8b-4cf6-bfd1-41bd3ae91f56", "value": "T135347B1176D1C076D25F027A4457872973BABD608FA586C3BFD8BE8D6E302D29F39242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231675, "uuid": "0a8f7955-1a07-46ac-98c4-2bbe75854ab9", "value": "46880354346121d1864f7d05753c4715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231675, "uuid": "65071c0d-d9c6-4a3c-b3dd-c419a44164b1", "value": "3072:jSKdPwUfvFEAXQAnLDkaNU2ljKqMH42TGZ6uvSmyBoDT3lZaBD1dc5/toefOI:+Kh7mIQAnLDk52AZGZ6eH6Nc5We2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231675, "uuid": "5e1a236e-58fc-44d8-9aad-074cafdb221f", "value": 245160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231675, "uuid": "f88bd066-cdde-4c28-8d87-065c342d3598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231675, "uuid": "053896bd-c90d-41e2-a133-0095de4a7de5", "value": "SecuriteInfo.com.Win32.Ramnit-CY.11209.965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc39585-bc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161666, "uuid": "db196481-1446-473e-a999-aec9eeb61e5d", "comment": "Malware payload (Mirai)", "value": "6eeab2d6bd5633fcc07be73e1ac21287", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161666, "uuid": "15522d7c-2f5d-47f0-af56-54566a090369", "comment": "Malware payload (Mirai)", "value": "95b8d380c4eb2fd93eca33c3fc25b0d52eb177dbe9a2b84449bdbfab8681212e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161666, "uuid": "b9b53e08-71b0-49a9-8dfe-3b0f783eea6d", "comment": "Malware payload (Mirai)", "value": "41d79baa8d2a8743d064f6445a8fee85e1eea92e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161666, "uuid": "652b069e-4079-4d46-a9e5-b3e7dd7537c7", "comment": "Malware payload (Mirai)", "value": "4f578246b6b9e1930da61b02e138de686216098d1c5cc88b69bb36b52fe4ee48401663bd3b723549cd6cc0624b506f88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161666, "uuid": "9170e7ac-6c46-4804-9a58-8dcc6a557f0b", "value": "T18E330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161666, "uuid": "0e5e0d5e-e386-4348-87dd-7f847040a4ce", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGl:r/hqaJMDg9eqK806MHdkfQX6HuCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161666, "uuid": "fd840d3c-cc7b-4e2b-8f3d-c655bc9bc6de", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161666, "uuid": "d4c8ec1c-c05d-499e-b9a5-def3732a56c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161666, "uuid": "287e82ca-b870-4d45-85fe-97b75685191a", "value": "6eeab2d6bd5633fcc07be73e1ac21287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100d74b3-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678198765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198765, "uuid": "081152a0-f7f9-4c20-8d04-ed620195ce69", "comment": "Malware payload (Rhadamanthys)", "value": "6426a9c12a40aad907b96837a487e988", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198765, "uuid": "2db2a110-e6a5-4c3a-b955-2a7238b0f250", "comment": "Malware payload (Rhadamanthys)", "value": "95df8e09db02d2956bdd6a91041e3424020e9dc1e2775bac33b6c0af30fada43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198765, "uuid": "9a015364-0428-41b9-be8e-e942bc194c3e", "comment": "Malware payload (Rhadamanthys)", "value": "75d6d49ffeeac90b867bdfcfe997a04fcf14547f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198765, "uuid": "92e46268-f4ce-4fc6-8e1e-c7965e6059a0", "comment": "Malware payload (Rhadamanthys)", "value": "1d3d3a5d6ee0a69510074bff656c2e1bbbe2842d7822e91eeeae9bce5a5297d0f3a10329a323d0af54a16d36bff39101", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198765, "uuid": "f3f90c02-15b9-4f56-b45e-6561e6d0dde1", "value": "T11B54D023F61C5028F169C9FD90CCD7F998FD657623EF60ABA7C414644A163F0A6B422B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198765, "uuid": "f2a261d1-d0c4-4970-83d7-db0937f8d771", "value": "1f7948b75e8007bde9f40a49c22ca16a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198765, "uuid": "6ac15d2b-ed7d-4a1e-a05b-05b3e13e9176", "value": "6144:CcqAPUkzcupqh6R/sdawzeIDTOdKSmmwIZOaH6d6lDlRr:CcqAPUkzcuQh6udaxySmPIIHCx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198765, "uuid": "293420de-3bb6-4a4d-8db2-5a38221ab08a", "value": 303552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198765, "uuid": "641b1b4d-6470-4cf6-8c55-03f01d20c234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198765, "uuid": "ca1b4c0d-4c60-4b7e-8a7e-316a13feaa4b", "value": "6426a9c12a40aad907b96837a487e988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18fcea3-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176353, "uuid": "e7588b09-2edc-40f1-9dff-3037618b84fb", "comment": "Malware payload (Mirai)", "value": "9f0b065385d2714a485d29fd822035f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176353, "uuid": "c0e5278a-b126-4280-b772-fc145454f4e1", "comment": "Malware payload (Mirai)", "value": "96a05057f353293c679e6f648fa1e7b67ef0d9fc0c3b56979553ff9f389a6701", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176353, "uuid": "e572c2c0-965f-443b-9edc-9774b1a51798", "comment": "Malware payload (Mirai)", "value": "919ee9973f021445d566512adb24f26ce6798b80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176353, "uuid": "573665f2-2ba7-47ba-9df6-85a67dc5dfe9", "comment": "Malware payload (Mirai)", "value": "4c60d099349ec47db0b3c433b7134ddf8b719986f3fc6f7511913a99d06b2315b3ded3c7ca369665fbe96b49abb754a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176353, "uuid": "4e7d786a-9ca8-4b9f-897e-37d4b85ec905", "value": "T13B43F682EC819A1BD6D02339BA6F60EE3310B3D9D1DE7747CD115B103A8995F0DBB652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176353, "uuid": "317781ad-b0c7-4be9-8411-e178077edc94", "value": "1536:IatnuCftC3Beq3CKpeH+EBp9HtyyqbLn:ISuCftlKat6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176353, "uuid": "bbfae6b0-95e4-4051-9c90-6f68f0d2692a", "value": 56604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176353, "uuid": "d14453ea-9f34-494d-a21e-a60bea01ff8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176353, "uuid": "bf92e4c2-53ea-4d09-bdff-035b6ecd8650", "value": "9f0b065385d2714a485d29fd822035f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c2f410-bce2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678191531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191531, "uuid": "7d341924-3fbd-49e0-ab30-e1e51070d846", "comment": "Malware payload (AgentTesla)", "value": "8d074b8561b7bbaa71fd8dba9fceea7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191531, "uuid": "8d05f12b-fedb-49dc-82f2-e7696ce20961", "comment": "Malware payload (AgentTesla)", "value": "96c9a2419e229bd026e7b73ad44ae7816d10e8aa3cec41e8de73f89edf430286", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191531, "uuid": "4ce11631-d627-4d91-b413-14070d5852b2", "comment": "Malware payload (AgentTesla)", "value": "b2ecc0f79937c68157faa4360be5680225f4dbf0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191531, "uuid": "9d9abfc5-fdac-4a34-82a0-e5ce8eb8e5da", "comment": "Malware payload (AgentTesla)", "value": "457c697f979faecc5a3d0df1af3f68238d50f3699c4c4458c3a8844de681f2b7a806003125f97221790ede0405655299", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191531, "uuid": "8439e1e1-43df-4602-b41d-f782dbb887f8", "value": "T12653816EE70F09259F5597BB430B4A4949BCB23DB38540B139AC973837EDC2E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191531, "uuid": "00541d8a-3854-46dd-ad33-b51d63abf0c1", "value": "1536:QwAlHZromd3Ciyqo0FcbGbP8VL9IEzQV3ZuD2Q0Fx5e/9HjCZDrw52vmYvYfI:QwAlHZroS3JyqoiTP8VL9ICm3ZuD2Q0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191531, "uuid": "3bb36a46-d461-4120-b0ed-36ba84f46abd", "value": 63565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191531, "uuid": "c2bd7630-4868-432a-bb33-a997184fa6cd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191531, "uuid": "19677c9c-efb9-4b08-ad71-b048ab70edfc", "value": "priceandavailability.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bbf82f-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1678196122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196122, "uuid": "a0b2f281-9bd3-47eb-ac91-8294b8a9fea2", "comment": "Malware payload (Stealc)", "value": "4b1c3818a24229422554fbd56af1c64c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196122, "uuid": "dbce7a4d-e43d-4579-ac02-6177ae42ed3c", "comment": "Malware payload (Stealc)", "value": "979afbc8137f3cb684125b0f15be3c34d8539425366c3a067b98a97e181eb142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196122, "uuid": "6b55cd00-9473-48ba-b8e5-c10c1cd38428", "comment": "Malware payload (Stealc)", "value": "790d86cfed466cae5b05d853cdee214731b87982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196122, "uuid": "ca0fdb27-72a1-4f20-8288-938b58314f03", "comment": "Malware payload (Stealc)", "value": "300d720f6a5e19c00e4ebd64aa78051f781a59a80f3a311590c02455929d1761592445015f3d607028205789615b7548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196122, "uuid": "fbcb0ec0-3604-43f6-b83d-ffcfd0f6ddd0", "value": "T14544DF2073A1C072D6A705B09979DBE26F7B78322670861F376536AE4E307D18B7631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196122, "uuid": "5182dea4-4972-4940-bdb8-6a7351071c29", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196122, "uuid": "4b70e641-00b7-4b4c-bcae-1366803ccd83", "value": "6144:hZLrIUOVTgLSXAvxt6XiFwVumt/gVMNb:hZnIUOVs+2ayFwxt4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196122, "uuid": "7bea0aa9-651b-4f41-b432-9cd93fc2f016", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196122, "uuid": "683f9f2f-5a67-48df-a156-7c02778bea2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196122, "uuid": "9d765fda-e036-4945-a520-2bc71df90435", "value": "4b1c3818a24229422554fbd56af1c64c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c2b7a7-bcb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1678171583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678171583, "uuid": "008dca3f-1816-4846-8354-7c54c4eca188", "comment": "Malware payload (RustyStealer)", "value": "f92c8e818c14a7736b842689ff8ae5d2", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678171583, "uuid": "2c336e24-8bba-4b3e-a873-ea087fe829f1", "comment": "Malware payload (RustyStealer)", "value": "99169403e7aa55ce16fae9df4b53c8d7464d242ad9dd7b52aec3633e279ba5b3", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678171583, "uuid": "286f2ed7-6562-4d7b-b6ab-c32a1279f73a", "comment": "Malware payload (RustyStealer)", "value": "0386314fc76e2167c403612533758939f209ac94", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678171583, "uuid": "0bc0d596-9e43-470a-b718-2f9dd8ca2c98", "comment": "Malware payload (RustyStealer)", "value": "2273a0942532a424a2af920a65832e59eaa946c775792a41a5e7ced9eed17e1e8cdd12beb05cf70ff10ab9ceeb7acd2a", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678171583, "uuid": "de6b90f7-fad5-49af-8d7c-1aebfb230273", "value": "T17BE58C43F69445EAC06AC278874A5323FB72BC8A0724F79B57D456722F63BA01F2D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678171583, "uuid": "12570bc1-2833-4f30-97c5-8bbea2568c45", "value": "07d6165a937a57fe512cd3fff119e68c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678171583, "uuid": "4cda4b0b-376d-4894-b61b-4058f7d242d9", "value": "49152:5A5amZydDe+SOpg98UQFDJ5PSRm4vD9/Ynj95wWpEOmQDVWA/IrG:5lmGYm8mMqEtZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678171583, "uuid": "41b9e793-9f21-4be8-9f5d-7245b0fb4e4f", "value": 3287552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678171583, "uuid": "1d201e76-393a-4c45-bd92-0656e9508931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678171583, "uuid": "e31ed0c1-06d0-4cd0-8182-6cda474bbb0c", "value": "f92c8e818c14a7736b842689ff8ae5d2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dc683d-bd09-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678208404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678208404, "uuid": "9e7bcadf-35e2-43a5-93bf-96c689eade1e", "comment": "Malware payload", "value": "c487ef0ca56ef27e89df95ea91860814", "object_relation": "md5", "Tag": [ { "name": "hworm", "colour": "#D6DE35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678208404, "uuid": "8b0bf85b-4cfd-4240-b5a8-c38d3d0a605a", "comment": "Malware payload", "value": "99613561041525ed0afc6831e5bbe4643ab5cbce4ec6633d13672d4536edfd7c", "object_relation": "sha256", "Tag": [ { "name": "hworm", "colour": "#D6DE35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678208404, "uuid": "ce579f9c-2538-47c1-91ad-8c60da067fb0", "comment": "Malware payload", "value": "14e7883bc7ff4e42194b4a9e1ac571f465755c5d", "object_relation": "sha1", "Tag": [ { "name": "hworm", "colour": "#D6DE35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678208404, "uuid": "2670f193-f553-4e29-b768-05dfdc80c339", "comment": "Malware payload", "value": "24998ae31a8656ce229622f0938bded8383dda43441172e0c1ae7a347e09a5de7501d4e115846c0674715fee139766a9", "object_relation": "sha3-384", "Tag": [ { "name": "hworm", "colour": "#D6DE35", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678208404, "uuid": "c0aeda97-7bf5-4289-8713-29bcbd3d97e7", "value": "T112E14C26B76EBA7F85CB3D601038A9CE6250D1E246FB3A184045EDD8DC374CC42EB65B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678208404, "uuid": "bc500245-350b-4220-aed2-52d89d8162d1", "value": "192:PDc4GyoO/PMyoufYgMyo8aqIVLYMAOmWTc1WmR:PDB9fz/nzaqcWs/mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678208404, "uuid": "a14771cd-64e3-4818-ba90-df7bd038d743", "value": 7224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678208404, "uuid": "d7f7749d-9f58-4ca2-a261-991c9f93ae49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678208404, "uuid": "45728c5c-2526-4ce8-9ce7-84c4e421487a", "value": "evil.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d150da-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1678198960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198960, "uuid": "97734ea5-23d9-4ac0-87d3-32416b23060a", "comment": "Malware payload (Socelars)", "value": "ea1dffab7eaa37262aa2d5557d8915af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198960, "uuid": "b0e78bb2-ccd7-485b-b53d-f52a09a3a30b", "comment": "Malware payload (Socelars)", "value": "9970aa4cf1c6a8708af3447e17defc23ee7cba951a802507563684aa81865fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198960, "uuid": "bc7d158e-2582-4222-a84e-b32cb6145afb", "comment": "Malware payload (Socelars)", "value": "930924541704e8283ef0ae3ebc3dcaf3f407cef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198960, "uuid": "faec4e02-1ca4-41ed-97fe-39af0abdc04e", "comment": "Malware payload (Socelars)", "value": "51b4ece19a4dc6d31d1d754fa31be90f007798fe2bdc460d31d38abe0a6f3e4b305b5f881bdce4a46e5813554a94cafb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198960, "uuid": "4d162003-4c44-4431-a24f-9d5430c59ebd", "value": "T1A7658D21F7C26032E9E310B745FF56BE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198960, "uuid": "2388796e-9a8d-45ca-9a27-b018cddb3c11", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198960, "uuid": "a4c1c96d-9754-4fca-a1f5-a51f0230d29d", "value": "24576:/GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR/F5htSt:epEUIvU0N9jkpjweXt77d5f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198960, "uuid": "eccdcc91-3270-448f-9897-3354d69ea1a6", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198960, "uuid": "4d7f6255-68ef-492f-b457-2e140341a00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198960, "uuid": "0bf6b87b-6497-46bb-88a7-259a271ae4fd", "value": "ea1dffab7eaa37262aa2d5557d8915af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1349b8b7-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678209507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209507, "uuid": "82ff33de-c2f2-452c-97e5-6fec9dea642e", "comment": "Malware payload (RedLineStealer)", "value": "ea554d350e4c10fc818e5318067b1972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209507, "uuid": "63c37900-e6ba-4ee8-b337-0c7a777306a7", "comment": "Malware payload (RedLineStealer)", "value": "997c73cd1e75587de8ddbdbabc4527454f80eb06515efe6f5d8d0bae39e0dfa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209507, "uuid": "d76bef29-c463-490a-94f9-2b2058e1b177", "comment": "Malware payload (RedLineStealer)", "value": "e6d958b493a587240c7ab65c60a0e3e743d9b0f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209507, "uuid": "05965a42-4ba4-4c91-baf5-5de5709c95cf", "comment": "Malware payload (RedLineStealer)", "value": "d5b5753f501b77b13babfeb92fdd648606afd5d23e2425a2ce3511764d596f3620fbf99bac21b89be5e3c8dca28f7978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209507, "uuid": "d123db27-d7dd-42bd-892e-b63b9c8c3223", "value": "T173C4024BBAEC8177E9B4277018F602D3053ABD515B34835B668BAC5E0D725A4F2313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209507, "uuid": "65e60e7d-7f9e-4c8f-b38c-0be22c72d607", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209507, "uuid": "4a588c7e-b615-4172-849c-d4516cd59900", "value": "12288:nMrDy90O3DJfmJxj5kA5n/Fnm8Dyzxi1CPumsM2YveZgs0t:QyV1OJxjH5n9DWxNPumsMFeZ5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209507, "uuid": "9516b13c-374b-4f27-ac7f-f6eacc71499e", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209507, "uuid": "9e46bd3b-615e-4103-88fe-e599725a2c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209507, "uuid": "517a8f96-1012-40ad-af5e-cd0d441f3d9e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbf9b5c-bc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161688, "uuid": "b287bb24-40cf-40b3-82a3-0701fb559952", "comment": "Malware payload (Mirai)", "value": "6e775dbf896245478621e0b4bbfcbe47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161688, "uuid": "5b53b740-f1ca-4b40-8a4d-36964102d313", "comment": "Malware payload (Mirai)", "value": "9996dbc18fbc6d62734036ee6acbded331a2caffc4478526b165b28ae3c9e4f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161688, "uuid": "3bf8ae4d-df01-4520-8640-4471a1ee2252", "comment": "Malware payload (Mirai)", "value": "40a670f96c34d0213c2fb34ac11c03b45e6d5ada", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161688, "uuid": "2299fe0b-9810-4be7-8211-100995a9d222", "comment": "Malware payload (Mirai)", "value": "823644c5ffd9db933ccf74bfcd6b595df478d70f699c828ef9de6fed0258adcf838a199f54f15a9eda75085dd2842f7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161688, "uuid": "664b1247-4442-423a-acd1-82e5c965826f", "value": "T1CDA2D025D3496EF4DFEF9C9493C2C2C276E547C6678BC8E340EEAF016506046BB88D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161688, "uuid": "830457ca-5eb6-4fea-8094-cf8fa5ad024c", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C56OM4uVcqgw05VxJY:9RxsSVsMD6xiJJE5zRWNIN4uVcqgw09e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161688, "uuid": "2fcd1aeb-d814-4e47-acde-0c2bc93000b3", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161688, "uuid": "b7a127ba-7e6d-4933-8f1f-fc4c63e6dc74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161688, "uuid": "712de65f-52f5-4da6-9665-aad5062a3a08", "value": "6e775dbf896245478621e0b4bbfcbe47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d540e89f-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678195659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195659, "uuid": "67567ba8-707d-4685-9e80-136e5720c665", "comment": "Malware payload", "value": "f6772f57c8d65bd3f9e5bf1c76cb4cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195659, "uuid": "9593c84b-92b4-42a8-b05c-6666ee1dd0e1", "comment": "Malware payload", "value": "99f4c43adb5f2ac9e9ac6adc649e378f4ad56c3d3c307097d93f95adc91258a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195659, "uuid": "25eb5209-484d-4e92-8bf8-915e80e5fd37", "comment": "Malware payload", "value": "e2ccf1e0c7f26cf98e054b07c57b4230fdb2c2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195659, "uuid": "d2dce897-7f42-4686-8656-b8c292928d49", "comment": "Malware payload", "value": "1fe90f9ad2f4f74a5b3e6936d42b32a7c40c1df512c44d0aecfee113f76770d84d1aa578b1f7b666ee7a820221a59054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195659, "uuid": "f554caaf-d99c-419a-b4b6-d40ac6892211", "value": "T1BBB633D992F10DEDE825E23AEAC29811E79378170338C1CF4395826B2F63E957477B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195659, "uuid": "d8c90a31-cdad-4e63-adcd-0c514277cce5", "value": "196608:bLF3ZyqzxbAQvaNJm3AqowejuJDUX47dwdW0tnFwB2nT7vYv:nFJyyxy/m3poaUX47d4VnNHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195659, "uuid": "09665fd0-8288-47cb-b6df-c06f1bf2f57e", "value": 10835871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195659, "uuid": "4d705c96-6d5e-4525-9780-44544de57570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195659, "uuid": "cc3a40b2-043a-4b2e-9cd2-5ed719c1025b", "value": "f6772f57c8d65bd3f9e5bf1c76cb4cec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2669fcc-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1678198688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198688, "uuid": "223f9ca2-873e-4fa1-acbb-0bd82015f2ab", "comment": "Malware payload (Socelars)", "value": "c65180a7d0a5faf91760b0e97e92bef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198688, "uuid": "8ecc6123-2db0-4d6d-bcf6-5f37d9a8760a", "comment": "Malware payload (Socelars)", "value": "9a671cbbcd15525d27cfc295861d98d4e8cd144348e8541d78785fb60879d77f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198688, "uuid": "c6d9cddf-ebbb-4d94-ac3e-39fea6fc6513", "comment": "Malware payload (Socelars)", "value": "e9b4ab05680375e27e1edf69dbc02267251cd179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198688, "uuid": "ab04920a-5aeb-44f3-bb0c-c904d3a68cbb", "comment": "Malware payload (Socelars)", "value": "b6340f4d920ca77c9acf0041ac29f270ba7f89646458f931c11f6730639fffc12555c2c9ded69d101d031be7b8bf657b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198688, "uuid": "4c9f18af-a8c4-4173-969c-34d1826158cd", "value": "T105658D21F7C26032E9E310B745FF66BE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198688, "uuid": "6b6d4ebf-8e9f-44c7-83a5-aabaa2d935a8", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198688, "uuid": "062b05bf-2664-4920-8158-9a320b4a039f", "value": "24576:JGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR7W5h1St:MpEUIvU0N9jkpjweXt77C5H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198688, "uuid": "e4c6c8f3-567c-4451-ac83-557a09d36885", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198688, "uuid": "87193919-baf1-47ce-9c2b-05d3f6ce36cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198688, "uuid": "0ca3574e-ad6b-47c0-8dd8-f2e51897fd9d", "value": "c65180a7d0a5faf91760b0e97e92bef2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017f9bc4-bca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163951, "uuid": "7f526b4e-c0f9-4bb7-91ee-ae5806d40610", "comment": "Malware payload (GandCrab)", "value": "059a13c59621098f30349ceb2518ac95", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163951, "uuid": "e3e5a25d-319b-4ceb-816f-798d5e4e8c4c", "comment": "Malware payload (GandCrab)", "value": "9ae362cbb590010114ff6825344292d38d78b5672a64ec0cd030dff8f72c2196", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163951, "uuid": "264297b2-7cde-49fc-a230-ab7ef25af105", "comment": "Malware payload (GandCrab)", "value": "d39780374310ab1836ba25bc9414b27c8e3c0868", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163951, "uuid": "4d09dba7-73ba-4b62-9572-d58367c096b5", "comment": "Malware payload (GandCrab)", "value": "952d04a6e55df7e39a5189ad8114dd66b82b7a8210d833650675128bfcb5e5a1fcc35777f39f66201c2d7427f3d4e883", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163951, "uuid": "dfad1c06-46c8-4a56-ba76-a9cbbd623a7e", "value": "T172636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163951, "uuid": "aa7d201c-7c35-448f-897d-977233056fec", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163951, "uuid": "8b4446c5-19a0-4c94-9cc0-69df8806d8bd", "value": "1536:KZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:hd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163951, "uuid": "6c73e8d1-7fca-47b1-a64a-a04c816933b8", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163951, "uuid": "760effab-d4e7-45fd-9962-3211aad7a05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163951, "uuid": "475cb957-82a4-4c96-87e4-78d8301577c2", "value": "2023-03-06_059a13c59621098f30349ceb2518ac95_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f3be2b-bd14-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1678213322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213322, "uuid": "212502f8-eef1-474d-8660-5e6a6a7046fa", "comment": "Malware payload (Cobalt Strike)", "value": "5bedc21224025369c1dba514fc4f6859", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213322, "uuid": "0c82a8e5-b9f1-48e6-82f1-8788de629f77", "comment": "Malware payload (Cobalt Strike)", "value": "9bb31ac6d350fec7927ae213adec3f4363b815c7afce36495286a3c281db5412", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213322, "uuid": "778c2c2a-7eee-4507-8e45-18e535fb2283", "comment": "Malware payload (Cobalt Strike)", "value": "3f7a61b80bd7438fda64ee6a4079b86cfae011cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213322, "uuid": "09355308-ec87-4578-a902-133e2c60d38e", "comment": "Malware payload (Cobalt Strike)", "value": "8c8f034517a2a81e03d1b9217bfad6af5ef45a2403a457dac80292f834d2c666dd437b99b6257531e58bf4b4bbce0a09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213322, "uuid": "b23d5d96-106d-43cb-871d-e28ba75d336c", "value": "T13DF41232B7E1D431C5A7657064206A985F7FB83353A1F56B372C0ABE2E343E16926B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213322, "uuid": "f4764cde-f0c2-4711-8be3-78898279a5bc", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213322, "uuid": "fd7aaedf-6f7c-42ce-b50b-e5eb137e2968", "value": "12288:YuKKhMsI5SIBJrfliXPYrikFBpBtaLMpMsGwu8CQvPpCjsewDv4aRDxLoKMIHqeg:nMsMPsX0zPaLcMswApBemv9dMwHqTPlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213322, "uuid": "44960f87-7416-4192-9d61-4c071d774bc1", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213322, "uuid": "c83c3139-5cc7-4796-89df-f48f0d080f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213322, "uuid": "b202bcf5-70b9-4b00-b77e-abe3569b6e45", "value": "5bedc21224025369c1dba514fc4f6859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5860e2f-bcb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1678170239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170239, "uuid": "67b2b7b2-313e-4708-8293-580f63f43ab6", "comment": "Malware payload (Vidar)", "value": "28f43e54049a99dab96198f5bfb103e9", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170239, "uuid": "e3f03a44-71a6-4821-a8cf-9b74b5449d81", "comment": "Malware payload (Vidar)", "value": "9bb44477f819d5e21fccd7431311639444e8cf7793c05bf2bc1d6b2e235b6108", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170239, "uuid": "f174805b-459e-42b0-a0c6-ccaf3020d91b", "comment": "Malware payload (Vidar)", "value": "3fb64cb7ddc0ac83ee196fc048af2bbbdc87873a", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170239, "uuid": "bf373577-4335-47cf-bf31-3beb6fbce631", "comment": "Malware payload (Vidar)", "value": "8c8c6141c6d353a6b62e1d9f1af5adbcdf01e56708dee0bc1be077be91c4bca0962ca1e48d55f6ee5822f6ca22d769e2", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170239, "uuid": "215cf875-fd0b-44c5-9ad4-534151f2aa20", "value": "T188B4CFB6A7A8A931E53EF734E935541042BE3CB9A813CE5E94426E993B733C11FD049C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170239, "uuid": "c3e7a8e3-f713-434b-81fc-2ae99967f792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170239, "uuid": "314611fa-107c-4a6f-9405-accefe01c1e7", "value": "6144:1zIGwu0M0Fp4w/waCheOXZNWDHM57BPWB3lIQftgz3rDdYXuTkz:2Gwu9Qea8euNWjeMoQWz3uXuTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678170239, "uuid": "03472a06-098d-41f0-8a4c-eac95e304a99", "value": 497416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678170239, "uuid": "309c9334-04f8-4832-b67b-ff8bc366595b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170239, "uuid": "9b9f7f97-2d60-429e-850b-220705a03ef3", "value": "28f43e54049a99dab96198f5bfb103e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d086ddb7-bcf9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678201664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201664, "uuid": "95a2d468-a5b1-4b37-b8c2-d6e91a154175", "comment": "Malware payload (AgentTesla)", "value": "4560193b469fba0faadbd79d31a9a499", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201664, "uuid": "59e400c0-f5c9-4204-9801-0bec68076d09", "comment": "Malware payload (AgentTesla)", "value": "9bebe1f8ba36a10f4c4da24bb68d6d08e019571f76a1b4473200fd6e26a76a38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201664, "uuid": "77dd1063-afd0-403c-b47d-91c17c18ba02", "comment": "Malware payload (AgentTesla)", "value": "1d074ff2017c2bb99bc6149c5a323da29875031f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201664, "uuid": "0ace0f3c-d421-441d-aec8-b14f473a030b", "comment": "Malware payload (AgentTesla)", "value": "177cf674da02678e1f69008bdb21e260dc4defc244630feea1da068fea739c7d87936175f550352d0aeafedaf0322499", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201664, "uuid": "947c0c7f-adb6-4a9f-aa2e-6151d7973a9c", "value": "T1DC958CF0ADA3BE8887AB1D9491DC28C04C6C1B9B479D8648FECC1546E6E1A64FFCD570", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201664, "uuid": "77b22f40-a94a-4032-9e91-153856ee83df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201664, "uuid": "ca59da4b-7416-467d-9319-296610e0c7d7", "value": "24576:XBUz183gX3QFJPGeGqwOgBe3+GDfNG+rXm2UULfaF04JItxXeerr:x+ze9JgBOa81DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678201664, "uuid": "b980b586-8055-49f2-a8f9-71847b283bd8", "value": 2040320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678201664, "uuid": "60ccea84-2e2e-4231-9fbd-62f91e06709a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201664, "uuid": "c4f578c5-5d6f-4133-ab29-2d3c1bcd8913", "value": "4560193b469fba0faadbd79d31a9a499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445e8923-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678210019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210019, "uuid": "85227533-e26f-4936-9608-6ff138880fe2", "comment": "Malware payload", "value": "ac0d5e1ec2664ad36db8877078bcf6c3", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210019, "uuid": "2c55f62b-b0a6-4f27-b9aa-b6f532032f47", "comment": "Malware payload", "value": "9c116add10c5df49593da2aa2d8a887dbd7970e5c1a50bc58626a98ef386968f", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210019, "uuid": "6cf845fc-ec2a-4305-ad2a-f2754802b201", "comment": "Malware payload", "value": "d8631b2830af376932be65a5a7785df3bda93798", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210019, "uuid": "091342c8-e9ae-4f9e-9158-7261c9fa275c", "comment": "Malware payload", "value": "4f3babc0975cb1eb660c0eb710c54e7c6e828a79654f611f02c68e2eb2e771f7a93efa73cc486f5898ceda8bf0de40e3", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210019, "uuid": "59b14517-22aa-4e12-aa6f-dd73a31dd286", "value": "T1D0461A87B8918643C4E4367AB8BEC0D432636EBD9B9B52576D04FE3D3ABD1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210019, "uuid": "6aff1c99-2b0e-4252-8a98-7ba5f37faa54", "value": "49152:4rUoHPHVForheCJlCBeKl6ET9KHH1jFiZhe+b1:IUoHP1ForheqocF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210019, "uuid": "67ddc71e-da36-49b5-8d45-46115e01e968", "value": 5636096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210019, "uuid": "7bd2b3ed-6c31-4805-89f0-77e687e83a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210019, "uuid": "3c755a7f-371c-4063-91ff-c070acd36d55", "value": "d_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cb2fd5-bcdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678190188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190188, "uuid": "14d9aec6-f989-4fae-a00b-5a5671ecbc59", "comment": "Malware payload (SnakeKeylogger)", "value": "46ed76d1d2f6fd37e4eb4c9f07e078ca", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190188, "uuid": "bd4862c0-3cad-4ed3-aa96-e536a5545096", "comment": "Malware payload (SnakeKeylogger)", "value": "9ca93c2486ddb772d48f3d619ef603070600da0e40fe16de3caae5e3b30f3735", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190188, "uuid": "ae3c2de8-15ac-45d4-a7f6-f474bf744663", "comment": "Malware payload (SnakeKeylogger)", "value": "f8ded6d3992b85270a566be20523c5dad058cbd0", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190188, "uuid": "2ba228b4-8930-422f-a7ac-c0217e3a454b", "comment": "Malware payload (SnakeKeylogger)", "value": "3ea7ca1268ef6e7335061d2324222a87b255ee4d378e8f2a6389f61bc4e6d4854d6374b18858ebc0d98681895f821aa7", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190188, "uuid": "df8826fb-d8cd-4e96-882e-80022a580b08", "value": "T1E422C3410B8EA8F1C768E2734229142919BDF62F36430AF835DCD59533BD60E6AF91F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190188, "uuid": "a2cd79d1-7ee1-48c7-9493-3c4481fa29b4", "value": "192:KKyvqB+RMHu44moA8xiuEkkM6SE4078ZiGUeAT6WOjyss1:GEh4moQuEZMi40HGUeAT6WOzs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190188, "uuid": "b04c8da0-2521-4dbd-af08-65d495d986e4", "value": 10093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190188, "uuid": "387c5ec6-ac37-4b3c-be63-79364803aba1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190188, "uuid": "b87d6558-d0f8-4a8d-a89a-ed7d5d741267", "value": "46ed76d1d2f6fd37e4eb4c9f07e078ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b07bd70-bcb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1678172262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172262, "uuid": "9a5f4f5e-72d3-41ea-ba4d-b0e6fee0d895", "comment": "Malware payload (YoungLotus)", "value": "3b4ab4203a31d3599445aa07e5734a46", "object_relation": "md5", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172262, "uuid": "c787ced5-e22f-4384-b467-74478d214d11", "comment": "Malware payload (YoungLotus)", "value": "9cb5e5a87d2dd89e237b75351840c574b38df763ca5345baeaa3d7b1884ac8dd", "object_relation": "sha256", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172262, "uuid": "98b7adc7-07f8-49e0-8552-21b81b26c27b", "comment": "Malware payload (YoungLotus)", "value": "abfb81229c3295584a80b7f840ed6705605ccbf1", "object_relation": "sha1", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172262, "uuid": "6cf43ccc-07b5-41db-9701-010570e69834", "comment": "Malware payload (YoungLotus)", "value": "ad3120e925c4c64217704f2747da023158267219a6603096f97f2adff08bdbaa51df9eb35964c14f1dc89b4f45a6cf6b", "object_relation": "sha3-384", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172262, "uuid": "ede2db6a-fc0c-42d8-96ae-0da29f0b209d", "value": "T17106E071B28040BDE12A063E65F5ADFA2419FC326B668DAE2F9D7F7D49713C0142E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172262, "uuid": "3b4c1f77-2b04-4bf1-8134-1ec02199b959", "value": "b462095fea3219e285e54ac0547eead6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172262, "uuid": "18425677-425d-477c-b872-ec2e4af689a6", "value": "49152:omSwlEgEB7+1mMOFlY/0bO5vGbAY4GPx/7JQ5okCkPSu:omhEgcy0HO5vGbAY4GhNi5xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678172262, "uuid": "80d8396d-b1ba-4809-b110-2a227dbcac98", "value": 3699712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678172262, "uuid": "84f75137-352b-4ed0-aeee-8f6d958c18c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172262, "uuid": "bbc3681b-27cb-485c-a0aa-05357148ee5d", "value": "202303060202152.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daced1ea-bc89-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678153578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153578, "uuid": "5487b715-c1d3-436c-9421-32d4210a3c25", "comment": "Malware payload", "value": "a0287cf41cf5459602dee2aca1a286e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153578, "uuid": "3e7a950d-8e38-49de-bb7e-0a7b9fb37a1c", "comment": "Malware payload", "value": "9cd55fb0ff687feda88e3494d8d8d4bee24692cdfe1e34e6d724a6d31c2e3282", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153578, "uuid": "e50d0ce0-76a2-4423-8741-19a232a83fea", "comment": "Malware payload", "value": "0dd5da82c15ebb7541e630e8bd470a132f0fb16d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678153578, "uuid": "e4db556e-8753-4017-a9c1-d9b568a876de", "comment": "Malware payload", "value": "8991864ddb27afed74262b0458ac5dc1509cdb6b00d54384946d2ff28ceff760660af2c672a3878722f1bc3d7e2a2375", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153578, "uuid": "afc59d10-a443-4291-b475-dc9dfdf62fc5", "value": "T17AD40122B151C49BD5A773F2497D0AA21A97FE112874A20E23317B5E3777143CC6DBAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153578, "uuid": "c7914a6b-305f-4c9f-b0a9-74f14384624b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153578, "uuid": "a9dd55fa-f198-4dee-b877-574341840c8a", "value": "6144:2Ya6YVZVEJIXBqA2crL7urWI4yYNY5cqI:2YOVFxjrLaSI4yl5lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678153578, "uuid": "a2cd88c3-a9f0-4f6b-955e-eec91f3e9ac8", "value": 612444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678153578, "uuid": "17c34d27-3756-461e-a988-81dbd92ca7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678153578, "uuid": "02900af0-93e1-4f17-a06a-414368e306b2", "value": "a0287cf41cf5459602dee2aca1a286e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38cf14a-bd1a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678215870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215870, "uuid": "97c987c1-cff0-4eb5-8b9e-d0e90b81278c", "comment": "Malware payload (RedLineStealer)", "value": "69fb73e283630210dcb0e9b400a1ee4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215870, "uuid": "959088ad-c843-40bf-a3b7-d78b26015241", "comment": "Malware payload (RedLineStealer)", "value": "9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215870, "uuid": "29c3ff13-1f7e-4134-896f-703cc06b5a25", "comment": "Malware payload (RedLineStealer)", "value": "f746b5f15ebf476579d0705720ab4daec3306e41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215870, "uuid": "80d275b4-cf52-4710-b0e2-83b9ae731fbd", "comment": "Malware payload (RedLineStealer)", "value": "ee7a4d3ec35be1d74506b0d099f9ed8f1d2f69510ee765339bb67245bf212f8a81a224cf109c4c99908780b2f24fdc5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215870, "uuid": "45e7ad3e-17ee-4e21-8ac7-c82cca613ebf", "value": "T18F84F022F7E1C0B6D7B7417C18758AD46E3FB4B11564888B23690B9E1F306E1AA7731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215870, "uuid": "c8ffaf30-601b-4fda-992a-25718c48f3bd", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215870, "uuid": "6939e9c5-75f7-4472-af62-8d8e31cacd86", "value": "6144:YY0L64nRBgQZ50kxyZCQj4pPIuVBNX++ZbE8GqcdPQrixxAAY4eZu:YY0O4RBgQwsyZj4pPlxu+ZQ8id4rixxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678215870, "uuid": "a04d8e3b-153f-4f3f-b5b8-eab109c9a4e0", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678215870, "uuid": "7ec39082-9675-4f10-8e80-38f4168b1be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215870, "uuid": "b8c1d78f-33f0-4d49-af01-d9a35eb4177d", "value": "69fb73e283630210dcb0e9b400a1ee4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4bb2f8-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209742, "uuid": "0257c9f3-4e43-4dc0-acf9-371545a1dbe3", "comment": "Malware payload", "value": "098d65390f8f45211a95a197eade4924", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209742, "uuid": "b9494106-2ea1-4039-a5f4-828f30b96baa", "comment": "Malware payload", "value": "9d66a5cefbcd4bdc4719a279ce6734c6d7a179533304d9c6838a3e9f3dad6974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209742, "uuid": "dccaf112-051a-4580-b7e0-ea88c16eec0b", "comment": "Malware payload", "value": "2db0792bcf7e46bee5725c004da644d594cc6e25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209742, "uuid": "9be95c33-62b5-4ec9-8258-4a2dfd916746", "comment": "Malware payload", "value": "16de6c7ef7e7be337417c357e47faa14741a89a6b56399b39b958dc1a3c5c349345613e0ba3fb902d88d34404956589a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209742, "uuid": "ef5ded3d-4a7c-4b8c-8fe3-730a327ddca4", "value": "T147369D467B52A0F7C28F42B5B01E9339AE735518A3058EE3C7906DB4A9B53D12D3B72C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209742, "uuid": "676c5186-328f-42bb-8fc1-0f95235a962c", "value": "f00136899a62e795e9776b6db07e3031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209742, "uuid": "2b5476b0-1959-40c5-9489-0a0fb0612b37", "value": "98304:0PVDIiu7YdOAElxReHVL4iWbx1avQB2/PqwWqMbfhXc0O3w9+OHW3O4aO6u+C72:0PVDIiu0dOAElxReHVL4iWbx1avQB2/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209742, "uuid": "077ad9f7-7ba3-45f2-95b0-a196fb5ca5db", "value": 4995584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209742, "uuid": "060b5d4d-4120-482c-a4d7-e98487c483ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209742, "uuid": "7186e5db-15e0-4010-b311-e4425d6bf44f", "value": "098d65390f8f45211a95a197eade4924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e639cb-bcf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678199769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199769, "uuid": "e6716e4c-91cf-4557-8b9b-39a0d85da161", "comment": "Malware payload (RedLineStealer)", "value": "abe218d09ea20cd6677bb6a7e1aca07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199769, "uuid": "24d9784f-f3b4-4d9a-a7ec-4b2c02b4494a", "comment": "Malware payload (RedLineStealer)", "value": "9e075cfce69b8fceb8028d1f8647c3f8abde1964fa44a3f65254cc1c2993a7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199769, "uuid": "440c2e93-406b-4ae6-993a-628ce5d36803", "comment": "Malware payload (RedLineStealer)", "value": "eb2e23306a9aecc617b4798c4dab58bf37caa438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199769, "uuid": "1b4aef4f-2ca5-40d4-989b-e4c5d396e67b", "comment": "Malware payload (RedLineStealer)", "value": "2db92404938bfb6f701dc7e8599c21ec454ba793448fbd4ef7d7931f2e0bf977253bde7c069dd50d85d9a5d829bcaf3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199769, "uuid": "f2085deb-beb0-4363-b026-7b8349a37a34", "value": "T1F174F12176E0C073C7E751B09935EAD4AA3FB8321664465F33A9169D3E307F09A6E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199769, "uuid": "e4663ef1-ece2-47d9-b533-d07aca4114a2", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199769, "uuid": "09304318-98dc-431f-9677-077db652abbf", "value": "6144:A8L22mM+YgCpTJvObOKXE8/BJVq2UDRVcivk+RVZyypj4eZ:xS2mM+YgKTJvOy8XVXUdV1vk+RVZpTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199769, "uuid": "d4f967a1-48fe-411c-bc69-c0141448580f", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199769, "uuid": "d0b93d5a-5183-4cee-a850-0b3f3c7ee034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199769, "uuid": "07c28da2-3d81-4c33-8984-298af194156f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d00bb0-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678195665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195665, "uuid": "bf5fb67a-9a89-419d-92ba-5ce93ac6a78b", "comment": "Malware payload (Mirai)", "value": "b0e0daea02305623206826cda9ccbb47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195665, "uuid": "c6be5125-dffc-4cce-8410-4aa1429efbcb", "comment": "Malware payload (Mirai)", "value": "9e076b9d03f8a589f30597c3802815ee8fe89b430d9f7a7c99c599001425801e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195665, "uuid": "6c638ff6-e511-4de5-bb9c-016b3c6694d3", "comment": "Malware payload (Mirai)", "value": "b96a00de7e864a5db61726e7e5d71c1cab32294e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195665, "uuid": "6245573e-ee8c-44ba-b995-7ccbe6a1bcb6", "comment": "Malware payload (Mirai)", "value": "8acf4a6c3f218ddf895f9a71eafa3ecf750ca80ae243a9406a8a998e474d49c1364920ba437d971382992e041b8558ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195665, "uuid": "bf70b707-541e-4732-8450-81601f319831", "value": "T134E2F1D1561988C3DA307D74DA75C4DA6AAA0F3CE4B8B031061312E45FD78C7BBEB882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195665, "uuid": "f1f25c03-fc74-47a9-af69-5a684c9b8c94", "value": "768:2oiWiO031vAEqKBA2NO1cxxpSJc9q3UEL5IQ:2orm1vAEqKBHUL/L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195665, "uuid": "0d3e7edb-1f0d-4399-8be5-40d31e29eec4", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195665, "uuid": "fa143eaf-1679-4746-902a-280be5b6ea91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195665, "uuid": "fb23cdfd-5dd0-4c44-a75a-a5b7dfbffa81", "value": "b0e0daea02305623206826cda9ccbb47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184069a1-bcee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678196631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196631, "uuid": "c3a8e556-a25e-48a2-a239-fc7c74f3126e", "comment": "Malware payload (Loki)", "value": "7a23a5f74976371470928eb2890ec004", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196631, "uuid": "8904664b-e0a4-4467-98de-5f77ca87cd81", "comment": "Malware payload (Loki)", "value": "9f07526113de664ebe677f020b48935685fe84d8d70e7b2a8db74d80c85ecde6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196631, "uuid": "2dd79c6c-a378-4bb7-91f1-8705a6530f48", "comment": "Malware payload (Loki)", "value": "00e47ad87baca3ec8d59a9e4e03076feb2f7b42d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196631, "uuid": "037abe60-dd81-4257-b001-fec49ac5f576", "comment": "Malware payload (Loki)", "value": "10a3b43726873cb3f354f00a53e96e6127b9dd236ab3edc7f523efd0bc8d5243620d3a695171dd6c658a1003ff8a013a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196631, "uuid": "e3746fc5-7fc5-49b3-87ec-a1e8f76bd3e2", "value": "T16F45F00392389D4BE102C7BDBA2F7519110E7D3271D5A9CA368DB70A4B33FA659BF109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196631, "uuid": "140b9b0a-3768-4168-94de-49f748b87d07", "value": "24576:0LKGB1tHlxbWQmmav30xlBiWtHlxkWQmmav30xS6FqxJEtn:0LKGV76QmmQ30vw075QmmQ30o60K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196631, "uuid": "7dac264d-127c-4dde-af7f-dbfa67b6e75f", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196631, "uuid": "50f2f87b-7d1b-4a84-ad23-dcaade78b8ad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196631, "uuid": "3503a075-943e-4c0a-a10e-79b934a34580", "value": "Mv_blue ship_00456.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093e5b9d-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678198753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198753, "uuid": "564b1cc1-c3f2-42e9-a30c-64694d894ae3", "comment": "Malware payload (Mirai)", "value": "c28f64be5bb2e44f603deeeab3800834", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198753, "uuid": "e51ca520-abd5-41a4-a23b-e2fb8414b6da", "comment": "Malware payload (Mirai)", "value": "9f7c77a3cde1a627abd7da96c8f2f482368b23cc662281426bcb43fd5d789f5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198753, "uuid": "29ed33ff-4458-4ad0-b309-33b62d6f18f7", "comment": "Malware payload (Mirai)", "value": "677c990cbeccbb3e5ab54e6e28645b2ca7404d8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198753, "uuid": "8c8c0fb8-34ba-47cf-8c50-30520b614793", "comment": "Malware payload (Mirai)", "value": "8a6e969ee4c2ce863ccca992feea289cf7a60c76c0ba10189aeab2dad8da371d47356b10c33f9a5ef1e3e678b6a5ca66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198753, "uuid": "a5ec4c76-0cec-4e59-9316-1d9226ae600a", "value": "T1AE243BD2FA01DE79F01BB23904E30638E670AFA58653C317736B35A59D362D21D1BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198753, "uuid": "46e2bba1-5a1d-4ba4-8eb9-5fdc64a6eb64", "value": "3072:OJBem/VoVQVZqr7v8YkTWEJ8SjPvNcylYuG6ePH260LD4oMai0bUgHF:OJ18/uBJzjPiylrGv10LD4oMai0bUgHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198753, "uuid": "7f9f5748-ec09-46bb-92fa-98efc9be7d72", "value": 212869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198753, "uuid": "ce44af09-4b19-463f-a5d3-a211c6225203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198753, "uuid": "afccaa9e-bf93-4ecb-a43d-6fb643d726e6", "value": "c28f64be5bb2e44f603deeeab3800834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869f416a-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678192092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192092, "uuid": "afeccf99-cb04-4449-9202-289befef2a4a", "comment": "Malware payload", "value": "5a509962fbc3c078d6e7097acb92d5bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192092, "uuid": "bb628bb2-f864-4aff-8c27-0e84138c6ae7", "comment": "Malware payload", "value": "9fb69fba11d9d0d9dd65347059db5690f3930c2b3a773406ee24dd40510480a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192092, "uuid": "8468fec5-c08f-497d-9b84-336f5529cb91", "comment": "Malware payload", "value": "4ece76988397e0c74cc369e6233b1350ff41d335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192092, "uuid": "5eb80aee-4aa8-4f01-a992-c06fe48f6e03", "comment": "Malware payload", "value": "64dc0775c77dec1d9e2818ed46534b3f0c98442d7c1b719afc9b5e0844a6555c54d8447e41589bbc1469195d88738252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192092, "uuid": "061bebf0-afed-4bfa-810d-f70770c12694", "value": "T11867122B72A88229C1EEC23F85934F10D933B1B95733C5E752A006693F165D96E7E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192092, "uuid": "40b6ceec-6fad-4bbe-bfaa-0bf5d7ff695f", "value": "1c4573cbe16194d246513676e8728cb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192092, "uuid": "6ac86c42-6067-4708-a82b-42704e24e49d", "value": "786432:jEp+Ty2SfUfnLZnvko+Me/ht8+0c4Nz55TOZHzqnIllmZpTFISpU:gp+Ty2SfWnVvkodepC+05NbOZHzqnIl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192092, "uuid": "5f53979b-076f-468b-9c29-7ec4e6973313", "value": 29857280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192092, "uuid": "e5ae9bf0-5db3-4870-a543-07fe6b0d5d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192092, "uuid": "d9a8b54b-86ba-4979-a68e-29fd8ee5b9bd", "value": "5738403681\u00ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b9f461-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678192728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192728, "uuid": "3e05b2a2-51a2-421d-8bd3-3b1a9dfc0800", "comment": "Malware payload", "value": "f04f49cf0fac776cecde254b5b8e3b75", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192728, "uuid": "3c136b9b-d770-489b-bf18-411e7d1085ca", "comment": "Malware payload", "value": "9ff71b633c947942d5b2b4ffdc0e771c9e167ae1cf07dc126ceaccdf4891ae9c", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192728, "uuid": "537a7a1f-d343-4332-9658-c9d852e9e954", "comment": "Malware payload", "value": "89213f63fae341871dc6cadf3d1cdda9679a7382", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192728, "uuid": "ff9e558f-3ba1-4e4d-81a2-5d0af8689c0c", "comment": "Malware payload", "value": "3786c5eadc9a1720e318815d0c720363a44cf9ee207b70a9dfebac7bb4dbd7ea5f2228031eb45cafc8afa8394d82e55c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192728, "uuid": "dfedea75-bb18-4db7-86d5-fcbde43fcab3", "value": "T16885CE716BC4FB21CC6823F2369B677403F545AD80A1EB0B6F49AEB16C168953B4B44F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192728, "uuid": "a46fa584-fd13-48b2-89cd-aae8b84ba276", "value": "24576:djSYsFy7sr5FlMFHPi3OgwF9l6g8Qj6gpcyqf23dpeeCXr77RK75L77P:dOYsFy7sr5j4dhjnl/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192728, "uuid": "c6854cc3-e4f9-4820-bcc5-8038bfbdcc7d", "value": 1797127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192728, "uuid": "2e3a3265-e79a-4d68-b4f2-72d8ffe4a9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192728, "uuid": "40d68ae4-3a5a-4e35-8efe-b6e24f8287aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2565735-bca6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678165966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165966, "uuid": "3f6086cc-cc12-4bef-9ac6-66bfa30d9a01", "comment": "Malware payload", "value": "7c5cba9d017262c75c329d88203499d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165966, "uuid": "32aa4ee6-d8f8-4476-85c0-f0f635319a41", "comment": "Malware payload", "value": "a0faa214e3ea50506c487ccaf08a94a951ec92bac7d776d5f40c325e01f0ecb5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165966, "uuid": "e3b61f94-82ea-4e8b-a37a-101adf184f40", "comment": "Malware payload", "value": "4e2b80cf9d2ec3ba458110456037e53f2b86bacd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165966, "uuid": "6a6a3145-70ce-490a-ac20-af59ce023ef5", "comment": "Malware payload", "value": "578384a4cc4e271bbcb0488c35c50bcbf73e7860265197c62b6f3c5ba5d8f8d7ba406bf92d0a9daf5071437e3173a095", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165966, "uuid": "dd8051e9-f1fb-4b00-b7eb-2120ca4d72d0", "value": "T16B940257B240421BF0A206B74B67CFA52B26BC709F17504EB0F6BB1DAEB134A5D1A2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165966, "uuid": "4530d0cb-255b-4477-832a-ae88f1bb3d01", "value": "1536:OiSEfL9zAzUZJi7XsyOKxijFyZWM+O2W9KDUHCRrNOthAXzBu7/1Qq61NRn3drB0:jpZPibaKxIyQM+eEZ0ou7/1Qq61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678165966, "uuid": "0c1a1492-f328-41ae-b5fd-22a61ad209cd", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678165966, "uuid": "c84495ff-e657-48b8-a917-b4dd69cda6e2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165966, "uuid": "b6842cad-dcfb-435e-8f99-7e24fdb984c6", "value": "mal.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f3a264-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192849, "uuid": "1b4e414e-ca02-473e-8f3d-6eaea8d2dd9f", "comment": "Malware payload (AgentTesla)", "value": "5af8c13f1935c19c755ab8038464625d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192849, "uuid": "775fcd4b-093e-4d8d-a675-93d0b9f49847", "comment": "Malware payload (AgentTesla)", "value": "a12d30e3ea7930d9487d94e80d52834b838a518d834febddecea4c1e1d3e204e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192849, "uuid": "155fb527-5836-435b-8d6f-397bbc63e8b0", "comment": "Malware payload (AgentTesla)", "value": "da33b9fba80661ec84a9e22bf43017d19d90d72a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192849, "uuid": "7fad8c61-49df-48c2-a4c8-1d8107f30d41", "comment": "Malware payload (AgentTesla)", "value": "b7ffa3df3c0503bb9862deba44fa519407514a95d06a5a144f5fe002641a00b7593773d8f6294b6a7e9cf750c885c255", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192849, "uuid": "ebba9f21-6e93-40fb-a82e-af521ddadc65", "value": "T10114011473E1D363D9E316B21E782B6BBFF2E2252168965B67501F5C3D22B809C4F31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192849, "uuid": "6ba8b065-cdf7-4044-b6f9-17a766c5456a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192849, "uuid": "80adaf2c-6c34-43f7-8895-f9213129f489", "value": "3072:HfY/TU9fE9PEtu1blMGeAyqzGoN+fyTwxqr0hQcEDU/wcWFMj8:/Ya6LL3yXoN+fR12U/qFk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192849, "uuid": "1f353bde-cad9-47ce-9ed5-226d5471dcf9", "value": 193146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192849, "uuid": "a0d8e0b2-85f7-4ea3-8403-a7b96ead31e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192849, "uuid": "205d80bb-0b72-4588-ac06-0737cba2638c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf8c777-bca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163945, "uuid": "7eb8a16b-dd01-48f6-bc24-244d8f1e94b5", "comment": "Malware payload (GandCrab)", "value": "e6d8f08fc598d4f63fb642dc70a49526", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163945, "uuid": "919c483f-a89b-4689-b798-bcdd299a737f", "comment": "Malware payload (GandCrab)", "value": "a13323a8c0d9ef9bc2b420fbfed8e7eb4d68810c52e7f0457992add90a97a594", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163945, "uuid": "ce0e0766-377d-48e4-8a97-b31bb984feaf", "comment": "Malware payload (GandCrab)", "value": "3a036bf835997aab729f2c98d1ddf65861e45eed", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163945, "uuid": "2b8526e3-e2b2-4cbd-994a-a1d6e9ae9a07", "comment": "Malware payload (GandCrab)", "value": "6f226aefd159fa39c8cacece7acc176368ab6ec7f09fce4dca8926c830d1d1722eb8ba9f2f3a076ead8c12590896869e", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163945, "uuid": "0de98be4-d0bf-4a08-ace0-82444f0d17d8", "value": "T149636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163945, "uuid": "e16b917d-6d96-4827-a870-c61ee257afbd", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163945, "uuid": "58cbaadb-c120-418b-afe1-8949a4e7ef44", "value": "1536:xZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Yd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163945, "uuid": "3d3dfd93-1ad1-402a-9f24-12dc3b9b4b77", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163945, "uuid": "6891925b-cdf7-4a29-9470-39734a4286af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163945, "uuid": "72f4d8c5-34ae-455a-9766-b361e62b8965", "value": "2023-03-06_e6d8f08fc598d4f63fb642dc70a49526_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00aee47-bcbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678175384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175384, "uuid": "7fd71e43-5c72-4846-9018-f2e66c11b609", "comment": "Malware payload (AsyncRAT)", "value": "8bd7320fa277aeeb9d3724fce742a732", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175384, "uuid": "9a0c1750-91f4-47b9-b56a-03dfcd434fbe", "comment": "Malware payload (AsyncRAT)", "value": "a16b5f3c6b4f73563ed5f276337c0bc59319dcfafce5273a7b75a080bc20ca1a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175384, "uuid": "f3cf7265-ff89-414c-9039-d138562e52ef", "comment": "Malware payload (AsyncRAT)", "value": "a002457fe25aff92c7eaf95f362990c65ff1d98a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175384, "uuid": "b1e2000a-b98d-43b0-8e19-5a420e24d70b", "comment": "Malware payload (AsyncRAT)", "value": "0cd31b52c2b3c67203f916338f9bec2c8dd07cbed1adbaf718228a66dd59ce77e21ef740dee5310c185b37c7fec6cbd0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175384, "uuid": "b89df117-3fde-4244-b3b5-5cd1ec73f350", "value": "T106D423F41681D1F96749146009D9C587BEFE0E3AB298C288BD6FF3F14B99560E26E0D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175384, "uuid": "a7021e14-2243-4c5e-b3f9-6e7441ebc056", "value": "12288:tNLqRQU/pF7pX0WVVusmrr8fj5y1wBdMI7TYb5Z2NgR2Ybgc9hZJ:7LgQ6F7p5VVzjTBdMDb5kYbD9hZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175384, "uuid": "0dba7859-90af-41c6-91cb-ea0de20e23ff", "value": 605516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175384, "uuid": "c4b16bce-a387-44d6-9a12-4050d96cbd61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175384, "uuid": "51d23605-d4f7-46c6-a617-f27aa2c47765", "value": "MEDICAL ORDER-MTC04RFQGENZAK1220637501220524622023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80db5f4e-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1678198954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198954, "uuid": "7c9baa44-4299-4700-a82d-bf660a006c8f", "comment": "Malware payload (Socelars)", "value": "b724dda35c194b1821c819d4e65ece81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198954, "uuid": "eeb78543-bafc-4543-b7e6-b2a571bc90c4", "comment": "Malware payload (Socelars)", "value": "a1b276417402dd3c2fd22eeca1eeec4ed6a36a206fdb29b78f7195b759e76211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198954, "uuid": "83e260db-2882-4508-b46b-20558fa92711", "comment": "Malware payload (Socelars)", "value": "e2ed6bae5f0cfcd48813c30a8505326b3efcf5df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198954, "uuid": "2bfc90d4-dff0-4c8d-800a-7aeb04e595e1", "comment": "Malware payload (Socelars)", "value": "c1dec7debf3c64e55ce627b7f3e696419a839974a086c8b279e0db312e1094b5923cb12fb6bcf356f4fc1beda45ba71f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198954, "uuid": "e99edf89-af52-47e3-b17c-a6e107d43a20", "value": "T165658D21F7C26032E9E310B745FF66BE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198954, "uuid": "6dc5babe-5d2a-4dff-b7f7-a070b1f73286", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198954, "uuid": "ca5bd24d-a74f-47ac-9838-d226d82330a3", "value": "24576:DGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR7B5h9St:ipEUIvU0N9jkpjweXt77V5P8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198954, "uuid": "31ebf300-63aa-41a3-9efe-d2cac63eec8b", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198954, "uuid": "9bb68e61-4d41-42ba-8dcd-6d87da9886d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198954, "uuid": "682b9209-2458-425b-ada2-d568f041da90", "value": "b724dda35c194b1821c819d4e65ece81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0381ab34-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678198744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198744, "uuid": "9dbbd29c-7684-453f-a46c-123fede04df5", "comment": "Malware payload (Mirai)", "value": "e2a7f23566470e5d05f6a3b2807b0c27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198744, "uuid": "ed96e513-8008-4eac-ab1e-eda48579138a", "comment": "Malware payload (Mirai)", "value": "a37b871d99fb5607b92d5252e3cc141c510f06e6fcd345c5ab15e2d08d185452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198744, "uuid": "ac79a375-8fc8-4c06-9df4-eb7eb568e131", "comment": "Malware payload (Mirai)", "value": "b91aa9baf6defc60e118d811d8055f95eba88b13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198744, "uuid": "ba60cf04-9465-418c-b6d8-72c18b776e8c", "comment": "Malware payload (Mirai)", "value": "c903b9cd164d305bab4c6281c45aed94843053e0ebfb5f18afb61986b906a561a610cda21f5028c15172481a632bc23f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198744, "uuid": "f6186d7e-4605-4c7f-98cc-2f320c04ad3a", "value": "T16B34D688FD145F7BC3D277BAEB69828E76391BA477EB71211E30297433D8B55623A010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198744, "uuid": "f364346b-2eb0-4be5-8eb2-bc3dbad5540b", "value": "3072:Oh20FdUGURMKFkmW2MMAjcZyvCJOCuBRm1fbSLkg6NwDYDvSqWHY88kF:gdi1xtE2auOZRmlb2DYDvSqWHY88kF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198744, "uuid": "1224fcd7-efda-468a-b9b6-12f493155149", "value": 247020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198744, "uuid": "9ab200d2-ea5c-4a4c-be9b-fbb6ff164eba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198744, "uuid": "a60ea543-072c-4dfb-b375-03e25606d9e0", "value": "e2a7f23566470e5d05f6a3b2807b0c27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affdcab0-bca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1678164244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164244, "uuid": "7b9b333d-7b27-48b5-9941-7d5c6af13a23", "comment": "Malware payload (Dharma)", "value": "6ed029b9794717d305103e9eb20a8d1f", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164244, "uuid": "5bc5fa12-3330-4e12-a753-c045d7be0ed2", "comment": "Malware payload (Dharma)", "value": "a43dab9c34af5a49a2a615e86db3e2bf4c5467853dd5bd4f1a1c73619b683ab2", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164244, "uuid": "6bf43aeb-b80b-4a35-98d3-541ed21f009b", "comment": "Malware payload (Dharma)", "value": "956ebe054b5f286a1584b365dde59c130dd494ee", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164244, "uuid": "4356f751-43f2-4c67-ba19-abf6e5f95537", "comment": "Malware payload (Dharma)", "value": "b32675bfaf828d419c3b6690d5628926b98daffc64612b408c459b74e966f5422b36c43f79365b41542537db15fc4fe3", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164244, "uuid": "b01b874b-1a4a-434d-b2f0-cb085eae1b82", "value": "T14B938C28E931D135E8A350FECBF659FDAE648B101307D0DB97C02E49A7895D6F932632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164244, "uuid": "71595c65-4748-4001-8d8f-c0a5a943aac0", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164244, "uuid": "de8c0d21-294a-4e54-baa8-123c6017035b", "value": "1536:mBwl+KXpsqN5vlwWYyhY9S4AOYNq9Siz/+XVgaypvbjaFJt7:Qw+asqN5aW/hLFNq9EWvajt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678164244, "uuid": "922b7b95-62b4-45cf-95c7-ec9b20e98a4e", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678164244, "uuid": "febc207a-0ef7-43fb-958c-801eacf4dc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164244, "uuid": "b5dc92de-6957-4e50-9566-7a18ba05b991", "value": "dharma_unpacked.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1774867b-bd1e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678217245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678217245, "uuid": "65c84921-cb28-4d62-9cd7-ea0e804b29ca", "comment": "Malware payload (AgentTesla)", "value": "b7e69e59c6c8f1a191d9ba26f69f62dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678217245, "uuid": "bc182138-c78b-40d2-bb7b-ddf39a439ea2", "comment": "Malware payload (AgentTesla)", "value": "a56f5f192556bdb3fd7af7a7d03750cbb4473b14ecde429a39a1b80ab6c6ab67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678217245, "uuid": "917cf15d-e7c9-408e-a3ee-c253fc63129f", "comment": "Malware payload (AgentTesla)", "value": "9b4c7a77bcbf2c86949b6e6e36d6a80cb2f1b5ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678217245, "uuid": "77af8386-9604-4c41-8bb5-e5941d434484", "comment": "Malware payload (AgentTesla)", "value": "79bf43605777a26ea68694966f458c6131da334003108e171949871bcbf9df21d7bbbede706c4724ef71c446f1be16a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678217245, "uuid": "990b9211-a0b1-40be-b52a-c710b13a2041", "value": "T119941255F764A233E1AB04B00C9A81D0A6F2BEDD6837AC5FBCBC733D66F9254910166C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678217245, "uuid": "e717af18-fe9e-4126-b90e-5860caaf129b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678217245, "uuid": "4c20fd83-db04-46b6-9002-0c5e631e34db", "value": "12288:CGg1d+TmdbkJJLwyCJNdtbt9B338CEJlC6:CGK+T2iJLdAXn9JsCE3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678217245, "uuid": "ad5323b9-0e75-43e0-a890-078bab7ce7cd", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678217245, "uuid": "e27af360-bb00-444a-a185-1aff88a769b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678217245, "uuid": "7c0946d1-4e1e-49c1-b012-f67b766a8bfa", "value": "SecuriteInfo.com.Trojan.GenericKD.37435820.25619.21009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dfac3e-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175608, "uuid": "9a785aad-6a9e-4be4-9c5f-2f96091a135a", "comment": "Malware payload (Mirai)", "value": "416c4916411a53f22b139d8aa0fb9197", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175608, "uuid": "2c50f4a8-b48f-43c8-825d-e6f7bc16de0f", "comment": "Malware payload (Mirai)", "value": "a591ecffca5df7027ae091d683f3b5cd99af70ddbdf8fc95b8f1c2ec7c99b995", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175608, "uuid": "fbd2f7e0-2c38-44f5-a3a1-c31396f69d42", "comment": "Malware payload (Mirai)", "value": "1174a1044834e13e3086e023abfc1c5b9575b0ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175608, "uuid": "4903642b-6fbe-49bb-8512-b8b66f698915", "comment": "Malware payload (Mirai)", "value": "0d04b38de9771a155a4298b7414c4c2f01ad1257e94dd40200659932daad8ca7e6bf086953c65c6a0b5f827b5e74b7e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175608, "uuid": "4232784c-6de9-4abb-a54c-065cab5a1ca7", "value": "T10B43730ABF604EF7EC6BDD3745A91B49358C610A21A87FB67934D428F61B24F05E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175608, "uuid": "9961acb6-ce2a-4f68-bee8-c3c7b421fd02", "value": "768:bJv8J+bx9k4a1Fpj9lT31U124zFy/oe3ee4Fe2QX8YTZuyfXiCA6u+Dv+:bJv8Jm/k4YFUsY7eelF1QXVTZuyhu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175608, "uuid": "5d78beba-beaf-43af-a7fd-e1ae6d511d73", "value": 59520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175608, "uuid": "ca880c4a-dcea-405e-9f45-bef574808ca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175608, "uuid": "1fb99ac5-4302-427c-a548-e2db28f3f6c0", "value": "416c4916411a53f22b139d8aa0fb9197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c837e8ad-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678199503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199503, "uuid": "329f2748-88f1-449a-a155-57de96c9b0bd", "comment": "Malware payload (GuLoader)", "value": "491a66e147af28db87c1b74d7d657bac", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199503, "uuid": "37d71559-5245-4aa1-a0de-94929c739b95", "comment": "Malware payload (GuLoader)", "value": "a62743743c080ace353c78902b08cfd37154d1d13d9fd93c142811b208b80c5f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199503, "uuid": "67a48cf5-48bf-4b37-a428-84c99af0c1ca", "comment": "Malware payload (GuLoader)", "value": "7fbccb2bb4ce92ad199d3d7ee2adb27d7547c923", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199503, "uuid": "4225cd6d-ccf7-4a74-a630-d763f84cfe3b", "comment": "Malware payload (GuLoader)", "value": "bcb3941174136afe80910535977b91a069a6e9df839b6b5f3df509d753c341fd97ffcde0f6861af84402436c771ef298", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199503, "uuid": "4e4e59b8-826a-495b-9ba5-2f465e5c8873", "value": "T14DD25B51ED560B14889F2BFBDD064C70C57844BA92220075BDBDB36C6E4335CAA3EB5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199503, "uuid": "8d113b12-d3fb-4dfd-9289-7247394088d8", "value": "384:+v3bg7tfNXpw7jffiDgyWVlsM8U/4trpTza9CsXAEXEw/TrSLGwH2XSKI/pfks1L:oqVX+yDgyW/z88G6L6ZWXXKpfkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199503, "uuid": "d4c84332-9bd4-4432-b938-33e30a1cd769", "value": 28501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199503, "uuid": "419aec3f-fff4-4a17-ad73-9905faa60189", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199503, "uuid": "adaec1f8-df76-403a-9b4b-92b4fcb25f5d", "value": "OC 070-2023 ROVSAC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107861e2-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678196188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196188, "uuid": "9379a5a5-cfee-452d-843b-44cb772c9099", "comment": "Malware payload (Mirai)", "value": "be41c106ba1c32269bda2bacb804ab8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196188, "uuid": "dff4549a-ed47-4915-9eff-7e18464b2ac4", "comment": "Malware payload (Mirai)", "value": "a66d2341c77d4a050f3af0799065c2b0ac80ddb846970bc850d7ab13e432b8a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196188, "uuid": "7c74a90a-1e0e-4f42-9d79-b8da738f390a", "comment": "Malware payload (Mirai)", "value": "4f5353e4966a423c0781d77d5eac1fa17a76e01d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196188, "uuid": "44e3ce5f-a6cf-462a-996f-ba74aad14b63", "comment": "Malware payload (Mirai)", "value": "9017884d613f1c8e86e82cad46640d0c8677bdc913bd8699c2a87eda1f4ab77d5be8e55f09dd040efeb25ee346e2c0ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196188, "uuid": "71e48207-b5c7-462c-849d-ed99b4e48348", "value": "T15AB2E06996D1656AC270643AF1B98F525FB612E4D2EB34357B10F22CDB8600FB6F8CC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196188, "uuid": "4ec872e0-4cf4-481d-bb2d-2d4ab77c533f", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYV2Yul+x/AfroAjztqkiAJ3ehymdGUop5hu7y:4GaKQFH0rs3zRRl+IfEAjztqkiApes3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196188, "uuid": "35628590-c90d-4efb-98c4-bde054cd48c4", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196188, "uuid": "7daea026-5f16-4295-bcd8-7cdb54739d2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196188, "uuid": "c0b3ebdc-f611-4027-8471-8e7016840c50", "value": "be41c106ba1c32269bda2bacb804ab8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459d2b68-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678209592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209592, "uuid": "80d17f2e-ed85-4320-84ac-149e88a794e4", "comment": "Malware payload (RedLineStealer)", "value": "3171fcdd8b3795f6c5d6d7543e6c76b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209592, "uuid": "0ff2678c-037e-424d-97cd-912c90fe43ce", "comment": "Malware payload (RedLineStealer)", "value": "a7d1ef142714d3f73c7ae9e9964a13d721b19cb8e7d6fe28527eb741dd4b4c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209592, "uuid": "be22b1bf-e147-482c-80c7-d078e7c0b280", "comment": "Malware payload (RedLineStealer)", "value": "4ceb2ceacb785df1e407dfb0f36bf11de8e8a80c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209592, "uuid": "b2f924d7-0533-4f29-a81a-766567512723", "comment": "Malware payload (RedLineStealer)", "value": "818dcf3b172e28f43074751d5950389b62f5d8c6ea9fd0bd69db71b0e750fd8c0be4b6eab1a78d82e33b37a787271a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209592, "uuid": "b5dd36c2-597a-4182-bcca-551ca7da5ca5", "value": "T12F84012173E0C072D5EB15702531EEA4AA7EB83255F5C98F73684BAE0E307907A7631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209592, "uuid": "d48ed4b6-9bae-41fd-bbd5-aba9bc280a72", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209592, "uuid": "82f0979a-e631-42a0-991f-3bc710a4a521", "value": "6144:YWTLQgLVCflBOmvsrlLHt5hXLCsOJrSnXLDW2WAN4T9p4eZGB:YWTMIeBOmvMlrt3bvO+Los8vZGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209592, "uuid": "c4101c1a-1dd8-4d12-937d-abfc4e982607", "value": 371200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209592, "uuid": "f7f7df99-d2fc-44a7-b47a-46fc0761a334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209592, "uuid": "2c4a2635-ec77-4d0c-a099-fa591f213536", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef38b593-bcbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1678176805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176805, "uuid": "67872cf8-b69d-4e7e-809f-951d64e79cba", "comment": "Malware payload (Gh0stRAT)", "value": "613e88c53caec3d1307e263510eb475e", "object_relation": "md5", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176805, "uuid": "a369f920-b298-4cde-9fc5-0618d59cc6b4", "comment": "Malware payload (Gh0stRAT)", "value": "a853b17061786737988e904c7cca3c808f5a74ea3bb6d9c624ae71bd08ea40ad", "object_relation": "sha256", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176805, "uuid": "01d4868f-3285-420d-96e2-cd657d79a208", "comment": "Malware payload (Gh0stRAT)", "value": "929ce0fc7af3f7df27d3aaa59949fa9ee91b8497", "object_relation": "sha1", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176805, "uuid": "ef74b2b7-f839-42cd-b804-581a658f8248", "comment": "Malware payload (Gh0stRAT)", "value": "3f67ad47cb0b6189ab2562c5ba1c9b0d856c19cfe5c2371b9fc46c098b2d1287b9756bc76ead1176431e2706a0edea53", "object_relation": "sha3-384", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176805, "uuid": "d4e28bdc-5cb2-4b7e-ad2e-325ded235daf", "value": "T19F85E086BE0445A5E829C8B1C62BD9F8DB213DF74950C53722D4BF4B3DB21F2162792B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176805, "uuid": "f6439966-03a7-4be5-a476-9ec1f6e77d50", "value": "53f8ee7cb488f1fee528409debb3a862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176805, "uuid": "0827493a-5fb3-4d92-bb0e-16f12aae5f84", "value": "24576:GPzahsCGOVdfcp8LsR3qiWXk5hZ7DCkxdmpmkh60FY5MesoRGM27:GPOrVdmlZ3CqcpTqMeXGM27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176805, "uuid": "57d93588-18df-4aea-9741-dec552e80146", "value": 1713981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176805, "uuid": "1cfda64f-9ea8-4aef-b873-597693a7c9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176805, "uuid": "a4e9f7c8-44d0-4638-8cd4-fb069ae3b485", "value": "wait1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c96a6d-bcbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1678176809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176809, "uuid": "d9a09ba7-22e0-441b-b90f-891fdb57fb8c", "comment": "Malware payload (Gh0stRAT)", "value": "7defee0256b1e42f479f14484af82daa", "object_relation": "md5", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176809, "uuid": "a02ae53c-8692-41e7-bead-045839547612", "comment": "Malware payload (Gh0stRAT)", "value": "a8f59998bb89d7563e5dcadd2a7f23b86c8e643203cc921abe3450fe80348a0b", "object_relation": "sha256", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176809, "uuid": "8fd6141b-eafe-44ac-b3b5-d63c60c7e436", "comment": "Malware payload (Gh0stRAT)", "value": "4e9b199550abb1b3438cb7fb1ea62170b37dc994", "object_relation": "sha1", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176809, "uuid": "7fc365f2-e182-4494-b907-021dc6860ec1", "comment": "Malware payload (Gh0stRAT)", "value": "d90d378de7f0ae24623c4fcc9f747f48993653769ddc62c68b441e084b4cda57efcb74a10e405902598d44bf184116c1", "object_relation": "sha3-384", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176809, "uuid": "a543bc73-6cc7-4f9d-bf91-10481505514c", "value": "T1E575E083BE045561E928C8B1C62BD5F89A217DF39A10C56763E8BF4F3DB21E11627837", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176809, "uuid": "8cb0294e-e0ab-48c1-89e4-29589ae1740d", "value": "53f8ee7cb488f1fee528409debb3a862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176809, "uuid": "0c318db9-60a6-4fb7-aac7-8fe3592ef3d6", "value": "24576:kmet+chXbYQ2lrSnIZtAzZnEpIE/Vl++U1sSiecjv9GFY5MesoRGM21:Hq+qbYv84Rp3VASJjv9sqMeXGM21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176809, "uuid": "38a17cc7-857b-40df-b01a-08d237969133", "value": 1701181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176809, "uuid": "a5c49bcc-e300-4890-9974-2a84044b4595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176809, "uuid": "0402c021-bb28-49fa-9243-95c278773b3d", "value": "KKSEZ1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1622a5d5-bcc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678179018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179018, "uuid": "3c32b67a-9dad-44a7-8822-3cd5618fc071", "comment": "Malware payload (CryptBot)", "value": "9b54544a0c3da02c0d549825d461a0ab", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179018, "uuid": "d814e1b3-c8ac-49b6-9705-6c64fea31dd6", "comment": "Malware payload (CryptBot)", "value": "a973fc1265a873ad907a0856925cedcb906bceca2a048d1f549f765374d5c764", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179018, "uuid": "2f2e5374-cfde-40ef-8a04-c419467009e0", "comment": "Malware payload (CryptBot)", "value": "7f6cd515360fbc05588f74926a8697c87d43cd5c", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179018, "uuid": "db4bd0f8-6782-49cf-8177-e8d4b17d22e8", "comment": "Malware payload (CryptBot)", "value": "0cc76abc991da5ccabc6fde0bb194bdc4f299f43b44610d8fdf3379743ec4bb6377f997d7642e22a5376850b9cc4e398", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179018, "uuid": "933b5297-e369-44a4-8685-2db7f2bda36e", "value": "T1890501297256A53FDA939171C824427E1678BC930465E4AFBBCC3D3FFA5C052A339B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179018, "uuid": "371946cb-3cc1-4737-93c5-75ba5826d76c", "value": "12288:RJqNR+3wrrwtinxeUltkv0iwORRXfkqbxy0+sh5b9A14oIZj9WuD5sGp4r2qXLmH:vqm3UwoEUlttoRRXfkqJ9GICuD5UmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678179018, "uuid": "db6529ce-6b64-4f6d-a4e8-f47337cf2dc1", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678179018, "uuid": "48e16493-459e-4282-9941-4aaf43daf7f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179018, "uuid": "aa442f25-1c81-4b39-a00c-d702b117af26", "value": "9b54544a0c3da02c0d549825d461a0ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1a62de-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678210083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210083, "uuid": "7228e649-0578-43bc-8eb1-397e5d475c95", "comment": "Malware payload (RedLineStealer)", "value": "f2b263060c59e7a89c7255f0da805906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210083, "uuid": "e7d04531-a07a-461d-8dd2-1aa974346f4a", "comment": "Malware payload (RedLineStealer)", "value": "a9cc7e813f650f2c50de712a456cef1fd375ab5addd057ba326aacacb1db346f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210083, "uuid": "5825075a-a618-4460-9616-74234fe36a66", "comment": "Malware payload (RedLineStealer)", "value": "4d404ba842210d83cdfa322ef0a951fa7ed18878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210083, "uuid": "d64ad628-06b6-4a93-93dd-cd33ea98efe4", "comment": "Malware payload (RedLineStealer)", "value": "f6d0165c5485d23d91a7f635f681288a2dc135c459b405be2957072f6077f4f22cd2a0df14e7e4555fabf419b5545397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210083, "uuid": "6c6a22cc-9d35-404d-921b-230477476f48", "value": "T16E74F131F7E0D076D2A7157055B4DAA86F3B78725BB5896F37680BAE1EF02C04A26313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210083, "uuid": "5b4ec22f-23b8-4c59-8b5f-5b5efcf2d38d", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210083, "uuid": "0ff6bb9c-5ad8-40cd-822e-dabb79634373", "value": "6144:YQr7LCxunNMwY2AQbObqIBVxATqJA7A00xc8Q+4eZu:YQr7m0NMwYxQam+xu530xcFEZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210083, "uuid": "1845c08b-4443-43bb-8e9c-9a5bb8cf653d", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210083, "uuid": "f194eb08-0097-45b1-9fe1-a24e7d768433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210083, "uuid": "36e241e4-6ee9-4ef7-a746-ca21d77e80ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5630c1d-bcd5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678186130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678186130, "uuid": "221991b7-33ba-410a-bd8a-bfc7f973136a", "comment": "Malware payload (Gozi)", "value": "a76e284e4fecfa1d838aa5a6e93af780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678186130, "uuid": "d3cf036d-330c-4a61-bf81-608c92adbd0d", "comment": "Malware payload (Gozi)", "value": "a9f25933eb0dc82972d77854034dbc86220088eff4758a7df4e65f87ee1745e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678186130, "uuid": "3109a5ca-ad99-4a12-bd50-f0e70305aaa1", "comment": "Malware payload (Gozi)", "value": "00c3c6d22f7875dbbfa6763338a391eff6eade2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678186130, "uuid": "e06ba0ec-75bd-4479-b813-6e658a4cae28", "comment": "Malware payload (Gozi)", "value": "292970ee11ef922c9391f72b826851664383f9138c18ac5d72d0d47cc9333ebd7207c5c9d927b266946a6c796d0f970d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678186130, "uuid": "e0e4d52a-9770-40ad-9a13-5b8dbbf8ccca", "value": "T1E744D025B3F1D072DAE705741874EBA41EFFB8722670858B276817EE4F323909A66317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678186130, "uuid": "0a6f44a0-25ee-49b7-9bc9-eb20a43256cd", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678186130, "uuid": "f73acc87-b21d-40d2-ac3d-8e7339a45d1c", "value": "3072:Q46YtTL532cCGv/3wFG3mol7HkSyNjiGv7R6Xtny+2P758Ji9EoDNb:T6aLY1xkz2Njiu7RMyL5EMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678186130, "uuid": "b7c94853-35d3-4c82-bbf0-4b86e22e7998", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678186130, "uuid": "d6caa382-2c2f-4d9b-9370-999246b2a84b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678186130, "uuid": "34a86f7a-8e8d-4c1c-88c3-04f80dbc28c8", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433c6dc7-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213453, "uuid": "8000820c-f4ac-484d-99b9-d1828a0e664e", "comment": "Malware payload (Mirai)", "value": "e79d79015fe8703e6c4fb5e27e8322c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213453, "uuid": "8de82050-8662-4343-9941-6c5d318fbd23", "comment": "Malware payload (Mirai)", "value": "aa1f61de25eb2e968c1a2da1b9b53b7133931277489b8252de0eb492033f0397", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213453, "uuid": "73a9ec2e-8037-4ec8-ae74-878c308f1752", "comment": "Malware payload (Mirai)", "value": "940084cdc3d911341e780a19cb06717c9445eec9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213453, "uuid": "97e88136-dd97-4508-9715-62d201d82c4f", "comment": "Malware payload (Mirai)", "value": "420ba60f1cdd85ab27ef58513a3261dc204e6fc591bf64364667a92940ad24b424e815bba70955290b7dfbea90e16475", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213453, "uuid": "84a07465-ac7c-4e3d-8e63-cf987db0afcc", "value": "T147E3C61A7F151FB7EC5BCC3B0AE86705288D640B21E97B36B934D849B64B35B25E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213453, "uuid": "086a3b33-4e6b-4c29-af27-d71414762476", "value": "3072:Ic0HnK6KQDA3NXPuOMf8IT5SdU6mL1SJ49wbZnkn:Ic0HK6KQDA3NXPYf8IT4dU6mL1SJewRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213453, "uuid": "de384426-840a-41de-b0f5-14daaf2d7a61", "value": 144732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213453, "uuid": "1b39f966-61c1-4bd6-8980-388b190a614c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213453, "uuid": "deac06e9-0e52-4271-99b1-8fbfbb1196e5", "value": "uYtea.mpsl-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287acb62-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209972, "uuid": "0072ba34-ee9b-498a-991d-2805daa5a042", "comment": "Malware payload", "value": "ff38a8dedb64a31a84a05c1183468536", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209972, "uuid": "a7fc9832-1390-49f8-a26f-5d667ffbe00e", "comment": "Malware payload", "value": "aa24ad12f53cfa81a839a1bab651cf56080c211c010396a9cece73e69a798a78", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209972, "uuid": "849b971f-106e-42e4-b67d-06f2147c40a0", "comment": "Malware payload", "value": "dfae1df231ba8e8abfba4886df35a64c1d61d53d", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209972, "uuid": "20ad7dd8-c7b6-44b8-9ef4-9306f74f1184", "comment": "Malware payload", "value": "969bb2416415ece9dbf5ca29e7c650bddab76ae859037871f52eb448e24b28f4c66e1c2c1f65f929a1b3ee5e95f3b875", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209972, "uuid": "8303c1a0-9c07-4ea6-a517-357b578b0f2a", "value": "T1B5562A43F85091A4C1EDD270C526C292BB71BC894B2127D73B60FBB92F76BD4AA79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209972, "uuid": "b593b585-906d-4495-ae3b-1e498ba92eab", "value": "49152:D3sFDkv4LW9rb/T3vO90d7HjmAFd4A64nsfJyiXC1PNLrs+8nONA1agrj6lnndJu:x3sZ4JYRFEUbzwxkwYcvcfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209972, "uuid": "5f6f694d-caf0-4fb9-bcea-079de5eaa221", "value": 6211024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209972, "uuid": "38b25a29-98f8-4346-ac23-232a64889b67", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209972, "uuid": "46f448de-2bac-404b-b46e-115a552a37e0", "value": "d_mac_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b2da5f-bc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161675, "uuid": "47d627a9-979d-4dc4-9c81-efa7e5d4ada5", "comment": "Malware payload (Mirai)", "value": "8bc8768d1c4ab1480842363b8781d511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161675, "uuid": "df1417f9-be91-4640-aeb0-ce62e168f414", "comment": "Malware payload (Mirai)", "value": "aa97f9c0d4e6a1912e733a9ce4e6dd36c696ebb03a9365690e32d31455e6705d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161675, "uuid": "7c251b4c-df36-4844-b1f6-7285f2233195", "comment": "Malware payload (Mirai)", "value": "2e1b1986c61cb2b8f4855a2757ba9dc503360226", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161675, "uuid": "8f2cc512-2bec-4019-8dca-b64aacafc3b2", "comment": "Malware payload (Mirai)", "value": "615e0569d33e4371cb28eda4398f400a47abcf94064d5d51322be0330c17f91cd098f35009756259f96470ad06c8ff2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161675, "uuid": "c73b34fc-18f5-4054-abf1-274c3f65b8cf", "value": "T19A432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161675, "uuid": "c1403b27-f156-4c8d-ac6e-71da0e9b1f24", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw5:RqtmZPuutfbltZFBSJsBcfDSTFI+BE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161675, "uuid": "272d1aef-3b69-41a0-9bfe-c64fcf1cd4d6", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161675, "uuid": "9b7376ba-f8d9-498f-bc68-00467dfc5c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161675, "uuid": "5c4e68af-54ab-46aa-8f55-d5c68989ec11", "value": "8bc8768d1c4ab1480842363b8781d511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ade0cc-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678209703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209703, "uuid": "d294232e-6051-43c5-8dd0-39f6780f6384", "comment": "Malware payload (Gafgyt)", "value": "c934bd46884327d49869c9ac53c6a5e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209703, "uuid": "1514f208-6f10-41fd-b903-707c4162ff92", "comment": "Malware payload (Gafgyt)", "value": "ab0fb6f529e19da9075e7b3837fd538510e90d64f19bc44e611422a8ed432d6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209703, "uuid": "1e41da3e-3320-4935-b15d-b885361e493a", "comment": "Malware payload (Gafgyt)", "value": "5ce0a7f2f0ac15c4e06f8ea7da981340affe61cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209703, "uuid": "ef3784d6-615f-4ee6-b3b1-e1ba27be55ac", "comment": "Malware payload (Gafgyt)", "value": "456ddf333da045c4916898b59b7e01e51e00a9b72bf5cb17a31d7a3195aae1321e2a10794cd7eac47fb3d56594798e89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209703, "uuid": "4e75be8a-b359-4602-8618-3c2e6225d9a1", "value": "T1B7B31792F900DFF6F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209703, "uuid": "adbf51d0-cdfd-4e18-a081-2191224e35cf", "value": "3072:mp+3MNBCpCTyRQpimmrytK4s4OWlKhRm2pgYMx3IPtW:m+CTyRQuyttseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209703, "uuid": "ccfe110e-8154-4196-b269-b79f91189825", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209703, "uuid": "fe46187c-9fe9-49e7-992d-c26d92da68ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209703, "uuid": "5cabb5dc-ab20-490b-a633-42c74265cf60", "value": "c934bd46884327d49869c9ac53c6a5e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5abd784-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678198613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198613, "uuid": "dc1907bc-2a9f-4b71-bac5-d7ce8b6df691", "comment": "Malware payload (Formbook)", "value": "16cef0c69addc43ca5cfffc4b0275f07", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198613, "uuid": "2346b4c1-3d25-4034-bdfb-e546f55d74d6", "comment": "Malware payload (Formbook)", "value": "ac42e66c477866ed06ef31d2801f4b187762c44abedd6df341040c5906f07851", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198613, "uuid": "c98c0188-1b04-4fd4-ac6f-c157d80facf2", "comment": "Malware payload (Formbook)", "value": "89cb6339465424aea7e6f2969a2e8eda4ecbcecb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198613, "uuid": "ca1b42df-1403-4cc1-bb4e-cafeb80a3573", "comment": "Malware payload (Formbook)", "value": "8711b9c3269f57bcd8d422bdd7a9dc4d89ea56134a162cf1c545867cad4c96e92c885f176d5c9e1cf0642669badc51eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198613, "uuid": "0401d0f5-3471-480b-8566-d4c8f614d77f", "value": "T1C28338A5E749D6DB47CA039D8B420C4CE85B7D252312CC296E69BE8D3D0331CB66B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198613, "uuid": "91e78a57-d5c2-4961-9c77-d3e39c6e44a1", "value": "1536:q9UPuavBplP2asgJtJEppi79waFAVGAajc5N8r3o12zlAn+d+ENg:UKumlPMetippuFaqc5N8r3M2zlAknNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198613, "uuid": "14cf3ccc-b9e9-46c6-ab79-86fb9b793ac1", "value": 88356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198613, "uuid": "46281d2a-5fbe-486e-ba31-d35549ba1f85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198613, "uuid": "42f5cd4d-8dd9-4a9e-8633-ef985cc88d40", "value": "PAYMENT070302023066757.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a489834-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678198809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198809, "uuid": "a9b45776-f451-44d1-9f34-3072d315baf5", "comment": "Malware payload (Formbook)", "value": "9cf74c9d95b6b41ddf3f67322a0dbd66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198809, "uuid": "7f6287a3-0215-450d-9259-68ad193d43b8", "comment": "Malware payload (Formbook)", "value": "acd4463568f93636799b294ccbcbafa0d47f362c929e0e9e47709bd57bbb8c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198809, "uuid": "9f437e0f-5796-43c1-957d-0919ab389184", "comment": "Malware payload (Formbook)", "value": "61f6ecdb564866cae9e21f15c18729336aad8e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198809, "uuid": "204d1703-823b-4a9f-8219-7406591eeda5", "comment": "Malware payload (Formbook)", "value": "a1d164be038a262a88430578a1fd20af94b5392a98a51d9db14995daf3b60f4a8bef94fe5904f7f99b5f10e918377513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198809, "uuid": "fb57028f-5b84-4679-a955-3b7d8b38ca72", "value": "T13F041307C32E3889D6BFA5F2DD3EA17221AD4F13F8EA654D36ACB8176015B10496C17B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198809, "uuid": "acf77ff3-920d-48d2-bfb8-7d2d751d65eb", "value": "3072:MWrlSVR9l3xjYPHtLyOc+B83jwS+B7ZrHBs+8bS4NJkEQ0u6ngBsulAVtFSZwYH7:MWBSH1YfYOrB83US+B7Zrr0zN9Q0uVBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198809, "uuid": "3f458f39-b44a-4a39-a9a9-be90c80891f0", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198809, "uuid": "b04fa46e-25b2-4e15-907f-af94c64ea673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198809, "uuid": "1ba0f6a1-4608-4a7f-a587-affa45040d31", "value": "acd4463568f93636799b294ccbcbafa0d47f362c929e0e9e47709bd57bbb8c38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8ac20e-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678192697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192697, "uuid": "efd18f58-ec50-474f-aeb4-90112145aad5", "comment": "Malware payload (Rhadamanthys)", "value": "728c307b7712abf2d8b84d890a0b1d66", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192697, "uuid": "075a28df-943b-4b24-a7ff-dd8e09127170", "comment": "Malware payload (Rhadamanthys)", "value": "ad0a1c3a1be7e8bc3c552891a43134257b41eae540f39478881bb3ae5958b5c4", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192697, "uuid": "5c22d097-2f55-4ba4-820f-1bb6694e2548", "comment": "Malware payload (Rhadamanthys)", "value": "47e9ccf1abc79b77739fa1a93cb3b72ca6291f9d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192697, "uuid": "3e57c54f-bde2-4c03-9772-90a3d5e94074", "comment": "Malware payload (Rhadamanthys)", "value": "7148c659af69adf7de06701e3cf5a2df32a7446e6fb9f9c13489ec0a6583540150b918bbd7809ee7cac3f0a19a4a11bb", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192697, "uuid": "b5e735ba-bf7d-4688-b42f-042d230f7368", "value": "T133A57BF18E53FE90E7AB1D8480CC2AC05C5C1B9B86999948FCCC2547E2E5650BFDC6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192697, "uuid": "9a84ef11-19fc-44fb-bfe0-5a5e9fc31629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192697, "uuid": "dec14d70-7ffd-48cf-ab23-c607a72b858f", "value": "24576:q6bfiE9GXuAn6OVy7p/3RoNkHK37gxindv35H7cEx2nw6ZcPshX:qCfRIuE6nZA02KEx2Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192697, "uuid": "57ef6b75-b122-4735-8ced-36e49f5e0ad0", "value": 2075648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192697, "uuid": "bd42524d-614a-4c26-9882-db6a5dca4313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192697, "uuid": "a5b4fd10-242b-45aa-84c6-ef97333a9612", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc7037f-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198576, "uuid": "6f6a12c0-bd4a-4106-b50c-bb9bab0bf648", "comment": "Malware payload", "value": "0aedb4be392ed6a9bb467d81a993a756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198576, "uuid": "e6e655a8-1451-45be-bdf5-c87b052290d6", "comment": "Malware payload", "value": "ad3c623bcaf9729cc75dfb694b3548c8d7016d463c378073306c095b53d39751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198576, "uuid": "67437fc1-6444-4243-821a-06d76549f86f", "comment": "Malware payload", "value": "a7e74949fa98062d0da252ea411067dadbdea665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198576, "uuid": "07418f70-3164-4835-8eed-741da123d284", "comment": "Malware payload", "value": "ce84f43550f1fee1c9725fc22834894a6cffef8ad52295d4b93f9e780becba192d7feb1cc46539efc775f8ddfd7cda48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198576, "uuid": "6577bee1-e627-449d-813f-e7a08040191b", "value": "T139E408A790A04111C9524AF31A6FBF794F1B1FBC96141C1A907432AE66B7BC7DC33A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198576, "uuid": "701f1dd9-cd77-4efe-9ce3-e40c4677407c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198576, "uuid": "9f0013a6-22c6-4b80-a8b4-53710d72b779", "value": "12288:2bV7K1f4pvNYYD7TabeslVSLuPbfiJXPg4wh6g2MRhO:2bV7K1f4pv+YD3abeslVSLuPbKJVwJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198576, "uuid": "4ae4105f-2401-449b-be5f-f3e5c2cc387a", "value": 659928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198576, "uuid": "1d6b6b9a-8b97-4ee9-9003-c798fd628951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198576, "uuid": "0d9f7107-b90b-451e-a11a-684d58662656", "value": "E-DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e11df5-bc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149808, "uuid": "6fb8d227-2e7b-4424-8ae4-a0bb8063354f", "comment": "Malware payload (Mirai)", "value": "9dc73a5f9cd42f16c53348a992184930", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149808, "uuid": "7c6659cc-9730-4111-9eb0-e93bb071101c", "comment": "Malware payload (Mirai)", "value": "ad4e3a56971577c7d1ce4c7c619d347acca648971a9c41132e99234cb01835a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149808, "uuid": "74c286ec-af37-4fee-af4f-c2cbb7062fd2", "comment": "Malware payload (Mirai)", "value": "f62a669294f0ed2d8ff54721e9b25f830cc809f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149808, "uuid": "73bc9ef5-c97f-481c-94ee-69dbcd26e092", "comment": "Malware payload (Mirai)", "value": "913807113a942f913aac67614d7616ea3b00e171afa27877cabef4cc0116ced7643072cfc99f43799f6da14b6c1f8038", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149808, "uuid": "381a819b-b20a-41ba-94a8-004d9a529643", "value": "T1DB138E35E46ADF84C4578134B4A88F791F93F0C893635EB71AE141B25487AB8F908FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149808, "uuid": "134c7033-33ec-4c42-bc2d-66111bfdbe4b", "value": "768:PaH3WueDs+quFeSthLrkuUsf6atksoKCcCDoyl4mlvw:PaH35efxp6sfPPCc3yll4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149808, "uuid": "83ef0573-9e62-4deb-8826-498be17d8fe4", "value": 42176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149808, "uuid": "78d24344-fe84-4d27-a0bb-ffa409c7ac7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149808, "uuid": "6c140661-8b92-4405-9412-8b78e2b0a296", "value": "9dc73a5f9cd42f16c53348a992184930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d8029e-bcf9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1678201345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201345, "uuid": "54d64cc2-2ef8-4afc-93a8-0f4f783c8a53", "comment": "Malware payload (Socelars)", "value": "8786b658cc8531383511362b788f8f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201345, "uuid": "d2a43ba2-c816-4627-97c8-3bcbaf592715", "comment": "Malware payload (Socelars)", "value": "ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201345, "uuid": "1ed2cb7a-f9d6-4f4d-8e31-00d485a5d44b", "comment": "Malware payload (Socelars)", "value": "58da30ee843e7d5f51bdacca1ea495b84a7678fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678201345, "uuid": "7b9d51a6-1fc7-410c-9d08-cb7b3acf3dbf", "comment": "Malware payload (Socelars)", "value": "e1f17d8afed008351394c38e2faeabd014c977913d4a855ba3aecff1bba09ea92a779afbf603e5d4da80891b6700b09d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201345, "uuid": "69346233-f549-404f-abbb-1f5971e880d7", "value": "T1DD842286E69A4479C070BF752E69CA128F373E281D767441B2BC9D5E5F3B180C50B3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201345, "uuid": "eeb1b817-f5ed-4350-bdbe-fc5291b9bdb2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201345, "uuid": "5838369f-dabc-44d1-acb6-08cdaa9c34e6", "value": "12288:iQi3Qa6m6URA3PhNOZm2K7YOY5p2tpNnnTIg:iQiA5hhVFf4y3Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678201345, "uuid": "607f2cd4-04dc-4537-86cd-24a4f2c0bef6", "value": 406092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678201345, "uuid": "aa09ea20-3c56-47ff-89c0-0e1db22ccda2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678201345, "uuid": "b1ca3000-6c72-4337-bf30-fe440a6652fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00054ac1-bca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "804bfc60-ff20-43c5-9e98-44bc910f3449", "comment": "Malware payload (GandCrab)", "value": "a31e8f6d67601a23cad19a04aa5511b2", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "805d6675-29af-4abd-bb06-84a1ab413c07", "comment": "Malware payload (GandCrab)", "value": "ae37e57b50aa7a6ea1f6b845aceeb3e7b42206fbc18af1466402843ed4fec44e", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "8bcab556-79b5-46bf-abce-d181a742b1a2", "comment": "Malware payload (GandCrab)", "value": "36af1e9fbec16c9b44c3a5b56f0efa26fc35fa2f", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163948, "uuid": "820ff075-f03a-46a5-9dda-deebc5b3b75a", "comment": "Malware payload (GandCrab)", "value": "3db1bb2840d91f6f0d146d2555aae5d8ee65bae454c1ab63227042a36520f1d60d3c393283caf474df414c2dc1d75a31", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "b56a09d0-0c7d-43d7-9373-e7517b7f48f7", "value": "T12B636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "70a88946-d5a7-4149-be19-8d3f85e75973", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "9e5dcd1d-06a5-4e97-a8ed-be08a8e44a0b", "value": "1536:pZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Ad5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163948, "uuid": "a0a00c37-f687-450b-be50-cc5af0e5a207", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163948, "uuid": "3925a38b-1926-4b56-bff9-e59c6005bdc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163948, "uuid": "dcbb713c-6e9d-4dd8-ab67-ae0ecec1c0e9", "value": "2023-03-06_a31e8f6d67601a23cad19a04aa5511b2_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49f112b-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198719, "uuid": "c9e5f2fc-9b6b-4024-8c0f-342ca9d86420", "comment": "Malware payload", "value": "15528bdd99eb4b388374e9957c5b106c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198719, "uuid": "889a03d9-8425-4234-85f2-ec4a99be9c88", "comment": "Malware payload", "value": "aea9fd323b1b7e8e445830519ef858cf2fc8a397303af9596b24300eebab73ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198719, "uuid": "3400a82e-baa5-4b3c-bdf7-4de873f14dcc", "comment": "Malware payload", "value": "0a0c1d07a640310782eb55ae4a48582f6668ef13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198719, "uuid": "0db379e6-f7f1-4f52-b1d7-9c94e92a83f9", "comment": "Malware payload", "value": "fb09bf8bab898435f1e89e962522d838373e8ef72bd7e56c96ab8ded41a3dfe706bddb37fd901bed39b9190f78dcc8bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198719, "uuid": "b5adaa1c-2362-496c-9fb2-daf427d00f97", "value": "T11DD4022667148463E4A673F7093B4BA25E6A3E112978720B57313F587733193DC0EBAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198719, "uuid": "9167482f-3d17-4add-9751-3ae478464869", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198719, "uuid": "0f1b78ef-eef3-4ef3-9031-eaf20ad4b735", "value": "6144:2Ya6npxtxAI8vlLSuxJkhbDopBkOOPPwo7:2Y1pjWjvUukpkBknPws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198719, "uuid": "b6baec2a-e8b5-4339-9001-22ffadabe056", "value": 614496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198719, "uuid": "2080b139-67a6-4df6-af9f-f0665f417c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198719, "uuid": "a2ede30f-c018-40fd-9c11-69405597f390", "value": "15528bdd99eb4b388374e9957c5b106c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c1c9fc-bc87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678152680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152680, "uuid": "849b6128-cd00-4b4f-9b6f-c4a4d31c515c", "comment": "Malware payload (RemcosRAT)", "value": "21eee575b2425a16123e5eccb8d280c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152680, "uuid": "3584b686-709e-44c9-a3ae-91785e0f1c89", "comment": "Malware payload (RemcosRAT)", "value": "af9f2d56bf530f612c18e4a21f654aa8b5be48ad80a92c770699791907d95b55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152680, "uuid": "2c8d71b3-e566-4a64-ba49-fc7cab085bdd", "comment": "Malware payload (RemcosRAT)", "value": "47893d97edac57b27f25e42ccfa68585609d61ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678152680, "uuid": "11938157-e446-40ab-bb8d-aea47ff48174", "comment": "Malware payload (RemcosRAT)", "value": "7cd2f241bd78ead89009345b1a503c3230fbc596cb98db878e3d4d1654a12d12d709987df2713a4f9a0555416cea67fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152680, "uuid": "da71d725-230f-4e15-a6c7-c65d928ad507", "value": "T10B55BFC637BCE522F4EBA176061511CA3A39B997B211F13BA733BB158600BFF7A85540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152680, "uuid": "7754459e-1d20-4c6a-9295-7abf6d4e8dc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152680, "uuid": "5a6c2526-2162-46dc-a851-225f8ffdf4ff", "value": "12288:EMunAGk2GV5ItArRiuKV2jzbhrnM7amMLSUKkmiUKNe3Ra/YiHhAqkvWdFlLgC0F:ckdV5uAZb2A5KgyMQ9B+dbsC0a75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678152680, "uuid": "4211f886-833f-4bc0-a5aa-ea33144458a2", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678152680, "uuid": "e751f345-bde1-49de-849d-d14c44f0e88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678152680, "uuid": "da4bc438-805e-46bf-b58c-8d5b62c72973", "value": "21eee575b2425a16123e5eccb8d280c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fe0700-bd05-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678206712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206712, "uuid": "9f9e5d2d-5e41-4e91-adce-6936fb1b4d85", "comment": "Malware payload (RedLineStealer)", "value": "f710463a168bada78533aae97995e8d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206712, "uuid": "238d6a29-b175-4024-af76-7f2623cc72e5", "comment": "Malware payload (RedLineStealer)", "value": "b0616290928a4dc2b15cd8a0e1ab6be754cfc6c4d46bc50f4dfbc3234a364966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206712, "uuid": "ce7d38d7-c562-464d-98d2-1aad54e3ef95", "comment": "Malware payload (RedLineStealer)", "value": "bc48b54ffa772b06353c1aede6802859b6177010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206712, "uuid": "948b0067-d4ad-4c34-b618-cab8f5d5f1b2", "comment": "Malware payload (RedLineStealer)", "value": "4c88b9cbcfb15a59c3097139e803147c7e082c421138e4cb0246c2fd4561032ec2bb454ef8853b5d4ffa9679290f8a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206712, "uuid": "1a2ac6cf-1dce-4b71-9b3f-c22b46c19997", "value": "T167F41220B2ECD33AD5F70170196DBA958A3FB8764565C997336C17AC0E202D29B7A70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206712, "uuid": "e9c7e5b5-5344-4d60-8428-95d37b54f644", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206712, "uuid": "0a56ab08-0a69-4fb4-b5b0-7e5d5839b4bf", "value": "12288:n7lNyHJS9V2kuOWscPvQ5GyhJhwVz+CkMaBicaMGinSYo9vzq7Rdv:77iYikuOWsc0TSgMaBNqf9rSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678206712, "uuid": "bf074daa-929b-499d-bf39-64c567205417", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678206712, "uuid": "d731555f-0ec9-49d0-a5f6-0b2ee7665eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206712, "uuid": "5f001adf-d36a-4c5c-9f2d-4fb75f861a0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2411be9-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231678, "uuid": "85e7938f-58e7-4185-9214-db67452a798a", "comment": "Malware payload", "value": "b8ef0b0f878b5f7fd26a0455ff57703c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231678, "uuid": "1536626f-a18c-4402-ac77-f7ef5eff0ed4", "comment": "Malware payload", "value": "b25b3a5895997a86b268c0f1d954997e695e4b397ef253a94f4ad3df99872c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231678, "uuid": "7806ab75-f077-4846-a0a3-d6aaf9150aae", "comment": "Malware payload", "value": "6132038ecb0f273de401ba5309894550b2823a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231678, "uuid": "3c028d67-2e77-40a0-9d23-f7c7f3676119", "comment": "Malware payload", "value": "29b178d19682157a2c78af136b45829643642270f31969507de9dda1b883c29f2cfb33475a7d53e5e97bc15a99654e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231678, "uuid": "7fa1a549-4783-42da-aa76-f376a3fbf31c", "value": "T1EC74F7E15A00AE9FC16DD7BA8801768597F096E32703EAB63DE811EF45C2BC0D7A351D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231678, "uuid": "174ea891-c696-4595-89e6-3d9cc288e484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231678, "uuid": "63e1d463-c93c-47ca-8904-a574bc8379e5", "value": "3072:amgGJ7id+6g7RF3q9jKIzUXzpTH63J/yBnM5+puPDDFVFclREo3PNbDDGvMXKzqW:geqKIoXzs5/snMOuPDDFnclREaVD7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231678, "uuid": "23df1c97-622a-4646-947c-b875752a6301", "value": 355792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231678, "uuid": "645b22d3-f3a9-4db8-9731-190d8bd4fcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231678, "uuid": "2a5e5859-f13b-4f66-b258-e298d16d8a42", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.AHX.gen.Eldorado.14967.28369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcf3d05-bcdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678190198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190198, "uuid": "6cf7fc35-fb04-4562-91a5-769bbbfeb898", "comment": "Malware payload (SnakeKeylogger)", "value": "fea070006007750c1c69082e0563f7af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190198, "uuid": "957b1009-f9ab-4d1d-aa5f-1904c0fe5046", "comment": "Malware payload (SnakeKeylogger)", "value": "b33a98ce498846037fd68b2055d835464a1350c9c067e250689a2be1f17dc987", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190198, "uuid": "579b4680-d8cd-4874-8e03-44a8fef0dd11", "comment": "Malware payload (SnakeKeylogger)", "value": "2e593eb6217db01a316fe0e3b896162184ba7bfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190198, "uuid": "cdb8e467-1c21-49bc-8ff2-b94fcbec9627", "comment": "Malware payload (SnakeKeylogger)", "value": "2dce1ef1a0d8be2eba9a8a0197705d7eb982695266e880ce22dee89f8775112b4be202f86f71635fd9f14883dbc1a922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190198, "uuid": "95500549-ec8c-46c0-a962-270449f79904", "value": "T133259DA56F19A257E7C1A1B31804A7B7EBAC7D4D2427C0883ED13D8FB1B9D2C1111EAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190198, "uuid": "94d71e04-6639-45d2-ac03-ac1c4377daeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190198, "uuid": "0a2a8bab-8054-404c-909a-be367394a163", "value": "12288:WJX3OBVmNUfqBe4nvSopG4q91hl+7fCGiPPvG3kz6c03tSO08ZjYhP6M:KIYNUfqBpvHGcDCp/Zm9SH8G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190198, "uuid": "c82c00cd-5254-4b17-b552-06125b3218da", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190198, "uuid": "f7bf56ef-b7c2-4c2c-973b-0fdb4225650f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190198, "uuid": "390c2251-fcca-41bf-a522-9c3e38e3c723", "value": "fea070006007750c1c69082e0563f7af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fddeda7-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678192859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192859, "uuid": "87d34ddb-ebde-4558-afa1-47b5758b050f", "comment": "Malware payload (Rhadamanthys)", "value": "457bf3e5181bbddea129330b1cd81b78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192859, "uuid": "bd800b09-81f0-419e-b335-1ecc052ff48a", "comment": "Malware payload (Rhadamanthys)", "value": "b3c16003d613c90f1741bf5b9cf2f2ceb3eac08da27dacefd8162364838a3227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192859, "uuid": "348aa13f-f2f4-4331-a848-33ed2cdc32e7", "comment": "Malware payload (Rhadamanthys)", "value": "efa77c57e3c3349fda484f7b06b69ce0635a6f12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192859, "uuid": "5ddf9742-a96f-4a4d-af1c-72fada0f97b7", "comment": "Malware payload (Rhadamanthys)", "value": "d989e24a913ecc91badb0c1d8cb1f38a049264cb55a887e6b2deb5046715d73474dea238c73a8ad8795b507cbc0b0cbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192859, "uuid": "6c96a4ee-8b04-4f24-bec8-99d5d859d3b8", "value": "T11464E02176E1C076D6EB35304938DBA50E7B7C32E6A18A5F335427AF1E706C1AA72713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192859, "uuid": "50c5281a-3c29-4299-a8ef-0c067f3bf938", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192859, "uuid": "43856a25-4a6d-4787-8403-26d5fb2e0069", "value": "6144:5mLIg+4U0b0iYqEV1uz8+LyznLFOpUOF0ketYVMNb:5mB+L0sqEVQ8WyznLmB0kk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192859, "uuid": "53d5acb0-9dcc-409a-a9d7-775d3773af8b", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192859, "uuid": "b9016905-82d5-4fae-adb4-d0b2ee800c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192859, "uuid": "00e10fa2-fd36-4489-996a-5d85168fa591", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250c54d2-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678195793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195793, "uuid": "9564c7a7-d44b-4a78-93be-4b7d43dca95f", "comment": "Malware payload", "value": "c63a5164632ef0d8cfad3d70a14a1b01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195793, "uuid": "3fa352bd-9ecb-4b38-b9b6-f7b49966da3f", "comment": "Malware payload", "value": "b3e24e4638d67d9f5d2b4b6acc3b622fb9e5367f215efab3048a9cfe48cec22d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195793, "uuid": "998e860a-5e66-461e-8eb5-dfd42ffcde55", "comment": "Malware payload", "value": "2cf7e7acdd1fffbfe61cbfd5d4ca51c0cf3f114d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195793, "uuid": "5e5d0f05-48ca-4e96-83ee-473c1d226ace", "comment": "Malware payload", "value": "723a6109498e53c6325bd4345b423023205a3a0cabefdb1f742c1d7228e353c1cca208d6524f88a06b7a12705e83d5c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195793, "uuid": "7ec53b72-5528-4eeb-b6fe-f0a82c80c783", "value": "T10AD50735BE43E022C06337F44FB6968465297D105E95541AFBBDBA0CC9F6E03EE2426E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195793, "uuid": "8a346989-36ef-4807-8acd-d3c92a5d4767", "value": "cf07656c09e8bd7ad25c51f60d4260f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195793, "uuid": "080c3463-3e2c-4461-a9f6-46d8e75f7f9a", "value": "49152:dI+jl9y3tQ3UBSIbHWTpAjlpFbfBPV9pFP:dI+p9kbHltfB9FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195793, "uuid": "bfa51c8c-c0ca-432f-a12d-3f774b890008", "value": 2856120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195793, "uuid": "03eeacde-5949-41d7-88ac-c9d6b727b531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195793, "uuid": "540cd09d-0891-4b8e-a0a8-330f4bd68802", "value": "c63a5164632ef0d8cfad3d70a14a1b01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e7ac41-bcb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1678170246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170246, "uuid": "059c3b0c-811b-4a45-b46f-d52cd6327b1e", "comment": "Malware payload (Vidar)", "value": "a0631b0dd813f4a58b4dd58a5738f3cf", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170246, "uuid": "c4bf5fbb-4819-4996-9847-482af1f1c6c7", "comment": "Malware payload (Vidar)", "value": "b42efeb49eaf39524073c5e8a8230ce592bfa6e8333bbecc4a599a0bf3740975", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170246, "uuid": "82315e60-a5a2-4182-b668-b543e2503167", "comment": "Malware payload (Vidar)", "value": "29d3e479a7bf93c86750f1b2f29cf08f38c1f5f9", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678170246, "uuid": "5142db9d-21f7-4760-87f4-f76c1b0f3290", "comment": "Malware payload (Vidar)", "value": "1e411d741e7d22dfe42273f7add1902f7ce54d79111fb769315596b0439b4a070fba0bfee9d6b8c6b773e7af13bd627f", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170246, "uuid": "5fc5c0ea-3bbc-4a92-8e06-42b351842052", "value": "T147B4CFBAA398E931D53DF774A839551083AE3CB56913CE5E99866E883B333C01FD058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170246, "uuid": "73aeafb3-43a7-4fe6-ac11-07ad27483779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170246, "uuid": "763bcaa6-cdff-40f4-8d3e-34a78cdbe128", "value": "6144:Si2gm3FP0ZNsXobOp5Pyn0Jf9AtqYHeSRrj2:jvm1JX1pNeQf2F+SRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678170246, "uuid": "06a84eb5-f4f0-4ef4-af64-edec2824a6a4", "value": 497928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678170246, "uuid": "1ec7ec37-d3ed-4d7f-abf5-fee9070c98d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678170246, "uuid": "4ba04fb1-d9f0-4cd8-bf5e-bb54269481b8", "value": "a0631b0dd813f4a58b4dd58a5738f3cf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abb13c7-bc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161121, "uuid": "562d719c-bf29-47d9-bf9d-08919f642fde", "comment": "Malware payload (Mirai)", "value": "0830e2a8a648d670c23a39b9f5b38376", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161121, "uuid": "f938bf76-aadd-4673-b8e6-df5dc34b5e4b", "comment": "Malware payload (Mirai)", "value": "b51b1295997f60ac446a5f750a16df854edc76798b5efbdab5c8de7658f4a299", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161121, "uuid": "23ba5599-0975-49d6-aaa5-6a1900961b34", "comment": "Malware payload (Mirai)", "value": "12d143fd66f55f356f4fb7a5968a937a0797e7e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161121, "uuid": "f0a90898-93c6-42db-bfd4-5acf91329b46", "comment": "Malware payload (Mirai)", "value": "c5acbf64178e04d3e07d86c910ac4c4f3f32e420046f737c94191ac5e6a8579908de5f22647f37268d21ad9e32c2a902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161121, "uuid": "f7ac061c-50cb-4840-8909-438c367c09c9", "value": "T1E7336C36E029DED0C6560234A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161121, "uuid": "fcf7c271-49c8-454d-a040-787048019d12", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161121, "uuid": "6b10f24f-3685-4140-857b-56e0b560e951", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161121, "uuid": "ba36a02a-ea9b-42d1-8d82-54cc65bc7e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161121, "uuid": "b9f8249d-d83e-4e98-a354-ab14a31d8aa5", "value": "0830e2a8a648d670c23a39b9f5b38376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfaad35-bcf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678200021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200021, "uuid": "8295081e-d6fe-4d3e-a7f6-a5e5419e0ef8", "comment": "Malware payload (njrat)", "value": "044351e90cb1c56cac4275c4e8866ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200021, "uuid": "aea2fdc5-534a-4089-a585-8c27dab9ea82", "comment": "Malware payload (njrat)", "value": "b5d515196a439a946dc4eeb93ce45561decdb0be66a0014dff15e2b81b709965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200021, "uuid": "01e16ee9-e8a8-4380-9531-46e577e93383", "comment": "Malware payload (njrat)", "value": "d5bd27068c64286d9108518ff1eb409dcb07b150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200021, "uuid": "73b12297-9a7e-4db3-8c3e-ce5183f12c00", "comment": "Malware payload (njrat)", "value": "e69d6090bdebaf520a2042779e0884642f2f04cb605363ce66995f705a6efcdc5b542b51235a1d2fa1d4db1c11e01414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200021, "uuid": "ef4f3225-3e5e-4987-8e1e-3035b1961aa9", "value": "T15EF20A8DBFE24194C2FD5E774671D2220376E0171A23DA6D8EF884B61BA36C48E5CED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200021, "uuid": "65e877e9-78b0-4d65-a859-1e333e9682ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200021, "uuid": "658090d8-8307-42bb-9bc0-2cdd2aea334d", "value": "768:EkSWR/Bq39mnL59MoeU+GQ8NXEhq5lxOBcmZPtUTjC:EkSWtAtYL59MoeU/QG5lxOWmMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678200021, "uuid": "9078fc8a-09c8-4b80-9e72-2c0d892360dd", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678200021, "uuid": "c2d00cbe-439c-4814-874c-5077754d5872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200021, "uuid": "4d6fd72b-a308-4605-b072-4ebdb4a5738e", "value": "044351e90cb1c56cac4275c4e8866ab7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941cec12-bcb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678174075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174075, "uuid": "afc09def-dff2-4471-8a06-e86becbd8d47", "comment": "Malware payload (AgentTesla)", "value": "9bf22c6249b33b9a4474663de0391b19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174075, "uuid": "22d68a7d-469b-42ef-ae2f-87d13f6a9186", "comment": "Malware payload (AgentTesla)", "value": "b6c69de041a70157c59538fbd364f10135a4f4ad1a996397049f346b1ba21eab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174075, "uuid": "c2f22513-7842-4098-897c-7c2ec3075bc6", "comment": "Malware payload (AgentTesla)", "value": "3f3fbd603ca497084596f1b5a68f1630ff44d76e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174075, "uuid": "cd5a2aac-ac4a-4785-8a36-049ee9ee0871", "comment": "Malware payload (AgentTesla)", "value": "30b59f55e97377775a810b347a0537cf4d3485ca39852dd480022b71e5749307adc57df6ed529b4ef56e008dfaf4b15a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174075, "uuid": "f06f4933-375c-48c1-9059-88e8644694c2", "value": "T1ADE4C27D39B792D6C234FA7346E7E620B5BD80A23307D958D9EA1AC04F421827DCE95C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174075, "uuid": "76e3e8d9-03d9-4c66-9258-80de4f363f63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174075, "uuid": "5388089f-b290-4c0d-86d3-724c6dc09875", "value": "12288:sAZ+uNIkegET9jsIBMNjnNNOhAe/S0eE+tM5eo3BxXcPVmSKkqqI/dCTdsgzWeSr:HCTsIBMNjnNNOhAe/S0KpWBm9m9k2kd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174075, "uuid": "ae4046c4-7182-4d81-b078-b5fe464f4044", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174075, "uuid": "67a9d628-c00f-45e1-bdaf-72c1279eb16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174075, "uuid": "4a01de03-3048-4adf-aacf-0615061f1a40", "value": "Scan_0013882982_SKMBT Remittance Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bb7798-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678199464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199464, "uuid": "07279e89-3e3f-439d-ad3d-131d78dfde4d", "comment": "Malware payload (SnakeKeylogger)", "value": "ffd34afc23737d5d82396600a577e2de", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199464, "uuid": "074e00c3-f1b0-4b46-a657-3286121b734e", "comment": "Malware payload (SnakeKeylogger)", "value": "b76266c113ec9b84ead923a1f14d8607c13bd2c557a4ec500775e8d775549d7c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199464, "uuid": "69686a67-e31c-4edd-82e0-6038ccbbaaff", "comment": "Malware payload (SnakeKeylogger)", "value": "f783e56a3e337652e5d867a775757b5190d1797a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199464, "uuid": "e960596a-92d4-42c2-ab37-1e15b6b4dec4", "comment": "Malware payload (SnakeKeylogger)", "value": "38bc7e3809b0537cfd51ef5d5437ffb80ff40080f4cb39d1e3d65a6a45deda3153f058db69f7afd31db4012ba8d53233", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199464, "uuid": "482c16bc-e676-4549-b140-cc0ec9d2e96b", "value": "T1A455F10392389D8AD102C7BCBA2F3559110EBC3661D5A5CA364DB70B5733FAB5ABF118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199464, "uuid": "60b49899-5cef-4712-950a-58f33d820fca", "value": "24576:eLKrB5tHlxjWQmmav30xHBvBGtHlxpWQmmav30x26FiQ0Mnx+27z:eLKr97CQmmQ30RhBk74QmmQ30M6g/Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199464, "uuid": "1764d926-69ab-47fc-ba52-cbc22f6b9cb7", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199464, "uuid": "76140338-5930-4f84-854d-8d2d7d83b430", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199464, "uuid": "a522227e-9a50-46a3-bc9e-f14177834dd3", "value": "ATAMS2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a338f173-bcf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1678200729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200729, "uuid": "b984c7df-e1d4-4c2e-b624-79d31d67662f", "comment": "Malware payload (Adware.Generic)", "value": "7f1afbb1f303fa7825609d870f970c75", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200729, "uuid": "4d7b480f-836a-438d-ae98-a096d1ad16c5", "comment": "Malware payload (Adware.Generic)", "value": "b7fe14058e8415478159dd459ea7e84eb9c0c9449cc51fbf2925bfa712f19c20", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200729, "uuid": "37a04dff-658a-473e-a1ce-8d96dbe002ad", "comment": "Malware payload (Adware.Generic)", "value": "fdc8eaa2258d1e385993b6c69b48685dc766de07", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200729, "uuid": "579de7a9-0f03-464d-bea0-e4fc0676546d", "comment": "Malware payload (Adware.Generic)", "value": "b6961387858e8bae98009b7fffac50e0efb6a8cf8b33cfd7d1aa6a614e1d62f6a2c8f27ff46a2bf222ad2c9cb54b4779", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200729, "uuid": "0c15103e-4ca9-45f5-af68-f1137b588c3d", "value": "T1DAD533A3BA6019A5E0478577B16CBF20AF5CEC215371CF0BA561FAC6A9B02D347D2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200729, "uuid": "b392b11d-8c9f-4a33-a2a2-6c33be6169fd", "value": "a0c012e2da92ad42555210cc958fa405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200729, "uuid": "1a8c361e-cf20-4854-8763-7e34e509bac1", "value": "49152:DmFGB6jgk0erMz6z7SNUbaHrzC+3FbbmxUZJmZjPS3KDBorqoyT/SVk:CFGB0gZmWOyu+VbbxrUPoKDBorq1SVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678200729, "uuid": "70573d5c-af74-4de8-bac2-352e0843b05d", "value": 2864544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678200729, "uuid": "9f2a5b49-77a1-45d0-8e84-1238f6763272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200729, "uuid": "636ccab2-1d1c-412a-9a4a-5258ab63d0ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb048dfe-bcf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1678200420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200420, "uuid": "ec72b3d1-b9d9-4883-8417-d68f7e21845f", "comment": "Malware payload (Fabookie)", "value": "48f4f6461f03606000016cee556bab4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200420, "uuid": "f5435e3a-47f6-443d-a935-6f8311883349", "comment": "Malware payload (Fabookie)", "value": "b840bd433a47d42c5ff7e6ef94c39b1309849398e7d4a51938fdcfacfa26b793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200420, "uuid": "6f0beb41-07a7-49c6-ba07-32b143a6fa0a", "comment": "Malware payload (Fabookie)", "value": "304d3c6f6bb11414c5c22c0a83e45d63166824e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678200420, "uuid": "1f9b061d-fe77-40de-943c-f82f1008dcf3", "comment": "Malware payload (Fabookie)", "value": "f961a77c11e11eb2aaae4ba625957dddb574ef9d944bb02984a9de2745717bd04da2ea9bc2f0500bbd259230b57225cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200420, "uuid": "d5a68738-996d-4dd2-9081-80e327bad788", "value": "T1B424C02172E859F9D67A4130DA235737CBB3BC541928172F12A0CB9A1F3351ABE1EB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200420, "uuid": "142d8964-1da4-4803-9a3c-35e5e9232d6a", "value": "90292de38e2bd6803e8e5e27da945a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200420, "uuid": "9e7937b2-c649-48e2-a210-ea80ec2132df", "value": "3072:xVFE/ZYueQ6059PKEywh8QzEfae1NJLgf7nDVF6PUp1Yo3ICgC:MYue05FhyI8wEHN5gfzDVlVXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678200420, "uuid": "1c74ed64-8223-4afa-8691-47e2ccb1c3ef", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678200420, "uuid": "31f3ca35-b43e-490a-9679-a1dc5f12ba69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678200420, "uuid": "61e0ace8-ff1e-4470-b3eb-4e788bb881d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7f627c-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155431, "uuid": "f7c01511-ed19-4087-9d67-140cda88198d", "comment": "Malware payload (Mirai)", "value": "eeeb4ffa6bf45f1a64e555fcc6b137b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155431, "uuid": "b69c6231-6172-43a5-8267-07bf3a41ee1d", "comment": "Malware payload (Mirai)", "value": "b849bd8c30236b5ee97dc70981a1692bbcc81f76cd25cf44cc6b90307294f552", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155431, "uuid": "a9fc4db1-c719-49da-8420-9f607d4a04d6", "comment": "Malware payload (Mirai)", "value": "aa2371297bc28cfd47b30f098c576a016ccc7de2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155431, "uuid": "b99596f3-cab4-43f6-bbd0-3e35b26ca9e1", "comment": "Malware payload (Mirai)", "value": "495b9c9596b977169d6f225e6a06bdd7bc53e086a0e4ddc8dfba81a7781a1c79536bf6011af94d298f87aef191041967", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155431, "uuid": "a57ce154-84f1-44ad-a0be-effc5df7b630", "value": "T18E231941B8818723C6E51376F66E46CD372563E8E2DFB21BAD222F50378682F0C67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155431, "uuid": "3aa7b897-c96c-4fe1-9bf5-46742f710770", "value": "768:jMs5nwSZHbA18dr1338mDKI9ZUG/m7iXATD/N+ED3PZLYw:p5nwSVbACpVxa1nTDZNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155431, "uuid": "2642b510-d21a-4c2f-9d86-aab4a0a9bcb4", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155431, "uuid": "f4ea7048-b035-457b-ae34-17ae0177af81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155431, "uuid": "603fc7d7-7c7a-4089-99cc-ee85c78088b2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd257070-bcf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198196, "uuid": "92f35803-b981-4922-91c5-455b081116c7", "comment": "Malware payload (AgentTesla)", "value": "b503885d153a89ea72da331904168aed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198196, "uuid": "08bc69cd-106a-4b02-873f-c88c24311e36", "comment": "Malware payload (AgentTesla)", "value": "b8812397545808ecf86c5dc5202ca5d05fedd2ee21090808f51fb5d315910851", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198196, "uuid": "f860a5cb-a705-4051-9379-391555abcca4", "comment": "Malware payload (AgentTesla)", "value": "2490fee052ebb866d4e7fca6e313df6b9ffadc2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198196, "uuid": "eb4ea673-e66f-4cf5-91f8-50b6e5729bb9", "comment": "Malware payload (AgentTesla)", "value": "b0f6632dac6e5a065d9feeeb4121d2a64c407c9641184f82c74e44221f73ec4936e4bea770add1fdf1aa05cc835ef7eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198196, "uuid": "69a87b29-1bcb-4698-b8c7-9a346c1c463f", "value": "T10225ADA56F19A257E7D2A1B31804ABB6FBACBD4D1417C0843EE13D8FB1B9D2C1012E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198196, "uuid": "fa6d3caf-c65b-4ea2-ba9c-beedd08a2564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198196, "uuid": "bdfefe5f-5f90-459c-ab3f-184b6aa400a8", "value": "24576:4cYNUfqBpiuzcfty9mDMUUIjs/SFOOnIyvZP0om:WNHfzcfty9mD5UIjs/9OnIyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198196, "uuid": "9cf0610a-fe8d-4881-908c-ed2bc99ebbba", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198196, "uuid": "3436a8b1-b521-4983-9c12-6e05afcc08f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198196, "uuid": "854b481b-4f64-455a-ab7f-ecf7aa6e636e", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0dfbf2-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678210004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210004, "uuid": "0be5404b-a98d-49ec-a621-98cea5112671", "comment": "Malware payload", "value": "c344f584881e90d426235553fedacff3", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210004, "uuid": "abc28006-f7b7-4be7-933d-ac72fced6179", "comment": "Malware payload", "value": "b9cceeddd1c1b538557dc237655d9a5cffa9911801856e5d1a8dd9a7dd9031e5", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210004, "uuid": "94871ebb-80ca-4ee3-bb57-e394fca94eb8", "comment": "Malware payload", "value": "21f9cfdf4f6e85cf8834e1a4718395fe586d3b49", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210004, "uuid": "7f42c555-d69d-4169-936a-6d8b5f070d1e", "comment": "Malware payload", "value": "f6429f8862b346ab53c8126204c481c33e62e6762d964260dc9bb5e9930196203441bacb7fde7515e4f6bd61646cbba1", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210004, "uuid": "4bf50d9c-3e36-4821-b368-f143e8e28ef5", "value": "T184463A43F89191E8C1EDD17086269292BA707C854F3123D33B50FBBA2B76BD46EB9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210004, "uuid": "404471a4-1396-4bbd-9dab-797d2e7d323a", "value": "49152:z0gg2J/cN2rb/TrvO90d7HjmAFd4A64nsfJDc753DJ5mvbJUL0znqyWFGXpd/Wc2:n3Av3WpEfkov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210004, "uuid": "96d478a9-f614-408c-b3ba-c99176448ecc", "value": 5828608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210004, "uuid": "b878a6f7-67d0-4096-925e-609ed4473533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210004, "uuid": "d2c548c8-9413-40f8-a899-1204ddce04bb", "value": "d_linux_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab6f1fb-bcc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1678179321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179321, "uuid": "f09ffe97-1583-4c69-8b8f-d9522cd70ae9", "comment": "Malware payload (AveMariaRAT)", "value": "c4b7651986f28b21b779322e2d0a9a10", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179321, "uuid": "bc41e85c-7d89-4765-9109-d636ed0237f9", "comment": "Malware payload (AveMariaRAT)", "value": "b9d2eab1d0ed029c25c12c85ed04e8ec7abd0813e2ee90435cdf56967c2bb8cd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179321, "uuid": "fd279017-d46f-4f32-9146-198c3ed0d7b5", "comment": "Malware payload (AveMariaRAT)", "value": "93d5509102582d8885abf4e25af50c3722d7d7b3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179321, "uuid": "5e212108-30af-49d6-bc98-2355a4504e16", "comment": "Malware payload (AveMariaRAT)", "value": "420e31acb6f32d4507dec14b8f0c1d89e8cf9adffa83599ab7ff4ecddf1908df4872720f2355314d0e55724b92b96ddd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179321, "uuid": "6fdaa99f-d19e-41d3-815c-c848e2103a04", "value": "T10405AFE42F5DB263F786A0F328042AA7DBACBA5D2527D0541EE2108FC5CDD7C1152EAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179321, "uuid": "c35897ff-47b1-4e20-9291-629ad891619c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179321, "uuid": "10de0f94-375a-49b1-b964-fa0567031ff4", "value": "12288:s8XibrYwchpDWZsPuI9gFQ9bbiMjdyHs/LvwRCz7POi1b97wjx:TibrYwGl22N+wbuMyM/LvwRC3OiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678179321, "uuid": "d8d6b3d8-89a7-4b76-8f1e-71abc0d4d7da", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678179321, "uuid": "69b29efb-7992-4d45-bfb6-5e0686265f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179321, "uuid": "1dcf052a-3649-4755-969a-c8e9c14e7dd2", "value": "7hnidyiHcUQiC60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0944cf-bd0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678211129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211129, "uuid": "2267a01f-2c0f-450d-bd13-b6a461b08e58", "comment": "Malware payload (RedLineStealer)", "value": "a90bdb831d15588ce2493d86d0bd9a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211129, "uuid": "eb7029b9-84dd-4a5c-a8f2-95b44048b5c3", "comment": "Malware payload (RedLineStealer)", "value": "ba500a72bf6c89ff854336db958b331d9f006020071c8073fa849c5e9abf6525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211129, "uuid": "cde26661-23e1-4650-8145-445c66fccb50", "comment": "Malware payload (RedLineStealer)", "value": "ee060ebe2a44c700c5131a424e82453d9fa842cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211129, "uuid": "705c3f0e-7d49-4173-bc39-66b2e79380f8", "comment": "Malware payload (RedLineStealer)", "value": "7ab033b2779e6185215013a2369def3b5ae830e3567b3efc490f8139336535023125cad76a7cadfd8dff4c271ac76175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211129, "uuid": "4f22f79b-8e30-4501-b314-4f40c78dcc99", "value": "T18304C41037BCCD11D5BA5A3F6961A05087BF98026842F35B76C367CE0E36B50FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211129, "uuid": "fb8497c8-5a7a-45f7-a8ca-c5a6b714f939", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211129, "uuid": "575940f3-3564-4aaa-8f6c-2a16eb5d33aa", "value": "3072:7xqZWjfa8oty3uMLeT5FRhTnxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+c5:NqZCuMGRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678211129, "uuid": "ea563024-6b85-4587-b0c5-61c3899c4a17", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678211129, "uuid": "b639e1d3-b8b7-496d-a717-4a8bf4c9880c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211129, "uuid": "e496c59a-2680-4382-976a-0dc70c07ceac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4629c3-bce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678190925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190925, "uuid": "00a0f42c-5fd3-4ad7-ba49-2d0618b497a5", "comment": "Malware payload (Formbook)", "value": "9c50d404eadf1b8a4c4fcfb57c7736f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190925, "uuid": "5bcd7a47-693f-4560-ab06-90a8d9019d28", "comment": "Malware payload (Formbook)", "value": "ba5bc20c0063cb1a4e8192d7a552cd7dba167607b57e2f44552df8a34ed490ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190925, "uuid": "636c9d42-3498-4afb-b51d-5752397da8ad", "comment": "Malware payload (Formbook)", "value": "fa0183f8e4367fa7f4b72209a4f040007c37a219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190925, "uuid": "47060de4-c753-48b8-a808-e91dea584cb2", "comment": "Malware payload (Formbook)", "value": "9924b34748acb53047b47a504006c168d8ba1eca92ce157bfe977304fa84ca745d8bc979b2ed14e0075dc0b3196ee762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190925, "uuid": "de38a543-77b6-467e-b52c-b8f4371dfd2e", "value": "T1D5154A0B643E9002F49D20B51B12272FBE78D65D5E67E2F23686542BE14AD633FC2B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190925, "uuid": "79f356d1-3ec1-48bc-8eb4-88f3fcd0b916", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190925, "uuid": "1e6d99b9-8e02-464d-b40f-5fd51a528b72", "value": "24576:46CCF1W6ZesX2vB9OLmn8SowCNPM3sP6PMYH4WVI2UIKsRcGaDm2:46CCF1W6ZesX2vB9OLm8xwI03sP6PWc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190925, "uuid": "7373fa47-59b2-4617-ad3f-6a9b5b1a20c1", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190925, "uuid": "96e87b6c-a0d3-4b78-a9ab-24ec65e05c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190925, "uuid": "802b17c0-7abc-46c6-9f79-2219138da080", "value": "z17rasbpaltaasaprbqbr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed54de94-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678210303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210303, "uuid": "ec7c9029-aa4a-43a4-a79a-a28bc33702f3", "comment": "Malware payload", "value": "4b0e93354da17984f0bef68b9ab83380", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210303, "uuid": "c776ccf7-7655-422f-9c23-d44122aa8f83", "comment": "Malware payload", "value": "bbaf483c2b6f67f22eb6e1fa00f200e9c1e201b0110070acaefd416cf846b1aa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210303, "uuid": "b1dedd7c-7f8a-4cec-9a2b-cab8cffa2195", "comment": "Malware payload", "value": "bff351735b6153339cc8d52089495db0533392b3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210303, "uuid": "a27a0844-21cd-409d-b196-507695d3bcc2", "comment": "Malware payload", "value": "b4267a45b84731fa08105ea48ccc77b9c506cee291a0df3e52d8d27eb321f66587671de20e16deb9f77eae4b6d606a61", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210303, "uuid": "9b3f8c4e-d720-4f43-84c2-a5ab0ab68c93", "value": "T1CA361243F7DAB96BECF3C3325775972611078C6A8B43D643584476BC18BBAC04E86AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210303, "uuid": "ef0ac2d4-a79c-424b-b608-3cdf6ed23c74", "value": "98304:pza2GxDDbL6zkfwe+0F3hoiLUpbcqon9BsTBAx5r3LyNXvOwxHMRA2QAFZ:pzMxDDbL6ew6Ro6Szo9BCBAxs8wtkA2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210303, "uuid": "18671a95-ad7f-429f-ad61-5549d1cd62a4", "value": 4962211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210303, "uuid": "627ea84f-7373-47ff-b5ab-50f4256238fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210303, "uuid": "f3a092a7-9893-4cd6-9bb3-859fd28a03fb", "value": "Chrome (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1309cc4-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176379, "uuid": "72db18d1-bccb-45e7-b436-f28f7f8dd251", "comment": "Malware payload (Mirai)", "value": "c96b3279e4805ac7b3f257e1c88b09ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176379, "uuid": "2fc41866-d6f8-437c-a430-b2faf66040e7", "comment": "Malware payload (Mirai)", "value": "bc8eebed39d196b866a43e40f0f7039bdd23fecf268c494a5df6adf62df4fe77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176379, "uuid": "df55fcc4-3f52-43e6-ad06-a930b6430520", "comment": "Malware payload (Mirai)", "value": "b8c03f849cf7ab6dbfe3c3ab19d850fac8b2ee8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176379, "uuid": "0bf7e24c-f713-4fa8-b32b-0cae8140e58c", "comment": "Malware payload (Mirai)", "value": "9b4531fb0d731361d8f3b5a2f9cd8b09c07aac065e4fd67a93d1482445fb69f1b6875ef3b1d1f25cbe6ff9970a0d90fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176379, "uuid": "38012766-3c17-4bc4-ac8c-84f2f65f469e", "value": "T19E532B89B4019F6CF94FEAFA41124D0EF5226344A5930F27B76BFED36C710A59E0394A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176379, "uuid": "84e3e277-b38d-4022-a31f-ff66cb719bb7", "value": "768:dgMxFn2pydb5pe5SON9r8hdk+EsGPBpp0C+gCP4cul9WcxxyntYhTsuv8wFZE:dgLyPp5OT33sCR+lP4VzWQyntGTs880E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176379, "uuid": "b9a93444-a390-4366-9f74-b1a28c757f06", "value": 63552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176379, "uuid": "f097d39b-8f3b-4f8c-a62a-274ecbf1b93a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176379, "uuid": "deb2a30d-eaf1-4c39-a884-30f927b23684", "value": "c96b3279e4805ac7b3f257e1c88b09ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9b0647-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678196076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196076, "uuid": "359d219f-9f7e-4824-8939-ec60f843ae1b", "comment": "Malware payload", "value": "f981ee633618dc55b84fd91eaa2e75ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196076, "uuid": "abc72538-5e56-43d0-8b42-df0dd3af4284", "comment": "Malware payload", "value": "bcb5833e9b9ff99e6d2001552ad663f511bc57af02ca6ecacb188130fd8d753f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196076, "uuid": "4b99caec-1f1f-4aa5-85c3-41d14917c280", "comment": "Malware payload", "value": "da0f557874113d68c4924b9e49c2712fc010738b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196076, "uuid": "7b9e6829-6346-4bb1-864a-e688c3f8af81", "comment": "Malware payload", "value": "235bace22e434c3fbdd7126ce49c06b4df765931cd5cb344caf0322ec55a4fb4263fdde1cb5be4f18bd799cd38e85290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196076, "uuid": "ce15badb-4bef-421f-bd7e-69bbfc6b5be3", "value": "T191058E9132B1D4B3F5CB017560287ACC2D7CB143B6D4F24B6A777AC0A605ABBF6A8D11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196076, "uuid": "fb2ad8e6-a017-4ed2-baf1-e60afc8a5f61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196076, "uuid": "a603efc2-bdd0-460a-976d-41015674fe02", "value": "24576:r1Qwe3cOQHKgxHt6mgdlwQNa/tlaVmYV:rBRxHcdDKlaVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196076, "uuid": "40968ecf-687d-4f85-b9ae-8012a0931ecb", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196076, "uuid": "f88d3cae-8c9d-4a10-9b86-094f6133787a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196076, "uuid": "ef4dc880-cfbb-498f-b831-011e0db2d0a0", "value": "f981ee633618dc55b84fd91eaa2e75ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f7ad9b-bcd3-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678185026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185026, "uuid": "0bca053f-c9f7-4640-a50a-c9b21378a451", "comment": "Malware payload (DCRat)", "value": "f6a80c245622a0e205143fcf4bbae81b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185026, "uuid": "0b8c09b0-ea10-4212-9650-3ea0b1a68821", "comment": "Malware payload (DCRat)", "value": "bd20321c1b7bb6add3c6d692bc5d623ec8b37364e740571c6552d118d75e61e9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185026, "uuid": "891b6dab-eb46-4eee-8973-0e39f5d7d540", "comment": "Malware payload (DCRat)", "value": "cbc50db2147671ac085b85b5dc5395e3b5974015", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185026, "uuid": "6721bb5c-da9d-4f9e-99c1-4ce5ca1e912a", "comment": "Malware payload (DCRat)", "value": "e775e457e548739a162f3d3236ff55dfb30e0df249deb65f27f827d786db62d28a51a855424a0586665cf7c2f212448a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185026, "uuid": "d60a74bf-6b0f-477c-b3cc-40ab3a8d744b", "value": "T1E1454A427E448A52F0591233C2EF494847B0AD9166E6E32B7EBE77BD15123A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185026, "uuid": "cef6fc14-a262-4443-9ddd-268bc122afd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185026, "uuid": "ae90a0c5-50da-433e-b922-127ef0f6d817", "value": "12288:bgqLV75IMaxFueMuMZInKxuV0JeFQ4VDSlRMLyJLGITdGIw9IDmZJX9a86NlRgsH:J55IFuYJKfML8p4IWZJXg8GRgsI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678185026, "uuid": "daca3530-2e0b-42f6-9ad7-0505d4194403", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678185026, "uuid": "6d6d5882-e439-410e-9e0c-804dfa5123e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185026, "uuid": "622c5e6c-5336-444d-b36a-a25367b8425e", "value": "f6a80c245622a0e205143fcf4bbae81b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c784be0-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678192048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192048, "uuid": "0096d706-9703-419c-a2fa-c90f51a9e747", "comment": "Malware payload (SnakeKeylogger)", "value": "9b5f19653f844c3b0ee4e261efabc909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192048, "uuid": "3c2be6ae-a41d-4c6b-88b8-f750a8a3c69c", "comment": "Malware payload (SnakeKeylogger)", "value": "bd3704c36cc99d990c773ae12328f7938e7a5bf230e18501f2f8b869532b28d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192048, "uuid": "2073f7aa-2d5a-497d-91ae-2e9512f59459", "comment": "Malware payload (SnakeKeylogger)", "value": "a984f72836ac7a2cb247c91798c24581ceaba49b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192048, "uuid": "ed90e25f-b423-45e2-a4b5-aa4e0e533b50", "comment": "Malware payload (SnakeKeylogger)", "value": "580410c0e823674f247c98d3bbf6b5595b4537738737dabd8fd9c0198842415eea57b9a720047baa516c36a2486c53c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192048, "uuid": "b0e0777e-35a4-4a98-aedb-299985d451ca", "value": "T17815AF9132B194B3F5CB017560287ACC2D7CB147B6D4F24B6E777AC0A6019BBF698E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192048, "uuid": "05078d54-d368-497e-b3dd-810148a7baf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192048, "uuid": "4b4f5bfd-8b8c-46f2-bccc-c1c51a05cedd", "value": "24576:4r1Qwe3cOQUY1e/IFHIgr7BmvV6Sd/ev0xnu3N74bItGE6Mx:4rBm4dov4Cev0qN7+ZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192048, "uuid": "10ee8ee2-bf4d-4aaa-a9db-4f57fb301f3c", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192048, "uuid": "4ffc95c4-21b3-4ed6-80c1-971a599fdc13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192048, "uuid": "84a2666d-1402-4d0b-b66c-dcb0dd5e3ae2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917c358c-bd10-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678211437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211437, "uuid": "23fa810e-1bd9-4b95-8863-5664dcf79b26", "comment": "Malware payload", "value": "44acbaef03563e5feef87e57e5e2e12d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211437, "uuid": "b06d2fc8-258b-4770-9db9-ab1ed687224d", "comment": "Malware payload", "value": "bde7edb2e9d5c117677faf4a11373c465e3e5d776348c6156987cafa153e0033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211437, "uuid": "0e1c4f36-5eaa-4562-942c-f272e3cbe683", "comment": "Malware payload", "value": "86ff5b3bf9ef5572b01e809bafd8e1dbf376c53d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678211437, "uuid": "50052a56-3cd1-4bb4-8790-903a2a42ec74", "comment": "Malware payload", "value": "d84a9c740595165ea79695ee1de7ea79ecb6db10af4180791bf38258910e5a23e1d2f3da958d335ee4fcdd8f877d1bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211437, "uuid": "95017a92-e634-481b-87dd-43a3a6b62073", "value": "T119A5337BC6481684DD378A396F0395F5852323E52E7A1BA410D6E3211707F6A33E78BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211437, "uuid": "6b8107f1-46e5-4259-b0bd-6b081ac0f01b", "value": "aaa5676a9471619c6d9f60b74546b854", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211437, "uuid": "0657c07c-2cb0-4821-a462-55c97ae08d3c", "value": "49152:C8ez9PrNIgqoiXXNIVtdat8gHdHoofY3sTCgFC0mEkhnkEME70z:+P+x8YF5c8u10Ehnk4Qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678211437, "uuid": "e7ea6748-72ea-4bc5-ae0f-3c013d0b2918", "value": 2193720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678211437, "uuid": "904a2e7c-f842-40f0-92f6-1c29459ff356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678211437, "uuid": "4f72dd89-bab0-412f-b64c-96b316ee892a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd979c8-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678199457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199457, "uuid": "20ccb340-d8bb-4688-b66a-446512e58c0c", "comment": "Malware payload (Smoke Loader)", "value": "9138ac412b5d5bd98b0de282e20c80a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199457, "uuid": "fde9162e-3736-4c59-83b3-5e1f1e61d2e5", "comment": "Malware payload (Smoke Loader)", "value": "bdfe58167a1995f4dc095b13e2e77af10955cd0ef1d4f75d596120a929ae69a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199457, "uuid": "5b15eacd-2574-47c9-a943-70cd912c8015", "comment": "Malware payload (Smoke Loader)", "value": "d11d22ed4a9c41dfa5f0d5ba4567bb82c600428c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199457, "uuid": "1e25058c-288d-425d-99e3-16c5861a70da", "comment": "Malware payload (Smoke Loader)", "value": "9ee91ff409edc6d870ed737206d3572688caa26a326c9a581950ed0cb93c3005c594dcbbb1008965f18d979a216bb300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199457, "uuid": "bf804341-c938-4d2f-81b3-4714dff9dd96", "value": "T18E44CF21B7E0C176D1AB05B45935DAE41E7FB4322574C5ABF3B416AF1E302D09AE6323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199457, "uuid": "ad376c67-00f4-4386-b7e0-d6f832fadfa8", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199457, "uuid": "ba0dae89-fddf-498a-b61f-26f5fe626fd6", "value": "3072:XuXtGgLBc63XfPL3V3wTqxInjp5Fz4LBb5tDryNnHUbowL+ez4X4eZjU:mLBco3i1z4LBb5tDrenHUcJPX4eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199457, "uuid": "318897da-bda0-4528-a9b0-5b3a159880e9", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199457, "uuid": "aa4a4abd-a5a7-4aed-ba37-6d4ff3a690fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199457, "uuid": "e96ab26b-cd80-4734-b039-680330058a86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bc3a6b-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678195974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195974, "uuid": "7116b868-14d8-4c7b-aeb0-f2c6be382398", "comment": "Malware payload (GuLoader)", "value": "b785b0bb8e1f9cfdd3b32a5d591cebb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195974, "uuid": "21a6720a-6408-4cb0-a3cd-e3c32acad24d", "comment": "Malware payload (GuLoader)", "value": "be05b704ba61464c03135da23ecd74bfb3866a369ec721cdcc3be462d8a1c450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195974, "uuid": "0c4779ad-3d43-4b03-8e18-f7fb3f916cbf", "comment": "Malware payload (GuLoader)", "value": "71a174bdedb9029602d3e60106fb51dbd61a8e29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195974, "uuid": "facfd16c-b37c-4cf6-9c79-6511a708cae1", "comment": "Malware payload (GuLoader)", "value": "ccf2b256080caf16ea5e5a2979bec66828a9552dfafc176e2c36d79da746e4752eb15b6edc82445808193dbb8be0d929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195974, "uuid": "076386a3-8f3f-4f07-a0a5-e4812661bcfb", "value": "T12E94128A3B66C5ABD6661A32DC7BE2F2A930EE01E871974327403E5D3D311814F1E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195974, "uuid": "93fd53d8-c3f2-43a9-aa6e-589ca5040d39", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195974, "uuid": "94e74ad8-51ae-47ec-8ade-d5de135abdb5", "value": "6144:ywq3NpW6itLvG0Z51xsFi6cLYDbXwwTLpr1381SS91pMm3Mx9EJoh9/vG3o4pmi5:yzq6i9r7CEYDbXTLJSWJOojfLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195974, "uuid": "3f6f187f-9a0d-4eda-859a-135864ce60ec", "value": 440106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195974, "uuid": "025445b7-3699-490c-a377-de6c3b02fae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195974, "uuid": "a5e880bc-2299-4cac-a0e4-c16c8754e058", "value": "SKM_CE 06032023.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60487a1c-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678192457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192457, "uuid": "a5e5d769-a854-4d4b-afce-d558784d389b", "comment": "Malware payload (AgentTesla)", "value": "3aeba063b45fa6fa7a5203ba13812ced", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192457, "uuid": "140f343a-03c8-434d-8be2-2f9a17986c0c", "comment": "Malware payload (AgentTesla)", "value": "be749a359ee404fb076cf0f488ba20fb296edfaf918a0c0e88673e6332b17fc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192457, "uuid": "b23d0a5a-2036-41e9-858f-769b4942523f", "comment": "Malware payload (AgentTesla)", "value": "2bb4ef9ee5b18d73e93ef3c5989d4f669f7a600c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192457, "uuid": "c4400c65-4e94-4751-972d-fefc8a9000d4", "comment": "Malware payload (AgentTesla)", "value": "022606c24e28d5cfe76c8e9001434af1af7fec329dfe535cea80f491e0562641bfbc7d6da7f4dd2a83305e0d3e815463", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192457, "uuid": "66a01b2d-3f77-41ea-aa5f-2938a11c3de9", "value": "T10DF3296993D58E52C72D4079C4A053490AB2E157471BEB6D0EE49CFA3F463C3362FCA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192457, "uuid": "f489bf43-339a-44c3-997f-44cd74881340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192457, "uuid": "1feffe92-70df-40ea-be22-803e46ff0a2d", "value": "3072:LdtkZxpo3QD+eJi5HW1ZVinJpZ6E/AYFtpDSeGTCY:Ld6xKYLJiFcMhhZUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192457, "uuid": "ef3ad090-8b63-4d20-9c32-f8a721e7cf44", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192457, "uuid": "2f707982-e40e-4d02-b316-1320606af900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192457, "uuid": "40578bc8-3405-42e8-a85c-e764870a1636", "value": "be749a359ee404fb076cf0f488ba20fb296edfaf918a0c0e88673e6332b17fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4b28ee-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678192158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192158, "uuid": "2a378850-663e-48e7-84dd-ccac08e26a1b", "comment": "Malware payload", "value": "63cfa3b0ae5b6f7054315b793843ca7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192158, "uuid": "36e581b4-5477-4d70-a03d-d3c920c5134b", "comment": "Malware payload", "value": "bf6a3fb762b8a4506797d1c8d6ab164276e05453930c0e7f31ba7c6af8aede40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192158, "uuid": "680c24ee-95b0-45e3-8059-77d639111825", "comment": "Malware payload", "value": "fccb06e75b5365b6798fe8825aab4bffec2912cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192158, "uuid": "682cd4a9-60c7-4a5e-a46c-4ac41be13e98", "comment": "Malware payload", "value": "fd81a40dfcb7af64c3af25131e27bc7accb80619691dfa454c63b680a326056c08bd213ddce250baadc8da51b57552d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192158, "uuid": "cdf3733c-4427-418a-806e-3708f4bc25df", "value": "T149263333BE0E9204F161E1B41415E9A10C7DB8B61BDF2ACF678D81B36E5A7B0C9B1716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192158, "uuid": "30b159a3-025d-45d0-a66d-616b59c0299e", "value": "1f7948b75e8007bde9f40a49c22ca16a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192158, "uuid": "c3941d67-d299-4547-9008-569edcb6afd8", "value": "98304:tyQPhAW6eVBE1NvhgHtBZ2koNAHJeGtfgDOLLNGatgSlYqRvpJ:9hoebehmZLeAIGg0QatgSlJvpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192158, "uuid": "56acadb8-2d1d-4115-832f-235035b4faae", "value": 4455360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192158, "uuid": "eda2fdd5-fde7-44c8-a2b4-6809e967036b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192158, "uuid": "d243c5f3-1eb8-438e-b954-cbc13e40dbde", "value": "63cfa3b0ae5b6f7054315b793843ca7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a63468-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678195679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195679, "uuid": "91ca3649-5aa4-43a5-a494-f7e5f02000bb", "comment": "Malware payload (Mirai)", "value": "a7db8b53e15a928670da645e918b3767", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195679, "uuid": "89a859ac-b284-47ba-a3d0-ff17337ad30e", "comment": "Malware payload (Mirai)", "value": "c0d1a9f3691ff7f3d8a61370a5e7ae8e5ee005a6f22cf50f1a90b0954f0ad4ac", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195679, "uuid": "c361488f-594b-4b31-bdd8-4d6d8a8c42f2", "comment": "Malware payload (Mirai)", "value": "939431e4d0cf2d6255b73e6e698f6335b6bca782", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195679, "uuid": "c00ae16d-8370-4185-b16c-203ac759cb55", "comment": "Malware payload (Mirai)", "value": "f4110a52e422c5406d8438f766b2748fe936f785a6cd58910d0c2a6ecfb6cbcfd55ad42c59e8e16d920a8ec50f3a8f5b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195679, "uuid": "0f7cf130-c194-4024-97b3-b262d9037a39", "value": "T108D2D1E790E772B0C4D9F9BA215663C4FD71B519472C57AF0ACE28ACDEB30C49634644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195679, "uuid": "656a96e2-03a4-48c7-8702-862398f11678", "value": "768:SYSoXdJZETc51aBftnBURHyoO/MIKhKllEwBLiSx0s3:SYJdJZiy1a/W4dgKltLt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195679, "uuid": "39bbf6f0-9b4a-4ad9-96cb-d4272d0229a6", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195679, "uuid": "bb219a6d-ebb5-457b-9579-4a3942a32503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195679, "uuid": "76b2cacb-6149-4d6e-b612-332077a99aae", "value": "a7db8b53e15a928670da645e918b3767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07df472-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678199571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199571, "uuid": "d55e96cb-e297-4388-abb0-f7d5118810d0", "comment": "Malware payload (AgentTesla)", "value": "7922e40015f186d02baa152911f268dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199571, "uuid": "a96d980a-1c3a-4d9b-abd3-02e247a0196c", "comment": "Malware payload (AgentTesla)", "value": "c0d69c07096000d15184964499d68e91874da06fc8d461ae8b4bc376ea72fd30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199571, "uuid": "99ea27ed-6b7d-45eb-9b44-5358759fa7e4", "comment": "Malware payload (AgentTesla)", "value": "eb445943e5cfebc37e5eded2e87bc3bf16662bb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199571, "uuid": "b80132a4-f4fb-4f7c-9878-25691d74c115", "comment": "Malware payload (AgentTesla)", "value": "62256b0806b1c389dd0bd6a3b0f19e2edeb111ee5aac8e5a1408ac22427dc887e3104cd3767a01ef3076e180135859b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199571, "uuid": "eef614d8-bdf3-4e9b-ab0b-f8fe112955ef", "value": "T11E259DA56F19A257E7C1A1B31804E7B6FBACBD4D6416C0883EE13D8FB1B9D2C0111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199571, "uuid": "e1041f72-10d3-42fc-b273-e1cf86418c51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199571, "uuid": "daabf358-9f88-409a-85a8-1c0f0a2cb1b7", "value": "24576:PTYNUbH5MuG6CT9JSiKuyyBgAFJY9cqBp:UNuZo6YjSduyyBgAFJYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199571, "uuid": "ee8aab70-df86-49df-be60-b8c67226c666", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199571, "uuid": "e74b5210-4347-4b8f-86d7-62d70aea0453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199571, "uuid": "caac829d-6076-4af8-aebf-ee0cd545a682", "value": "7922e40015f186d02baa152911f268dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d210c4-bc80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149755, "uuid": "35e4e93e-41af-4f6e-ac65-b23ff2e6587d", "comment": "Malware payload (Mirai)", "value": "f78ed73496322cb4fcfa80be1c295a56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149755, "uuid": "25a55ea3-ddab-48ff-94e7-0e93ecc30fb7", "comment": "Malware payload (Mirai)", "value": "c14afbac867ed17499e875ebf069cdf0837692a02eada308337ac39d061338df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149755, "uuid": "603dc5e5-cb50-44a8-b467-8fb90064517b", "comment": "Malware payload (Mirai)", "value": "df4c4722f92b557e5850281ecea0522d4cc7a976", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149755, "uuid": "ff61c88e-6830-4b1b-bcf6-74b0e1d3481a", "comment": "Malware payload (Mirai)", "value": "db3df4b7623e1a5993e4a4d283eeac887cdfa3db7525e322619366dee4903b9541163e932a7f419dca45ea677d14d90b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149755, "uuid": "dc761cf0-f8c9-41d2-81b3-a247950edbeb", "value": "T174A2BF2D7BD7374ACB9DAC3D024C16B4AD5F75C0324A4B1A07414C8D7229E5FB68E6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149755, "uuid": "02c6fdfb-fea0-4291-b397-5ba39da92d97", "value": "384:HOnyBaRczYNKgK44MVYI/TymEMaj45V81SSEJvowRWGVCz0NviK:HOYBR4465EMm4AgXWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149755, "uuid": "f6005fb9-8650-4a68-b61c-0fa2cd0499f6", "value": 22180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149755, "uuid": "be6e4717-ada1-4bd0-acc7-a45fd4d78c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149755, "uuid": "c60634bc-3025-41cd-996a-da262fd5a5be", "value": "f78ed73496322cb4fcfa80be1c295a56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97c0ecc-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198592, "uuid": "6fbbddbc-7300-44b6-9c19-63bc4672f5e8", "comment": "Malware payload", "value": "0732c64d49f8f9432250bbf3eaa920d6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198592, "uuid": "0a5478e8-4880-45f0-ad61-eb56ef02556d", "comment": "Malware payload", "value": "c1c21ff2fb79e555889f461ea596cbd4a183515f0d607c5b950e7ec1dcf2abe1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198592, "uuid": "da760eca-3023-4d67-92b6-e856be8bf419", "comment": "Malware payload", "value": "cdf9d9dbd5e83cb75d491430ca57f4bc1669818f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198592, "uuid": "b67142c7-122f-4659-aee4-191cca394c1e", "comment": "Malware payload", "value": "1e86e5460fa0303377df72351afea27c74ebf1b5b89461012b65056dcd0574a688d2c488c91cd7f26b48fe53f8f0b4f5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198592, "uuid": "3195eee0-7c25-4723-a233-092097dadda2", "value": "T13041101C39BD4651D3B31D338425DB21B7353101DC368FAC26C68B486911A40FF3AB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198592, "uuid": "45ac0d66-af05-41bc-8749-bd692016746b", "value": "48:8Fb/UMBY+2KuIRIRI+d3d2X5p6JpJJPeC4+:8FbUO/2KuaQIYEXH6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198592, "uuid": "6f376b07-eec6-41b9-84d2-bb4fe39029db", "value": 2266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198592, "uuid": "38d5c906-b188-4afc-af7e-bbc0c414d826", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198592, "uuid": "f7ea9ac3-e7e9-46c4-a109-9dc97c6e9065", "value": "lebenslauf_2023 01 15.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b4112d-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198873, "uuid": "93ffee01-8879-4775-b4d1-f0fe23a6b1a6", "comment": "Malware payload (AgentTesla)", "value": "5092537a72fd01a36badb8572689bbb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198873, "uuid": "17a2b931-51f2-415f-8c7a-8731cdd3d6aa", "comment": "Malware payload (AgentTesla)", "value": "c2f9b55d138def6ce13aee0438e44e97ea60199e1e707f57e42c625fb305764a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198873, "uuid": "08567a0d-380e-42d2-a37a-4acf299bbde3", "comment": "Malware payload (AgentTesla)", "value": "1cbd7cb6b0c2445c27456d999e77df9369bdca3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198873, "uuid": "c36cb2a6-81be-4745-a7c7-db71f3e55810", "comment": "Malware payload (AgentTesla)", "value": "5a7925e6c807a17833e30efd2d1dd9c5c3858516df21e01572008d1c9cfad363c53fd642be97de1c44072f1c2da6c307", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198873, "uuid": "8d6e9bb1-947f-474c-97c1-dc1a6d0aade4", "value": "T14005380B643E9002F49D21B51B12272FBE78D66D5E67E6F23685546BD00AE233FC2B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198873, "uuid": "aadf275b-4170-4b45-b15c-3fdebc15f56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198873, "uuid": "f981cdb0-6d0c-4b18-8481-77e34c15ec34", "value": "24576:G6CCF1W6ZesX2vB9OLmnoUkjresEZMY8NDunZJDkSS0:G6CCF1W6ZesX2vB9OLmoUkjdEZMVaJDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198873, "uuid": "7bda6b02-282b-45e0-86d6-947158c441c1", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198873, "uuid": "021368a3-1d84-4651-959e-672fda0ad8bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198873, "uuid": "e2deff52-b37d-44a4-a709-f601aac8418d", "value": "5092537a72fd01a36badb8572689bbb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7a8d2e-bcc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678179003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179003, "uuid": "ec027e99-b23d-491d-ab71-c397e7d7e492", "comment": "Malware payload (Mirai)", "value": "3f3b3471c2ccb2d0bc45a91a90792824", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179003, "uuid": "9df206fd-7ad5-4426-a6ea-49d0b3d66156", "comment": "Malware payload (Mirai)", "value": "c3e546a46397142e391c3d5a92e78c26a97952a350909f60812ec3c7d8b02b40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179003, "uuid": "19919513-3c41-459e-9012-711f5d87c02f", "comment": "Malware payload (Mirai)", "value": "16b9fe355ec386ba9ed40b3628e5c30d2de4e173", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179003, "uuid": "bca2c1b7-9993-475b-acb9-b8f3957e630a", "comment": "Malware payload (Mirai)", "value": "0f90d0f6a58cd7d081a3661091a303decce420a6411d7a4a661795bb6452ce2968c5229aa015bdeb6f5d842f5e853fee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179003, "uuid": "b5a452dc-466a-46e0-9d97-0311bf6cb810", "value": "T146E32B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179003, "uuid": "eae7f81e-8566-4cb5-b6ac-15ad33f02091", "value": "3072:CJLce3pC5mf7/abHbz4NpaIJ8VIJ1FsUXkkTM/9cHMY:CJLcej/abHbz4NUIJxHsUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678179003, "uuid": "ef57072e-7674-454e-99d9-ed497042d603", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678179003, "uuid": "82038073-38af-49c2-9ea1-79ac82acaff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179003, "uuid": "3c78fe7f-a3d6-475f-9629-f6c5890e43f7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feabcc37-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678198735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198735, "uuid": "a89236ba-a841-4979-a061-96e04b23c1c0", "comment": "Malware payload (Mirai)", "value": "b6e844f4d7d5571f71302cba0ba9f030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198735, "uuid": "a08b1af9-af9f-4119-8d3f-cde3795e6f68", "comment": "Malware payload (Mirai)", "value": "c4ab14889779c1f253946f6275b0b094ecc8f19dbb322fdb69aa60351f0862fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198735, "uuid": "5e945cc0-776b-4257-91d7-110d9c692989", "comment": "Malware payload (Mirai)", "value": "147825515c45dca2b083a284a8ebadbbcad7beda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198735, "uuid": "aa0daf54-51fc-4aa1-b886-4f424299f351", "comment": "Malware payload (Mirai)", "value": "0d21fff132ca18d0d58e31b77d1f5c041edb04576b7175028253a78c002959b311809704cce984344ee0eedcd498586c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198735, "uuid": "c81507dc-0b17-4a6b-b0bd-04cb3253fa14", "value": "T1BB232AC69443EDF9EC1505742073FB328FF6E83A2159DA97D399E923AC42A11E2072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198735, "uuid": "259d9041-c489-4084-8ffb-45af63898a96", "value": "768:L1nQe8SmNlXEWPCGWsoYxfqaO59HlM27YW3ivhbvBe9UEMt2:L1nQe8SmNlXE/nsSfLziJbvQOEMt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198735, "uuid": "282928c1-812a-4f58-8111-f9b3029f81fb", "value": 49884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198735, "uuid": "11200710-96a4-4556-91c2-5daa948dfc70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198735, "uuid": "bb68a732-9f94-4be0-b164-5bb39d0a187e", "value": "b6e844f4d7d5571f71302cba0ba9f030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628a33de-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1678176140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176140, "uuid": "c431b8d0-7aea-43ac-90dc-85de0405bd05", "comment": "Malware payload (YoungLotus)", "value": "212c5beb7e726a395316402bc999a534", "object_relation": "md5", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176140, "uuid": "9fcd656e-b6b0-4f6e-8494-b493c2bca75b", "comment": "Malware payload (YoungLotus)", "value": "c5bbffaaa02f6289977ee6ba6f2684953114cebc79f3e3e6aca7ca301a87a117", "object_relation": "sha256", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176140, "uuid": "46fd6b45-b19a-4822-8db4-e3870b7f7f6f", "comment": "Malware payload (YoungLotus)", "value": "d767e6fa17f6fd5cba05ec8e2eb3b8cd05b17601", "object_relation": "sha1", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176140, "uuid": "9f06821e-5280-4748-b74c-64419a1ceb8b", "comment": "Malware payload (YoungLotus)", "value": "503cbd4d42745894c5b1c2d6b3d565d0d9e3509586d37a4cbedf736426057827d8e87e0f0e91f2b19c49649a2c9ac643", "object_relation": "sha3-384", "Tag": [ { "name": "124-220-35-63", "colour": "#90B71E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176140, "uuid": "26a8033c-5fa4-4731-936b-9dd7f6b71afc", "value": "T1F8450280D82041BBD1975AB054B116BCE6B23CA52E35E6F983D7F27436B21F8D1EA173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176140, "uuid": "12ac3c8f-598c-45a7-9b50-c875a45f2595", "value": "8f54c7f89ab7fb80e3cbd057af48cb19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176140, "uuid": "31b12358-5fa6-4215-910f-fbb81dd1bac9", "value": "24576:Ih+HEj5fhxXUJrlqQVAtJ9be9pIwpVRC0ueNvqI5c0:IhwQYsQStJ98hRxuwSIq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176140, "uuid": "69c881ff-290e-4237-8d66-408df081c6e7", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176140, "uuid": "3a64809f-256c-4ce8-b470-824f017ba18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176140, "uuid": "68ea7f6d-73c3-4aae-a41f-60476dd09905", "value": "zmp2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6c9c47-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678199560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199560, "uuid": "e2b1e051-037a-4b92-8dc6-aa7042328b94", "comment": "Malware payload (AgentTesla)", "value": "4367a4092b69619685efc9aae101ab6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199560, "uuid": "bbde57e1-5a71-4749-a621-95e999810936", "comment": "Malware payload (AgentTesla)", "value": "c7118fec7d8d5039bdddef1ca99be4a490a036a792cd65085c61814848667fe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199560, "uuid": "5579e11f-f2e2-44bf-acca-a8c402dcb4a8", "comment": "Malware payload (AgentTesla)", "value": "68456fcab5d46b5ddeda455273addddbd28713e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199560, "uuid": "a2d804d2-69e2-479f-aa0e-84746d4e8d1e", "comment": "Malware payload (AgentTesla)", "value": "79692f41ab8cbe4112b3fb9307d6aa0166211634893958a9543ef8aba41c5e08bc2aa206734c077dd0bfde931601f669", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199560, "uuid": "925c4a32-dbfa-4e3b-bd5d-ba79b3511517", "value": "T19B25ADA56F19A257E7C1A1F32804E7B6EBAC7D4C6416C0883EE13D8FB1B9D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199560, "uuid": "43f382a5-212d-44fa-bf62-df0f026d30e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199560, "uuid": "7e63024b-7ce3-446a-871c-8cb6fbfcf112", "value": "24576:NIYNUfqBpIDlcYdzWbyWp7Ly3YgoBeiZ7UaTAo6D7c:RNHqcszep7LJgowiZ7Ui6D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199560, "uuid": "eba83fa6-1248-424a-b82f-b45434766e2a", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199560, "uuid": "29d6872d-d74c-44e6-b25d-2f746477952a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199560, "uuid": "e90f546c-9633-410a-b42c-08e8444b28e4", "value": "4367a4092b69619685efc9aae101ab6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d6b90b-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678209673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209673, "uuid": "8bf6a785-ecf0-4c02-ad54-4fe6315c4e11", "comment": "Malware payload (Gafgyt)", "value": "60b1aa61af09dffe03829a2595ea45d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209673, "uuid": "2c9f469b-f58b-48c3-bd3c-087286f37b14", "comment": "Malware payload (Gafgyt)", "value": "c7d883cb4ffb1f9a9c19c30e46b5b0180a253d7e02350a5252bfaff1e69bc125", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209673, "uuid": "dfad1019-1eb7-4250-b8f1-14f10cae685c", "comment": "Malware payload (Gafgyt)", "value": "cbc507b2f09263feeba18a9b68e5811eb46c0d1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209673, "uuid": "837c0cc1-c60b-4907-9482-b831c6d33274", "comment": "Malware payload (Gafgyt)", "value": "d903734c8c8789cbfc6782c836925c64e1cd494a215a15cfb900063432e32acdbce430c045dfae938e95ceac272c7953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209673, "uuid": "61e23d4d-7908-4407-be3b-e36dcfc1c981", "value": "T1BBB32B4796A99FB3C086BAB515EB59300722ED120F2F1A9621387BF4437F5CD740EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209673, "uuid": "11116626-fc89-4872-9ed0-6d25bf2dc38c", "value": "1536:MqfWC0o17MhzlJpKgElT0T6Rk0MgPCtB5EDQEPWmmycgYVLu1IPYC:lfHdBeQglT6zPGcQgWmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209673, "uuid": "ba00d85a-7cd5-4b55-98c4-aa2eeb180b46", "value": 108482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209673, "uuid": "9b95ac40-acac-455d-90b4-d0b01df10334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209673, "uuid": "5d95400f-b2d5-4c28-8a99-4d49b0928332", "value": "60b1aa61af09dffe03829a2595ea45d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88def87-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176364, "uuid": "d62f2591-f126-49e6-9970-191392f0ad28", "comment": "Malware payload (Mirai)", "value": "33c7bb5a244e5ff53c87ef66f4baa972", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176364, "uuid": "7834f5f1-1770-4bcb-9bbd-94569f66b17d", "comment": "Malware payload (Mirai)", "value": "c94417e2a613c99dea04e43bcbb1b8609dda2592c37bbed9f6933ed8c3e8a05a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176364, "uuid": "d1a63d1c-ebfe-46aa-980a-d08f9bc891ad", "comment": "Malware payload (Mirai)", "value": "34a503f145a7303c3004ba2058098cf614329654", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176364, "uuid": "959ddfeb-ba9c-42d5-afb5-bc924d791503", "comment": "Malware payload (Mirai)", "value": "69b851c07166d238650b88c1928a4484a2128acb8c52058886447fffef20eebea6cbf9954b6fe9acdf7e117a02d0ad54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176364, "uuid": "0b868592-46df-4a3b-bf9e-00928ff652ad", "value": "T10F133A3AB7742A2BC8D4A57D26F70728B2F5164A28E8C71A7D720F8EFF2095055132F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176364, "uuid": "684938e4-4d60-4dc0-ace3-2fb7b27391f3", "value": "768:QL1gQL81NZ8bcVau2D+DahzIwzI7zzO+DWr0A:QBf8j6bcVau4+DYEWI7zHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176364, "uuid": "c37eccab-6a4e-414f-afa4-de61b52751d4", "value": 45000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176364, "uuid": "7077970c-8481-4918-a223-51b32b30cfa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176364, "uuid": "421a9d16-9263-4317-864d-1a016fdeb4c8", "value": "33c7bb5a244e5ff53c87ef66f4baa972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06497622-bce0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678190588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190588, "uuid": "cecc84ec-6146-4dd9-aebc-2f7fc6c340d6", "comment": "Malware payload", "value": "cbbf59795568c9bc067a4556c2517288", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190588, "uuid": "548761fa-db30-4e6e-bfc2-2b479a7fb9a3", "comment": "Malware payload", "value": "c9c664b5fcef21137013b225015a7ab3bf980612d5590dbc634987ae21cddb91", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190588, "uuid": "18d0dc93-18fa-4f6b-a496-c9d845cc6bf6", "comment": "Malware payload", "value": "fedd573508f5260f5ddf835ef7db2b6df776314f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190588, "uuid": "9b137650-51dc-4dc2-a994-a03018e3de99", "comment": "Malware payload", "value": "15374c31755c1fdfc89684e5dc4018c400534c23d35a666d60cbd2a686e4f98daccafe571d17d3c11b1fb925c8db647c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190588, "uuid": "a0852fa0-8317-4eca-8ff7-a34ffa0487aa", "value": "T1D1145051E7A46C3BF5540779BAB281831A93AD33B911C95626C7731F5B73FA06C32E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190588, "uuid": "4f36cebf-f48c-463e-aa32-4931a68bb4f2", "value": "3072:KwekZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAOQvqpN2TwqHI92ns:Kw7Z+RwPONXoRjDhIcp0fDlavx+W26nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190588, "uuid": "97343683-db3f-4702-9744-d1b303ab456c", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190588, "uuid": "2e54e540-224c-400a-9cfe-79b43c888c43", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190588, "uuid": "676f38ed-e26d-4b5f-ae93-863a542014f2", "value": "attached quotation for gypsum works at Dubai hills.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75e7ff6-bca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1678164793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164793, "uuid": "b481c7f0-7144-42da-a4dc-488677de751c", "comment": "Malware payload (LockBit)", "value": "4b122da82c589d68d15a98ba73997910", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164793, "uuid": "e028abb7-d931-411f-a889-857543efcd5f", "comment": "Malware payload (LockBit)", "value": "cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164793, "uuid": "94b27c77-1319-451a-a8b1-e8be5f5aea32", "comment": "Malware payload (LockBit)", "value": "3e4e31479d739e49af21f381a2be11a4e93d2d22", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678164793, "uuid": "a1b1f7c4-4111-4a1c-9e3b-e0f443423b48", "comment": "Malware payload (LockBit)", "value": "47aa7d703b4fd306adef7d9628a0df40bee335c3f3d50bfd16e59101bb625e353149fd9b4ad39ba63ef17fd643921ad4", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164793, "uuid": "8f9ce929-49f5-4808-92d4-3f841989eb12", "value": "T12CE312603A906FD0CF16073A8FAFA56AD7AB523444AC5323CFA4A473ECD1740A86D53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164793, "uuid": "44c386a5-44b4-4bb2-b9c6-097520c28a31", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164793, "uuid": "8c7785a9-29c1-4dfd-baec-a29dc36cdeaa", "value": "3072:5sNRFsG/loOgX68qIAdVcxiUmL+mpSjUMYChsf4Vtr+:+NdNoOgXBqIAdGK+mpSjhn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678164793, "uuid": "7141ee11-0026-4ae6-97d9-2ea46699909a", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678164793, "uuid": "23d3eb20-43c9-445d-98d1-36e620f80366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678164793, "uuid": "579757ad-8729-4a99-b59c-56e604809d22", "value": "bOpDX.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1057ee7b-bd39-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1678228830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678228830, "uuid": "7f2eecd1-cfbb-491b-a643-992efa6184e8", "comment": "Malware payload (BitRAT)", "value": "565ec6628ff44ca16c92656879f60f5c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678228830, "uuid": "dc13f83c-7d64-41f1-bdff-ea352ecb5c36", "comment": "Malware payload (BitRAT)", "value": "cca94f664ac1a51d2eb9162383a0f2d4c034ce4eebd24192bc8e13b833605fca", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678228830, "uuid": "d30addcc-fca3-4f9b-985d-49dd037e998a", "comment": "Malware payload (BitRAT)", "value": "bb141f1fb1bc83ee9e9b28c01682c57dc404416f", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678228830, "uuid": "a3c4fea9-e688-48d8-874e-0305287e92de", "comment": "Malware payload (BitRAT)", "value": "db3ccdcb7edb2efd7f26de64e84070cae23694a6ce628131f0ba82658c26aee11a7d0b5a79d8e71550190e4a3c926549", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678228830, "uuid": "568c0caf-2b45-44a3-942b-7ca57a6ec775", "value": "T15206CF02FA46C562D2170230E96E77BA053CF9354B2085C3B3946E6C59B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678228830, "uuid": "cbfee0e8-e575-44db-b740-9b4d421441b6", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678228830, "uuid": "16651676-d6e2-496a-9f05-af51ea309110", "value": "98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/HmlwXVZ4FB:5+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678228830, "uuid": "60caf939-2f8d-4c0d-bcbb-e78c39861229", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678228830, "uuid": "2c4fa8a0-8308-479f-a7a1-d454b20ba594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678228830, "uuid": "8a5e7729-d67b-4b2a-bd09-30d5a0848941", "value": "565ec6628ff44ca16c92656879f60f5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410bc0ac-bca5-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1678165346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165346, "uuid": "19e6d485-b662-440f-af80-3e5f9daf2a73", "comment": "Malware payload (LockBit)", "value": "a7637dfb6b9408fe020d9333d0ade6dc", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165346, "uuid": "8b665a04-1a67-4c0e-8324-fd4504b5afcd", "comment": "Malware payload (LockBit)", "value": "cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165346, "uuid": "5ac24cc8-38b3-4c01-a224-ec12ba7ab500", "comment": "Malware payload (LockBit)", "value": "930c34743ab12c80512723db0aa7b8b4762fcc84", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678165346, "uuid": "efe4f5f7-47df-41c6-9393-befc29a87e4c", "comment": "Malware payload (LockBit)", "value": "ea4f9f4bd5e7e517e176eeb5ee4ed66deda78f18e63014dca6ade8497ee34f8a8ff6a9d4de79e8b4e0a68d87c4415314", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165346, "uuid": "be3e9eee-52fc-497e-8fcc-c0642a6006d6", "value": "T143E3053DB459D275C88F00F27E2516BAE671F83C037985E3ABD38C299410FE96666B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165346, "uuid": "985b2a9a-5b64-4c9c-908c-25b696e5dbc8", "value": "168ea5b327edf5713a2bb8e19a928d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165346, "uuid": "49549e15-62be-4a38-aa47-d4196eab2f06", "value": "3072:ym0ROZIL87L1yoklfzGp3XjRaDyZYMqqD/A+lHlC:ypMCL8rpHjRa0qqD/NjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678165346, "uuid": "0dfe0db6-e456-4d57-a9ab-e88c717133f5", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678165346, "uuid": "7e99abd6-ee93-4011-b821-be2b39026a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678165346, "uuid": "20e75914-14cd-4829-9219-01f955e24027", "value": "29.04.20TASKMNGR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a5ca9f-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231681, "uuid": "a807aa18-b81a-403d-86b5-1320460db670", "comment": "Malware payload", "value": "5cd2e492d52dece44a5692d6b3f33620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231681, "uuid": "dc4c8c50-42d7-4e7a-a4d4-e4c8f476d6e6", "comment": "Malware payload", "value": "ceda8e20c77e299075cdb1f4883d59c0e9cc13d50787b1c957dbb1d38c144ec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231681, "uuid": "ab931355-04e3-4d71-ac25-8291cb0e79f6", "comment": "Malware payload", "value": "671f4d562ad04f88202db3534af03046ea0cd377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231681, "uuid": "ca9961fe-1373-4ff8-bfa3-46a14a6515d5", "comment": "Malware payload", "value": "1badbe818ff39d69576cedc95662655d97d1d86fbe1e581f41e548c2f796f35b00b7cb5ea53c14f73ce008034964fe1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231681, "uuid": "f3e97eee-2676-4294-8dd2-6ba86c7ef287", "value": "T165D48D72F2904537D1632978AC1A62968839BF613D38D983ABF41D0CCF396D27D69387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231681, "uuid": "3a74dfe0-3d5e-4291-91f4-69a819609f7f", "value": "626a6f3345d9c3cd0ccabd44f2e62c64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231681, "uuid": "820d2ba1-5f70-47b9-afbb-4e8b566c6a98", "value": "12288:5I9mNjbU8ACy19iIpAjuwBxMXyvJ5Sm5HYZCmSYSOE:PPZYiJxmyB5nYYISO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231681, "uuid": "88812639-4fd1-4a67-b98a-71c0d0b04903", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231681, "uuid": "5fb16ff2-1c6c-4307-b75f-1be6f019b719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231681, "uuid": "beb041f6-d19f-483a-837e-d16280a02145", "value": "SecuriteInfo.com.Trojan.TR.Spy.Banker.Gen.4756.29008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3306a0ee-bce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678192810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192810, "uuid": "a14e9e32-a84e-47c3-bdfc-b7aabeed313a", "comment": "Malware payload (Formbook)", "value": "d0be0d015a31597a578384f47f659ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192810, "uuid": "0b87b4a1-a54b-4574-aef2-36a1cea4b38b", "comment": "Malware payload (Formbook)", "value": "cef04e7e00436485beb0f0626d6df480635184bb9bc1a20920490eaed6e45fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192810, "uuid": "cdc2e40e-f0d8-486a-a88b-3e147b5d6078", "comment": "Malware payload (Formbook)", "value": "c4225e8703cc8e8ccc895d5ef4fd533e7418a829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192810, "uuid": "d6923d33-f5a4-40d7-bc88-f903ab57437d", "comment": "Malware payload (Formbook)", "value": "3ca8cc0dd18b1c1234fba02e491ca5ca15b104d415f2a7c28e5294fd6e66e6465f0375fe90e2a1ac32e21df2f7e920b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192810, "uuid": "bf69eea3-32eb-4765-8541-ea439aac908b", "value": "T1DA0412494E4B710AF631AA7DB3A73DDC5570B73C1749C5A84CEC982D205863CA89EA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192810, "uuid": "c593785a-77fd-4b96-acc9-a47b1253a21c", "value": "3072:s7jB5SkLbpr9NvdCF8tdiuB6MaIUIEoR5IRMaFi6nRH9grGlAJayO+KagW:Y1kQFJN1LdUS5Eu5IRM+V9grXayO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192810, "uuid": "dec26e00-0893-4890-bcce-4841cd96192f", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192810, "uuid": "733e3da5-a4f6-49f5-89aa-d682a1e1dcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192810, "uuid": "0bc996bf-1330-4c9e-afdc-4182a9bf93a2", "value": "cef04e7e00436485beb0f0626d6df480635184bb9bc1a20920490eaed6e45fa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e86e4a-bc8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678156065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156065, "uuid": "406dcedd-133f-428e-b7a4-972058ccc509", "comment": "Malware payload (Mirai)", "value": "e94d2076adfa96e568898a52357b6772", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156065, "uuid": "844bf259-482f-45cd-ad1a-3e9c3cb6ae81", "comment": "Malware payload (Mirai)", "value": "d14ed484396c60527571810699824ef5c4cd4ab527bd741c2bdf59f5bae281d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156065, "uuid": "1aa0996c-6bf8-47b3-af80-57111a3fece8", "comment": "Malware payload (Mirai)", "value": "a5b30565ce960c4d908ba251ed80cea169f4b6c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678156065, "uuid": "d9370912-7ee4-4262-a72c-1435c87b0447", "comment": "Malware payload (Mirai)", "value": "71036f7e4449169db8e27f88621fe14d83eb88c8e24d504144ad1e68bb6759580583f5b31d7050a0de32a30919c08abb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678156065, "uuid": "ad113866-5bf4-40ac-97ce-410407c2e0d3", "value": "T1A192C0BDAB9012EEC8A495F9829107247B704FE6F842FC4A7B4BE7AB491189D74476C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678156065, "uuid": "1dc56e8d-0a73-44fc-b8d0-df3c172b7729", "value": "384:eB2Ykh5xGZI+3/mPYnAZ60rU/DIkun9ISZAa81aj9i9vvVICmJgGlzDpH7uNj1JZ:eBsh5AZIG/mPYAY08zSCa8gj9JCmJgGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678156065, "uuid": "cbcb9d69-887c-4340-92c5-16f595888c27", "value": 21132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678156065, "uuid": "a3b80420-fcc5-474d-97ce-35bb89179c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678156065, "uuid": "9e97c261-ef0e-41e4-8310-e5e3a306c454", "value": "SecuriteInfo.com.Linux.Mirai.3982.25885.26572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486962d5-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213462, "uuid": "c310adfd-b3e7-4b23-8bd8-cae559709403", "comment": "Malware payload (Mirai)", "value": "d835bcfab116f1dd87d79bd01c084b8a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213462, "uuid": "fe24f041-06b8-4ca7-93e4-587e17a3c6ca", "comment": "Malware payload (Mirai)", "value": "d299163b3a9ea0866fbc08bad75b5629b08bfa4673f3a61a36f117b731c58806", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213462, "uuid": "6f15d8e2-13e3-4f29-9dab-8a29112cc658", "comment": "Malware payload (Mirai)", "value": "a5d9bcedc46f9a54ab238b10ab9968522725603a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213462, "uuid": "09cf2d25-d940-4ab0-8fe2-77766c1689f7", "comment": "Malware payload (Mirai)", "value": "ef49bfa6cc21b6c03f79beead27b723033d30af24c944ce1769931b9084938e9bebf17387631a5d246b9161ffd755df7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213462, "uuid": "16e2f557-7c2e-491a-88e5-6eb74e7faa78", "value": "T1DDB3194278815A23C6E623BAF67E518D332523F593EF71278D222F1277C641F0DA3A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213462, "uuid": "a6ce52f4-1b7b-438e-ab7d-e640bd72959f", "value": "1536:4JdrIoo6/R4Siv3/DLsMZGmeF7nlEEjHvSWYEzYjgCY+41WViiqSEUDPta10+wb1:4Jd0J6/R4SbwWJ+iiq2DPkdwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213462, "uuid": "13144391-2e36-4bb8-b415-35a79da9642d", "value": 117092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213462, "uuid": "ab155873-abdf-49e1-a141-9f52e9d30f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213462, "uuid": "b4daaee2-30f0-45c1-bf86-8880a55b71ef", "value": "uYtea.arm-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91c86ed-bc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161655, "uuid": "d5c8d848-8f4d-48f2-818b-4d7ffa5e9325", "comment": "Malware payload (Mirai)", "value": "24eb7fe4ee5f14ed01b68f4a675630b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161655, "uuid": "3cb14dfe-e8a1-473d-a505-248a539b9553", "comment": "Malware payload (Mirai)", "value": "d2bb3c293b3b7aac5fce92cc34e94dae672fd6a4fa172c047ed7d5d2b7276649", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161655, "uuid": "a2f44540-d515-4943-90a7-f3a408b3717f", "comment": "Malware payload (Mirai)", "value": "fb7519440bb0acb884b1b8a6bf200ae0a290c526", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161655, "uuid": "e752be37-b736-4f65-8fc2-b9ad0ca5570b", "comment": "Malware payload (Mirai)", "value": "91b541ad56863cda1fe2e375d67b82eb95a3d7c83bdf09dcd102733911bbc9a26a257615266d5b511543b12840671cf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161655, "uuid": "5b57fbb0-3aa0-4ab8-a788-7d3063fbea04", "value": "T186B2D0CD60943184CA8D7C7C678D4A674F6CA1C0BAED9B26E350CD9873BEA4B385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161655, "uuid": "99926093-dbf1-4b1c-b815-73f8890bdea9", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpXZqEWvu:/QlS07FUXqIYSXQKqupqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161655, "uuid": "b55f2ca6-645a-4f11-9414-03ddeb1ba00f", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161655, "uuid": "63f47783-6716-41f2-abaf-51db7aa1812f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161655, "uuid": "7c6e51dc-3fae-4cd1-b762-f0c62c25071f", "value": "24eb7fe4ee5f14ed01b68f4a675630b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b941b3-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678191959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191959, "uuid": "6c42e99d-1086-40b1-ac65-984b57755be5", "comment": "Malware payload (SnakeKeylogger)", "value": "000eacef2e4254e30b09a9e4b683d009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191959, "uuid": "fdada1c1-1d4d-4e2c-be0a-a614a8888fab", "comment": "Malware payload (SnakeKeylogger)", "value": "d3277817e3f5dd9265d3797ceb8db5316f75c7f708f9ba2186d8380c7a6530c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191959, "uuid": "cda6418f-ed92-4cff-ac69-160d336ce6c3", "comment": "Malware payload (SnakeKeylogger)", "value": "2150c7fc34a86887f6b5ad520d66e9ab9727df64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678191959, "uuid": "3313e3aa-c6cf-48f3-b3a0-8ec5d7725cb7", "comment": "Malware payload (SnakeKeylogger)", "value": "d8f1a0115bbecdaa5d8ac136c42e8bd27f7af27cae8fb9647feabeaa0aa3aab20e54b22da698484b775ab8011b838593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191959, "uuid": "849c6c18-17b2-4762-bcbc-022b19af3860", "value": "T1FE558CD1B654949BEB9740F36C1AA63169DABE8C5465C00C2AE93F0F72F3B15205FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191959, "uuid": "553b8c70-ae0f-4af3-a132-0edd70920d9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191959, "uuid": "fe7daf76-770b-46a7-acb0-9b27b9ce7467", "value": "24576:D0YNUK616VPsqYoK3qoUUUhJH0PqkqBp:PNJiSpYoUqoGhJLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678191959, "uuid": "b00d6362-c2ff-4da5-9d39-1a541e74b858", "value": 1283072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678191959, "uuid": "40c01a16-db65-4fee-82bd-021f170b4f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678191959, "uuid": "ce6ee0fc-f331-4e6c-b325-3c38792d86a0", "value": "REV\u0130ZE ED\u0130LM\u0130\u015e TEKL\u0130F VE SATIN ALMA EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fb9853-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175577, "uuid": "e53bebce-a494-4996-a55d-64575cbf275c", "comment": "Malware payload (Mirai)", "value": "39af7ccefc709e0f7ffd1424a3077c8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175577, "uuid": "1cea76a4-3a63-4333-8dc1-23249ec7bb40", "comment": "Malware payload (Mirai)", "value": "d402cf90bbea52ad9275309430a355acfec4f284da361850e1f7216a943c787d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175577, "uuid": "51cd6a35-d990-4ee9-bb1a-2ce07b64f00d", "comment": "Malware payload (Mirai)", "value": "22d2b6cd8e8a9caee7bb4c7874d464e657ddfdda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175577, "uuid": "920688b2-4b2d-4d97-b218-0acb56f7db60", "comment": "Malware payload (Mirai)", "value": "bfbba2e7db7744317f16630ed49518dc983e5ccc74be9b1bebdee6f442c290c8d45c940a99d5ed369bdf4447a6ba63f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175577, "uuid": "26210d68-f425-4939-a45e-ed3428462bc7", "value": "T15443940A2E258FEDF76D873447B78E229759338216E1C684E15CE9011F7024EB46FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175577, "uuid": "7f47da10-0762-4218-9189-09414acc274f", "value": "1536:UHxa6gsPJtKWqEbNJ+HaHF4whkkg920qNAjdKlgS:UHNJtKWqEbNtjNAjd/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175577, "uuid": "ca3b9ff2-74cf-4891-bb76-ff060e060dfa", "value": 59520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175577, "uuid": "918edd04-fda9-4612-b2ce-6eb6261744b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175577, "uuid": "d4d62e61-b92e-4e20-ae95-16f9a16d40bf", "value": "39af7ccefc709e0f7ffd1424a3077c8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dcddd1-bca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163982, "uuid": "b8b682e2-4213-48d0-9598-ad677f703428", "comment": "Malware payload (GandCrab)", "value": "d49d108fc8383e51ce7b9dc30584ae86", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163982, "uuid": "c497cb07-1dd9-4062-b745-c632f5e40d02", "comment": "Malware payload (GandCrab)", "value": "d584d61581997008a2fcc0ca2b232a874e33bccfd9f6f08dd81d778a8dcbb45c", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163982, "uuid": "491091e2-a4de-4536-a435-7415ee8123b3", "comment": "Malware payload (GandCrab)", "value": "4edd9a37f95d897f8e8a9a7c5dcae3c8c28e4c96", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163982, "uuid": "2ebab726-1e11-499d-a8fd-ceff5e733f83", "comment": "Malware payload (GandCrab)", "value": "d7df1cd0dc4394745481af23c62b8aecbfe6e8f784fd2c048f40044f43f6bbb5ee72baa55a02e547462827bd34e2151d", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163982, "uuid": "85a91f66-286b-494a-9a22-1f6b84774b7c", "value": "T19A636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163982, "uuid": "8bff4d02-488d-4c67-9f4a-ff4062a81932", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163982, "uuid": "2fa33542-cd03-4d54-b811-3ccbafc6f0ee", "value": "1536:AZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Pd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163982, "uuid": "a936aee6-4bab-4210-9b22-d98896589322", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163982, "uuid": "3de19776-aed0-4558-a263-7cfdb3a18305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163982, "uuid": "7994a436-0186-43fb-879a-aed9c61bcbe5", "value": "2023-03-07_d49d108fc8383e51ce7b9dc30584ae86_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b80111-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678209649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209649, "uuid": "ed8254ad-7b56-4da9-86c2-81f010756edb", "comment": "Malware payload (RedLineStealer)", "value": "2124ef6eb2d7af8726a919e0d6b4b65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209649, "uuid": "142eabe0-fe25-4394-87b1-47450607176b", "comment": "Malware payload (RedLineStealer)", "value": "d65ff348b355affe66cf32d1e054d9b8ebf22757642a678c6a55e821c647191a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209649, "uuid": "345da495-21cc-4385-a4ba-e2bf984d077d", "comment": "Malware payload (RedLineStealer)", "value": "c6770160f6578d891cef809e8074697c99f47009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209649, "uuid": "de243e67-34e9-44e2-9319-887090b551d9", "comment": "Malware payload (RedLineStealer)", "value": "a83bf5b3c4da500ede244789d0641c5d1e75db78e05c66c3cdb1f0ce1672a60c7d68bdaf030461b8197c842547641ced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209649, "uuid": "b96cf695-5c7f-40fc-b387-d4011a316a6b", "value": "T154C4020BBAD84173E9B4277019F702D3073ABE61663883AF36866D1A0D73564F672367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209649, "uuid": "7bed74f1-b879-4b60-aa91-6e6b1ae1ce1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209649, "uuid": "57ebcf33-0ba0-4ae3-a036-4669f1eacd28", "value": "12288:ZMrzy90FbD6mpGEwMfZG0/Fnm8Dyzxi1ZP5n6ImsM2YveZgs0X:+ye6gLo09DWxSPAImsMFeZ5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209649, "uuid": "0edae6e8-e112-4031-b4ea-28d0a6fbc0ce", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209649, "uuid": "52c083cb-3291-40af-9b7b-7823aa7c24d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209649, "uuid": "7f4512c2-34e1-4ccf-a5de-efcad21fcea1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3e2210-bc80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678149774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149774, "uuid": "a386da33-0d3b-40d4-9cbf-0c4ff33c3391", "comment": "Malware payload (Mirai)", "value": "9d7913b9ecb42d5ef189a2cd963b9059", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149774, "uuid": "ef3636b9-a181-43e9-8574-2de64eda5328", "comment": "Malware payload (Mirai)", "value": "d663f238d9fe9b5aa384d29daa6af04da6168b2b311b237604212db92697df1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149774, "uuid": "42e64422-7ff1-4a1e-9e45-5e7e3c6d48d9", "comment": "Malware payload (Mirai)", "value": "54e2ba233993d646e5f0f6ef929a075301faed2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678149774, "uuid": "458fb997-8ff6-49a3-bd95-5eff137582ad", "comment": "Malware payload (Mirai)", "value": "cdb074e3439177e6248aeb918cd42aee135fce6dd0fbc1d9368f25db1ee102edf71201bb65e63869be0ff214cb1ec5fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149774, "uuid": "b0e4af13-42f0-405f-a914-7366210619f0", "value": "T11592D0B8C0493F59EFBF25B24C22DB9633720D9207D32DE11587AB2101525657B569FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149774, "uuid": "da597c40-e79f-4efc-9930-47201bff7359", "value": "384:xlKJnTrHl14FBB6exWR6LZKnyONWj8z59Who8fY02LM4uVcqgw05VxJbe8:yxTrHlWtRcmENDzw244uVcqgw09Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678149774, "uuid": "175bea36-5972-4ece-8a66-95e828f9fef9", "value": 19344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678149774, "uuid": "9883eff5-e148-4aea-b9dc-0e4c642f0c53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678149774, "uuid": "4c211217-3d57-4893-85e5-8127ac9ad797", "value": "9d7913b9ecb42d5ef189a2cd963b9059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598e81b5-bcb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678172259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172259, "uuid": "2bfbc6e9-e526-48a3-8ed7-4aea5f42681d", "comment": "Malware payload (AgentTesla)", "value": "c121cde37ae9f4f9909c4ee8d84a7edf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172259, "uuid": "a2f0cb82-1b52-47a6-affc-1f2b79e9d379", "comment": "Malware payload (AgentTesla)", "value": "d68c31e1a3d21da2eb1e9bdd3cdb9e3f6c71d27e148304bb5517a1fc8b32704b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172259, "uuid": "48a9368c-c7ce-45ad-8297-8a3d9b5298c3", "comment": "Malware payload (AgentTesla)", "value": "39ec64697880210c4d4c7e2f87eb506b80b16b92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678172259, "uuid": "d55a4252-ce4e-4bfd-8f3f-32f1926222c9", "comment": "Malware payload (AgentTesla)", "value": "db52569f75840f21fef8b3ad998bb5e65846b8937fdaf7d85d82a61e000413f735cdd8f9d7c99f2bdae5fbf98b18e77c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172259, "uuid": "08fdc111-16a0-452e-8ab3-a62c78134163", "value": "T1B445B2303EFA502AF173EFB69AD4759ADAAFF6733707A45E109103860A13A41DD8153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172259, "uuid": "d2884cc8-8410-4c3d-bdc3-e1ddc0692872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172259, "uuid": "a214e303-d26f-4ff2-885f-aecb113e8bf2", "value": "24576:Sh4uOREBzq7zYpJJrQqLGJe4pcWmHl2A:k4uRBz3jIkWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678172259, "uuid": "18333646-1f23-4802-84cd-3b5adff4119c", "value": 1178112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678172259, "uuid": "a1f401ea-ad46-4380-8ee0-8e454634444f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678172259, "uuid": "4f440c66-7b42-4f5b-a8e5-6e28570ffedd", "value": "No.783006720pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242fa6f5-bced-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678196221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196221, "uuid": "8bbccfd1-41a1-4361-83dc-edb32d0fab93", "comment": "Malware payload (RedLineStealer)", "value": "eabe7374b6911fcd5ffc72abe8edea50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196221, "uuid": "39cc63ed-bb0f-4b2e-9807-4f45404a143e", "comment": "Malware payload (RedLineStealer)", "value": "d6d417bd2873b58931c75431d7f7a24313ef0980b918a4aabbaa02d41e96e7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196221, "uuid": "e330587c-470d-4114-97f4-8f536ec473f1", "comment": "Malware payload (RedLineStealer)", "value": "f724c41820d1f376be08f136d43c708430373c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196221, "uuid": "11979a8d-66af-4806-855f-96c9d3bd025a", "comment": "Malware payload (RedLineStealer)", "value": "302c7715d98e61ea759b15544deacb8221d0c2b0533bd8af6cd932fa362aef5eca81694de960f4e2c5526524a8b0172a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196221, "uuid": "9b318441-be61-464f-a6b0-11d9629cd1ab", "value": "T16594F12132E0C472D6AB15754874EAE12A7FF432567886CF37582B6E2E343D05EBA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196221, "uuid": "93c8a235-3253-49d9-9404-8c11fb5f25a4", "value": "e0796fd4d2678f1ac0c3dc6d4697501b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196221, "uuid": "31fa8407-0ff7-4443-877c-bdd86476a71d", "value": "6144:djsQyLCUD2E+QQAbb58KptRBOydtSF8M/Ftap3CD:dC2UD2DQQu5HpNzSt/F8p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196221, "uuid": "8613e978-4f79-4c5a-89f1-0fe490089de1", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196221, "uuid": "9e80634a-a674-41e3-a269-4575b22d33ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196221, "uuid": "c463b600-b6b5-40e8-9580-a0c406176c5e", "value": "eabe7374b6911fcd5ffc72abe8edea50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca3bee4-bcf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1678198222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198222, "uuid": "1020c395-5235-4c16-b17b-56ae567ddec0", "comment": "Malware payload (ManusCrypt)", "value": "75de993ffc429a40b338f5ab5f42f51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198222, "uuid": "1287bfcc-fbe1-4718-855b-fa08c964f4ae", "comment": "Malware payload (ManusCrypt)", "value": "d75bdc11107b27e7602f31a93896dbc589dbd313cbb5e76a00d695208218e92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198222, "uuid": "e2fd48fc-115b-48f8-9057-4163f5ad6039", "comment": "Malware payload (ManusCrypt)", "value": "d6ccae60897a050b2aa9ecbdf553bc8da116be7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198222, "uuid": "45e53491-18f9-4c34-90b2-dec0655f025b", "comment": "Malware payload (ManusCrypt)", "value": "5fe905c388f129ea77a26e784974f25f5ae209e6724555ac8f2a686a3ee0321380dcb515612d145d8d17c7b0ec55d685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198222, "uuid": "3f08b03c-3c98-4183-8459-7577eefeb013", "value": "T1EB648D1137E1C877D4B315734E52C3A972B6BE11AD32864B6BD03B0EAE70542CF29B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198222, "uuid": "fe464582-3441-498b-a100-822e2d43d757", "value": "30536483726143b4d0afeee8884fc70b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198222, "uuid": "f0dfed57-8853-412b-9d81-30f364b63dfa", "value": "6144:bOsY+HgEiTA14Xn0Ti8v1bbFgXIQdjrfzNt1iEP3:i814Xn0Ti8tbJyIQdjrfzMEP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198222, "uuid": "61c150dc-9f75-495e-aef6-e47972ac7ea5", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198222, "uuid": "a988bdc3-d490-40bc-9422-d7f02e326065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198222, "uuid": "79a8c85a-56c2-4db4-8714-6430a9ba5079", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cf17a8-bcd5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678185923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185923, "uuid": "a99bea5d-5c9b-4dc7-a2fa-60391b4ec137", "comment": "Malware payload (RedLineStealer)", "value": "f7d989f468251233b819509213ce2b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185923, "uuid": "4dd9a4b7-b2fc-4e69-9b23-e0eeccda7602", "comment": "Malware payload (RedLineStealer)", "value": "d77cef0de9e7ee2f37c721908da671027fd984169137b9f769e1853cb5c05419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185923, "uuid": "fd8295e8-6e50-4337-9ac7-8332f58e0219", "comment": "Malware payload (RedLineStealer)", "value": "3d448ba62fdfa1ced63639104864f91474de6085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678185923, "uuid": "f00b5962-d827-40eb-882a-b34090f7d9e2", "comment": "Malware payload (RedLineStealer)", "value": "6b1107c6e800e5a8de32f42d419012dbbd7e393342c0528b0b9b14d9fe7741928b48ad8dca6f346e717622a9372bd2dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185923, "uuid": "03d4a22e-71d4-4b2d-8d09-2e9089db0ab1", "value": "T1B247331ED15DF4F8CC9628B5E5D099B3A99AFBBC63749AD39F0C3C3802B219154AC11B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185923, "uuid": "d8f8ec7d-ce7e-40e5-9903-aa30d1785be8", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185923, "uuid": "781822ac-fc5a-4049-a441-f82de9bec092", "value": "786432:Q8d3KqYRaboW1vXKTao5QrRrH7wiftxjOMhOdMjkNsM6k:Qj3oboWMTL5QuA2MEdMjkNsM6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678185923, "uuid": "93825838-ab66-4b7c-9b77-594f212207bc", "value": 26893328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678185923, "uuid": "d6b67203-f70d-463a-b4e3-3e94969ed682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678185923, "uuid": "77edac20-585f-4bac-b8df-6faacef8ca39", "value": "f7d989f468251233b819509213ce2b7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18118ec-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231677, "uuid": "e6a35067-4d5e-4ead-a8ea-5978658f0f9b", "comment": "Malware payload", "value": "5ed3a10bb74a16c200790037d4db03e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231677, "uuid": "98e6efbf-5b7c-42fb-b2b8-43edefb37036", "comment": "Malware payload", "value": "d7cbbaf04a0cb7a40d1671549ea5e152c0410c742f1b87eb2cb5f8d5f704a0b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231677, "uuid": "7f77f56c-9c7e-43dc-88ad-d0d7a1960691", "comment": "Malware payload", "value": "bf4e12af955f07e52e2c7921f2a2743f99507b8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231677, "uuid": "afd7a058-e3f9-44a8-9d13-ac8abab2b06d", "comment": "Malware payload", "value": "079a9b69e39da9dbb7701560e8fb64f7b3b70835a50e571c4c856b4104802383e8359bf918f9629cd0bba951a7ae2ee2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231677, "uuid": "9079e3c7-312e-4157-96f5-ca9f2b9eb6b7", "value": "T16682E9AFF28F8C03CCDB7278541B1AA9992EC0CD595A4F6B124C54943AF7F9DD701A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231677, "uuid": "ed8c51aa-40af-4dfe-9870-460311237f36", "value": "384:NnbOhf/1+oFOV4VqGExx83TRwKgYNhidTi+QX:NnbAlJ8V4AGEX8cYNQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231677, "uuid": "66c1c2e2-b5b1-49a0-9bc5-d37f1dc296c1", "value": 18116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231677, "uuid": "177ff29c-7dda-4b56-b36b-00cbb40a3c7d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231677, "uuid": "3ad3d167-a923-4893-ad82-ad40ca4464bf", "value": "SecuriteInfo.com.Trojan-Dropper.AndroidOS.Agent.25349.22557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7632e7e-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678199502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199502, "uuid": "01f70c1e-4b11-43fa-bc40-7569b72ee254", "comment": "Malware payload", "value": "3569cfacda9d9cfa51ac2b9bd4c5eca6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199502, "uuid": "f8c8d97a-0c81-4b27-8061-06d8b1f7dd66", "comment": "Malware payload", "value": "d80cdd54ce6929221bd69d9e6fcfca522c53e40aad8f848562ed6aa35a101a41", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199502, "uuid": "901f8489-cbab-4987-97ef-35ff77987ac5", "comment": "Malware payload", "value": "f2c9ab82bf56b82430f1a11fee5e699981c2ea5c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199502, "uuid": "f72c102a-4bfe-463b-b684-540a3686744c", "comment": "Malware payload", "value": "f4b61772fd57f88f85f8b2e3eb9e1c90e4d1eac95cb794699cd6c4c7b07b64e4cf10bfa7e9817bd264d1be04d2a92211", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199502, "uuid": "19b784fc-c73f-4dd5-b6e0-043f2f8ba588", "value": "T1FAE4E257993C19148B0E33F668C3CA593F63831DF131D729DB69828FCB0235896EA679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199502, "uuid": "b0c7a2d4-0c40-4b3c-bd33-651177131e04", "value": "12288:jhqdmbFpoW/uY+ps+EukwAZ4sdWQyUIIa8l4RxrAUPNHSCA//FW:jwkFyUIIYpFo//FW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199502, "uuid": "2d7a0c1b-6203-4973-8c33-895446559476", "value": 666745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199502, "uuid": "2f4a20f8-fd37-4c36-85ef-cebe44c90b04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199502, "uuid": "2784942f-8aa9-4a1d-9def-2cfeef731f12", "value": "JUSTIFICANTE DE TRANSFERENCIAPDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9d84c5-bd32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678226220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226220, "uuid": "dbfcce99-cf02-4f86-acf2-c845ecc4a3d0", "comment": "Malware payload", "value": "4919920dbf5765aa01493e9289e4cf58", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226220, "uuid": "172c4114-5ac5-4419-bf76-5793aaff8cc1", "comment": "Malware payload", "value": "d92b1f37de6f6b9037160c4a6b0b790c22af82d66f28a2fdbe57d9d473ddc73f", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226220, "uuid": "793988d7-b3bf-425e-821e-080205cf6390", "comment": "Malware payload", "value": "5a34b98bf2d4f8447fb999fb25fdf883a7285d62", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678226220, "uuid": "eff1ae40-6c8d-4989-b2c7-44cd67fa303e", "comment": "Malware payload", "value": "213996da06b5e6e216c5ade5c9a81b819a37e9d03a1ca853d677335239abdd0b54879e4c485e7e73bfacd1bb2e5fef2d", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678226220, "uuid": "55315f7d-f0b9-4dd7-bbbe-f8574fbb1ecd", "value": "T12D94D4786199A1EDDD0A518ACF38CDBFFF1318141703908B9D6462AD382317BFF9A295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678226220, "uuid": "dddee467-8a14-4dbc-8161-e80c57f002d6", "value": "3072:64SigWEFUnO5Y7yte0Z2LAVCnMul7u97KZMz+dw3yU:9J0Z2LAVCnMuM9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678226220, "uuid": "a44609cd-4b8e-4702-9c72-80ad64bf151b", "value": 447616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678226220, "uuid": "af76c158-6df3-4bb0-89fe-936dd3f095cd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678226220, "uuid": "6acb9879-3350-4524-99b1-3ea688c7bc87", "value": "font_table.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00851ac3-bca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678163949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163949, "uuid": "bd0f4fc1-6679-4ab5-a3fe-0342e78dcf01", "comment": "Malware payload (GandCrab)", "value": "4ae0a61c529630676c3a5d90fd9a11c8", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163949, "uuid": "a917e598-0bae-4012-85e4-aef949532f19", "comment": "Malware payload (GandCrab)", "value": "d938f5731a2af15f1c84e21de05bbcac060186bd864b903322894506ff246ed1", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163949, "uuid": "7ebc162c-8ce5-4dc9-9479-9b2f23f0507a", "comment": "Malware payload (GandCrab)", "value": "d5c94ced76c5083f1c5b53af23519306508e761f", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678163949, "uuid": "82b9e02c-8663-488f-85d6-04a679febab6", "comment": "Malware payload (GandCrab)", "value": "1c76d7a715e03f5a47c1ea8fb3f687ff7eaaf61ea1d45c792c94e0d55bb7c0599d3f2ff636e3ed5c12012c15769b7a55", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163949, "uuid": "df9bb1e9-bb31-4b98-8ed5-d30b9e0c71e8", "value": "T116636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163949, "uuid": "9c8a3d73-8512-4bea-b279-329c9ecc3d1d", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163949, "uuid": "6992c9a4-1cd7-4b6d-ab19-e7df2a3997b1", "value": "1536:mZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Vd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678163949, "uuid": "07ec526c-876c-4b2e-9c8f-c00be682652c", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678163949, "uuid": "3d6b6dfa-da8a-4636-96e8-1b39db73a013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678163949, "uuid": "29f43fd7-e6c6-46af-9c26-775220117099", "value": "2023-03-06_4ae0a61c529630676c3a5d90fd9a11c8_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb99b8d9-bcf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678197871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197871, "uuid": "419c138e-07a0-4560-92d2-7106c378d11f", "comment": "Malware payload (Formbook)", "value": "b8b590cf36103ce61ec19acdc4c6ad21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197871, "uuid": "a0b119e3-15be-4e16-9390-2e4fe01f6a2d", "comment": "Malware payload (Formbook)", "value": "d93db44add0a1601472c9367293d29af274a2dca1bf9ef4c0829755000c3c37f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197871, "uuid": "1c27620e-0972-4f66-b9cb-5f7144e0bead", "comment": "Malware payload (Formbook)", "value": "f34947712889bd56afa42801678572a147f42f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197871, "uuid": "5167764d-ec9a-4072-97bc-11cb676769be", "comment": "Malware payload (Formbook)", "value": "269d09e70da5f917d8bea76ca25226dfe417a40301a10fb52e88dd8daf4dbee30bf5d85b45e0cdfcba84eab749eb9729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197871, "uuid": "7dca01c8-d216-4444-a0c2-71a56b7228ca", "value": "T140049E36E701C070E2B252F5B26C1B7B843E1D343354A0A6E3E12AE56EE45E5B97931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197871, "uuid": "1c98334b-6ae9-442e-8138-3212b393ce7d", "value": "3072:trU9J6IssW1r0pWC6NILfk+522QnvG+CWiN5dmuvV39swL5RxgH:4AM00v9D5n+vG+CWiNLV39fNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197871, "uuid": "55e6bd2a-d6e8-4e86-b775-e092a194e7cf", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197871, "uuid": "39504181-c657-40f0-bb0a-cb6e834e3dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197871, "uuid": "d484ad3b-b111-4780-9684-b51d084d2dce", "value": "d93db44add0a1601472c9367293d29af274a2dca1bf9ef4c0829755000c3c37f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f34eeb7-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198817, "uuid": "629f3918-ed0c-4f9f-802b-e36e02ce8630", "comment": "Malware payload", "value": "799615928241ff835308929e30a8d91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198817, "uuid": "a9d9230f-f6bb-4c2f-858f-a873cab044a3", "comment": "Malware payload", "value": "d959fdcee15bbf5ff656719fd401b9ba9e021b240047769a140b6d3374ff8add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198817, "uuid": "1845f8c2-d556-42fc-a8b7-45026b990719", "comment": "Malware payload", "value": "8fa09c5ebc411343d6f8d6deef5a1f45e449249d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198817, "uuid": "53c7611e-4c13-4342-85c1-2e604c4fbce4", "comment": "Malware payload", "value": "2398510640c8832aebb61888513bb0621f4c5b141c3d8d30c910a640661e5212b05bb9e0dd2bba41945ab2bb670cebfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198817, "uuid": "c354d27e-8123-43b8-9595-3051e3184600", "value": "T1E46633126BC2A135DD7B983830B198770577BDB23EB4DF9AB5D467E806304C0933E6A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198817, "uuid": "320aa958-e37a-47c1-ac6d-450b7628dd16", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198817, "uuid": "99755db8-e533-40fc-b0c9-8fd03fcfd516", "value": "196608:zrIWLrTNSgx+8AtpM2Y34M7ZepYU2YRkQ8OO:zrIWXTZPAfYoMteWU2YSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198817, "uuid": "3999a3dc-a6b3-4575-83d7-29d861b109db", "value": 6953992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198817, "uuid": "73d36b46-08fc-4732-b56c-e9a1bfa44888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198817, "uuid": "1165102c-31de-4a66-8653-827b13a90653", "value": "799615928241ff835308929e30a8d91c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4749bc27-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678198428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198428, "uuid": "d9d20f6d-6d9c-4501-b2dc-2e88b4eb286e", "comment": "Malware payload (Formbook)", "value": "511998d23dd3b8d602347c06f11f7d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198428, "uuid": "9431e31c-c6e9-49f5-8abf-4f2c4db16bef", "comment": "Malware payload (Formbook)", "value": "da09c2de0b3ff15f2a68fcb18c12bd974a1b67d282f09f0941a64d08d9af83a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198428, "uuid": "41f4144c-9566-44cf-afb8-b1481c19fea3", "comment": "Malware payload (Formbook)", "value": "0e086da1f8dc76913aeae7edffbaa9db73b4782f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198428, "uuid": "a5cabb30-e1bd-46f9-b67d-e210c1f204b8", "comment": "Malware payload (Formbook)", "value": "f0f1bfb18954ce0305615e822562d76d52106bef687e9c02df6a91e89de8267757d7cdce3feaed9990d1ec72dbf7a76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198428, "uuid": "0ad18f5f-9d6a-4aff-959c-8835df07b119", "value": "T1DA25AEA56F5DA253E7C1A1B31804E7B7EBAC7D4C2426C0883AE13D8FB5B9D6C1011E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198428, "uuid": "78df1ea1-e8f3-4f7c-8117-9b5eff9c0fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198428, "uuid": "1f11545b-cb99-46c8-b481-391b7bdca63d", "value": "12288:HDX37BVmNUfqBe4sVWcU1FH+fyY+txTZ7Tzmzf/zqzyW273hDrmCibv:LlYNUfqBpKZUrH+xQxTxi/z+20v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198428, "uuid": "86fbbbe9-7d20-45fe-b47d-50a98d3b4199", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198428, "uuid": "3a660692-2a44-48c1-a38e-6a95ac2f07cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198428, "uuid": "29d1fa34-3d8b-42f8-bc65-3307e69e9acd", "value": "BS Comprobante de transferencia 2023 03 07 ES65 0081 Fra 0452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613b0bb4-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678192029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192029, "uuid": "ff5ab05b-bfaf-4b92-baa0-10442323cd45", "comment": "Malware payload (SnakeKeylogger)", "value": "c7047fa3ddbc624b8814804732602fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192029, "uuid": "414565e5-70a1-4afd-a834-3ff91dc4d64f", "comment": "Malware payload (SnakeKeylogger)", "value": "dbedc4e6b11ce7e9ba52533b462d7d0a5ab177ed2cce767fbfb4db5f351addb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192029, "uuid": "6b6ff58c-b861-4c9a-982b-67103fa823e7", "comment": "Malware payload (SnakeKeylogger)", "value": "6cc6686d4ada47b8c40a7e2d8ff50168c4bc84e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192029, "uuid": "4de4c9ce-d1b9-4b6d-9aec-31fed15bf89e", "comment": "Malware payload (SnakeKeylogger)", "value": "dbfafc277d970e8600ac96b78c4019d4915a2ecc4083798fbd2cb1748fbbe16b244b737c882e539f18c863174f2565a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192029, "uuid": "cdcdfffb-e5ee-42a2-8675-97d8df54bf3c", "value": "T1265412481791D1B3D9F3917228BE8721ABF2AD3119A0A55F5F10378DB937392D92EB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192029, "uuid": "5cabe3ec-7d56-4c1e-a79e-f14776c39922", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192029, "uuid": "427fdda3-9dc3-4022-8a57-d814143388cc", "value": "6144:tYa6Z6E7Iu6f/6Wt1v8mU0Z2nccvrxd3oe2:tY/6du6f/rZ2h73oe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192029, "uuid": "38bd553c-460e-4b63-a804-5b9abdfc478d", "value": 284329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192029, "uuid": "0558213c-64a4-4cd7-911e-b2915f29e9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192029, "uuid": "97f00e34-1d57-4532-9687-29215fbb8673", "value": "c7047fa3ddbc624b8814804732602fa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44105672-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213455, "uuid": "85911a18-f5d9-47ef-b5dd-0cdfd2a7b276", "comment": "Malware payload (Mirai)", "value": "c4e5516eeeb87aada677673e5bc103d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213455, "uuid": "49fc6059-9272-4ddd-bb94-66dfb7d8e401", "comment": "Malware payload (Mirai)", "value": "dc936fd9ac1e755ae71f7d68c23822b6152744acf969f1adf7d840599bce6cf7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213455, "uuid": "d91a3c1e-2b99-42eb-8958-dc4f76b23772", "comment": "Malware payload (Mirai)", "value": "e49765f879bac96862fd975f43ee4919fa7f1a69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213455, "uuid": "bc1e2881-b06f-4b48-88fb-c321d0801cfd", "comment": "Malware payload (Mirai)", "value": "3fd3187bfd4ccf974e53594fb8d869fb18b4782d3e58fe01d06ab144d0ce51f8a99d65f08413fbaa5153302a92c11854", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213455, "uuid": "a5d11331-8b20-4a57-b328-aa6dfbd502c1", "value": "T1B1B3E802F9C58DFCC14AC134477BB93EA811F1AE523CB2E76BC4AF16684DE614A1D899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213455, "uuid": "5992937c-7a7b-416e-8a2f-6648b5ff5966", "value": "3072:exXohUU2ZlkHVmnyxbJt+L/6NNham7DMZWG9dxAPMKKoQ69mj0CIOlwbZnKD:ex4hUU2ZlkHVmnyxbJt+L/6NNham7DGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213455, "uuid": "eee94b98-da75-4d93-8623-770fbd2f1941", "value": 110544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213455, "uuid": "7c738c76-8b3a-4f0a-8cda-a753e68a5490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213455, "uuid": "b6c3e759-3429-4862-b48c-dd84e911e7c9", "value": "uYtea.x86_64-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b784c9-bc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161113, "uuid": "9aecd58f-ca22-470a-8787-3b4cf3306b96", "comment": "Malware payload (Mirai)", "value": "1736d245b7e9e159db9b9a7f901caabe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161113, "uuid": "a5a79fb8-d60c-49ed-b2e3-2076a0c6a2fd", "comment": "Malware payload (Mirai)", "value": "ddd1c824c63a613ff4fc9cb26ceef4706b39b45608c4c13e4ab35ce61f68b424", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161113, "uuid": "a403d473-1623-4b5e-972e-83fabc13d325", "comment": "Malware payload (Mirai)", "value": "a600b57689dc63345418843e634ce18d23c46d1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161113, "uuid": "1ddd0e7f-f78e-47d5-b125-3d60e34874e3", "comment": "Malware payload (Mirai)", "value": "3f4cde9e438b1dd99c5ee4df0554174eba8fd197ccc24a41f12797fd564f44551727cefb955fc8be58407daccf40cfdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161113, "uuid": "db5f28ba-abf1-4300-bc35-10ca2102c6bf", "value": "T12C230271840E9DB124303C76EAD9A393B6E12AB1C6673013D6294F3C6F65B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161113, "uuid": "dd60086f-69c7-4f47-baf8-e83a5a914c4f", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3Md9q3UELbUXfi6nVMQHI4vcGpvB:gECFd+A6YHAxMwLRQZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161113, "uuid": "77260df5-9932-4e3e-b420-dddda260ce6b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161113, "uuid": "44cc798d-42db-4354-8251-ec6030b4055a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161113, "uuid": "37a49eef-aa42-4b8c-a2a3-855c1a06fdf8", "value": "1736d245b7e9e159db9b9a7f901caabe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62ce63b-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176307, "uuid": "d65ae63c-8d1d-4a7e-9509-6d56a8fc2636", "comment": "Malware payload (Mirai)", "value": "829b57200abde68e185addc213f6e0be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176307, "uuid": "c46e60a7-d9e6-4c38-b587-cd79ce771ff3", "comment": "Malware payload (Mirai)", "value": "ddd938ea22eed7eb523573a3e39b36186002e6fd5f3d70e8489c790c9c2e3989", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176307, "uuid": "e0a96004-1900-4b48-8620-20490d665834", "comment": "Malware payload (Mirai)", "value": "ac66746e60f4500d6bdad5a8e692a8148767583e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176307, "uuid": "89b38723-aa7f-4d63-8e2d-69ed824b794e", "comment": "Malware payload (Mirai)", "value": "b1c52daccf6b93e495fc4ac24aad1cc3fb00ac021a397935286614860b29372ebfcd44c943b52d9c7b43e7772ba6cc1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176307, "uuid": "9e70bf3c-b191-4489-b6b3-ba6cbfb3e363", "value": "T17EF28D63C97A1E64D6184574F235CF7E5B23ED05D98B0DEA8C6682799003EDCF82A2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176307, "uuid": "3bbf07de-765e-4713-9d84-a3192c6395c1", "value": "768:hUc9axQ4s262a2DoWVqzMRECYLvVofH1GAoCp:hDYxNLr8WMzMevLvafMJCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176307, "uuid": "7d71823f-1464-48e8-9bfd-0ab4d1cd78ba", "value": 35076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176307, "uuid": "99bb349d-bba0-4080-9163-6136a77a419c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176307, "uuid": "3b51ae63-0895-47be-9811-b3937060c009", "value": "829b57200abde68e185addc213f6e0be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d43f66-bc95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678158485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158485, "uuid": "6fc43212-a266-4680-8644-35dffaae2f85", "comment": "Malware payload (Mirai)", "value": "26833c30b038bf43bf8a42aaef7c2709", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158485, "uuid": "02ade70c-176b-4ffe-96ad-e490d739b3f4", "comment": "Malware payload (Mirai)", "value": "ded59a4ab2c7e49b0db1f9b9c26e33040a2e81a160795e5dff46ebc3890a468c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158485, "uuid": "41f753a4-3dfb-4fb3-8824-61ee9dc9524b", "comment": "Malware payload (Mirai)", "value": "c0b75ffead66f25913a82425628415c565db9104", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678158485, "uuid": "8a7fe311-448b-4a67-aa93-37e3e271c848", "comment": "Malware payload (Mirai)", "value": "c81634bc78a761bce51852d3a557222ad81df2ad44748def63b2f10950bc0d91fe0dc9f392f85448e9a7af6402b79020", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158485, "uuid": "d1d0f2f0-c558-472f-a86b-92fc5b3bd5d7", "value": "T1E923179AF8028D7CF94BE77E545A4E09B92163C152C31B2B17B7FEA37C321992D02D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158485, "uuid": "6c4e3a32-016c-4b5d-94a2-d98ab1abb6a2", "value": "768:a5enXn+6TwH2Mns/1Z/FUtrBuJVMxjsMYG44rq8sbCGp:syTwH2Zj/F0rQJejsMp44G8snp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678158485, "uuid": "d0f8c7cb-0d71-4b0f-9da1-609b5337f29a", "value": 45580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678158485, "uuid": "605ae9e8-9c7a-4fb7-a352-0c9c54ef1b8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678158485, "uuid": "22877113-9c4e-499b-bbd7-ff64cfc83d78", "value": "26833c30b038bf43bf8a42aaef7c2709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd55edfd-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1678176319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176319, "uuid": "d158dc06-cffa-4afe-ab84-38998ca17194", "comment": "Malware payload (STRRAT)", "value": "fad2c41e5b864a3233bb57d5e3e8fbc4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176319, "uuid": "c3d9a2b8-8421-41fa-8315-2291e27dcb1c", "comment": "Malware payload (STRRAT)", "value": "df54f45e291c964f7169ee83806782007dfa01cddbb49104b14bbec92b27579f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176319, "uuid": "fd9c709f-c80a-4b3f-941f-486356aa39dc", "comment": "Malware payload (STRRAT)", "value": "ef5e62b4e5cfa2843574cc252942e48eca39e381", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176319, "uuid": "32366076-e6f1-45d4-96ca-10bf72728161", "comment": "Malware payload (STRRAT)", "value": "102092cadb1f3d740f97d98fcbba8bb53a802ab6e4e510bb017f5d301542a525cca10c7f66c26272ec77926953a8bf03", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176319, "uuid": "78462ad6-362b-49ff-abc6-0a6f048af901", "value": "T194748D0F46A21B17B6385B0880B916366FB118457707F8E7E7226FDE6E7268C113DA7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176319, "uuid": "40c3195a-c11f-466c-9526-d51b6093f952", "value": "6144:GQIKHEGaFfhzj8PV7IdBEs3HNqSWw3ycw1cHYja1n4XjUeyvWEdlG/bTrQeqQ:NidNhzcdY3HNqS1Ac4ja1beyvWzr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176319, "uuid": "3aa13452-bbce-4e05-8e9c-69b497a0d8a7", "value": 342289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176319, "uuid": "9ff594ea-d798-4f9c-a055-29b82b44107f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176319, "uuid": "cbf3fb85-e831-4259-9356-307aeeb070d0", "value": "RFQ No87675455566720.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a193320-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155429, "uuid": "8bc3a424-e869-4d9f-83c9-324cfa96fddf", "comment": "Malware payload (Mirai)", "value": "f13213d76d009b3cd516d43113532d71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155429, "uuid": "c3a35fe3-f616-42a9-ad6c-c2e1f0e75ee7", "comment": "Malware payload (Mirai)", "value": "dfef5bd45114040bba6a0195df2c2321638987a9984ad34e9b3ec4e169768834", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155429, "uuid": "83e12da9-fc26-4db5-8189-175622c57518", "comment": "Malware payload (Mirai)", "value": "81422e8a31de512248951359a4475873728148ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155429, "uuid": "d9f8b4f7-0685-4393-bca8-5d351e5155b0", "comment": "Malware payload (Mirai)", "value": "eceae69dea368b438e395bc16d2d902b10b7deb81eb90c3c1e2851ca989d8b36577f507313568cdbc436344e4e8a6ee8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155429, "uuid": "7c244bf0-65a5-4ed9-9fa2-28527b0c0d36", "value": "T1C643745A6E129FBCFB598A3047B78E219A5833D627E1D641E65CD6002E7034E740FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155429, "uuid": "2bdb3ced-9a00-49aa-b2a2-2d6ac53abc5f", "value": "768:Qcm0dE5Y43ZhCDmq85+KVvS1Bu4VMZwDRZeNsxCfufj0bkBT8+mp7Ewy:WX3H3RaV4wDRMsbTp8Pp7ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155429, "uuid": "82be8a88-fb57-4271-a146-c33c3d56c2d9", "value": 59448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155429, "uuid": "fd1248cf-44b4-4a71-917d-60d47a8991ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155429, "uuid": "aae80f35-f973-4518-824b-80f465b7dbc9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0743336-bd3c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678230441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678230441, "uuid": "2af0630e-8c11-4f7a-a1ec-1b3a0f5be6ea", "comment": "Malware payload", "value": "91b1abb6601af6a0b7ef088543ddd6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678230441, "uuid": "cd25fdba-1ea1-4edd-8779-93ac2fb00e75", "comment": "Malware payload", "value": "e05a921cb0193db227eab1d08459541252a91d603f4259aa75d0fd821fc6f25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678230441, "uuid": "79d3a172-a548-4a61-83bd-2640d2b41454", "comment": "Malware payload", "value": "664c2d1c4acf07b94895ee46fe4cbbb7d31f9b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678230441, "uuid": "bfec00e4-a6c5-44a6-9470-33298af8a04c", "comment": "Malware payload", "value": "9eea9a82dee3088aebe665654554415473a4e493eeddcad7f1bb3801f8259001e3cb5b4d98f3c62c347d6020d46ac1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678230441, "uuid": "7258d39d-6684-4650-99c6-da2602ceba80", "value": "T150E2084677E98225C6BD6AF88CB313240772E3438532EB6F5CDC88CA4B676D00251EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678230441, "uuid": "2ae58568-420f-47aa-bd84-3f6d1bd4ac1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678230441, "uuid": "85c6256e-1bce-49a0-8f76-8e0e2400c14f", "value": "384:v0bUe5XB4e0XUm+O5SlXCpF7r/oWTEtTUFQqzF/Obba:ET9BuUqMlQSVba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678230441, "uuid": "f0a924c8-4175-4298-bb94-c2a2e7c1694e", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678230441, "uuid": "000016be-818c-4bfa-bc5f-47cc144c0683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678230441, "uuid": "146ad710-a99a-421d-9641-d15324d29664", "value": "bKoA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a877158-bcba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678174516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174516, "uuid": "4ffaccf9-f2a1-449f-ac45-0a4e0d82255a", "comment": "Malware payload (Loki)", "value": "5b34766e6b76203560d9041bda965189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174516, "uuid": "c81077c9-9d68-49e9-832b-b5cc885497b6", "comment": "Malware payload (Loki)", "value": "e09603d415564f497c3e06ae53dece0dca6c250a6f7533dc382c35e7d55b552a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174516, "uuid": "df039b55-fe25-4c4d-b768-4bc1ac4503d9", "comment": "Malware payload (Loki)", "value": "1da05891a3aab3dd17f3389f362a1ae3d34edddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174516, "uuid": "19fade33-3749-4595-a8e9-841fad2395d9", "comment": "Malware payload (Loki)", "value": "d7b5ea128f8f6e7b45adeeacb019254d981c08178ed0f5f5fa165df07eb64367af17356fb04f418ce75a683271df8ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174516, "uuid": "ba1c4898-7d0f-4765-92da-3c4d3b11dac3", "value": "T1C3F48ED42F5D7263F786E1F318442AA7DBACB95D6527C0081EE2108FC1CDE6C5252EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174516, "uuid": "c6602ed5-cefb-4224-843c-4dc346f39ce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174516, "uuid": "4c79a0cf-bef0-4030-8ad9-df7a321d0dbd", "value": "12288:bds7XWdgpQGq8Wvz6LXdXQYftQRwNJS9HZeibxkvHonUrV3pZBAO:hsDtpVq9vzKXKYftQWNJMbxWiSxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174516, "uuid": "0002b6f8-9ec7-4fc9-9347-a4d734d05f0e", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174516, "uuid": "bba51637-e97b-4e2e-aa71-3e3bdb4d6a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174516, "uuid": "bb4d46e3-6e7e-42d1-bd70-010d76b33cba", "value": "FEB SOA SETTLEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19781ecf-bcee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678196633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196633, "uuid": "4838dd36-7ac5-4a2f-be44-312ae7b7494f", "comment": "Malware payload (AgentTesla)", "value": "883ceb9e3d9d23a78c4f99dd49246bd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196633, "uuid": "3dae84c1-9edd-4349-bbcf-60c3aac9d0b9", "comment": "Malware payload (AgentTesla)", "value": "e29a14afd98a031966a8ea4e437222cfe0fabeb0d4d3005d4f1ab9a6711c6569", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196633, "uuid": "4bd50c8b-dea7-4433-8bd2-3be407d4af5f", "comment": "Malware payload (AgentTesla)", "value": "80da2c46be8f10d510512cf2fd236ab79bd2ab14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196633, "uuid": "50769e42-aeb9-4621-b5ac-f757341521a3", "comment": "Malware payload (AgentTesla)", "value": "1be2ba8bbc27c04763b329b4ed1ece46701ca61365752ba093fe5d0cd7001d806fba8abd08013bfdd39f58270644adef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196633, "uuid": "bc9b3cb2-c454-4404-8d72-0af80e5df636", "value": "T12955F1039138AD4AE102CBBCBA2F7559111E7C3671D2A4CA364DB74B4733FAA59BF118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196633, "uuid": "12ec432d-23e0-4e91-8282-cb63785ddde2", "value": "24576:ILKUB9tHlxOWQmmav30xVBvYtHlxtWQmmav30xA6FPeroMolBJp4:ILKUZ7DQmmQ30ftG7MQmmQ30e6lerRoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196633, "uuid": "6c0c267e-2c83-41c7-b131-f5e68be3a3ca", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196633, "uuid": "9b3ef272-18c6-49c5-9882-a1edb29de286", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196633, "uuid": "13d6311b-23d1-4ac3-8e9a-9f82a93fdd49", "value": "Swift231.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441adb37-bcf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1678197563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197563, "uuid": "8945eeb4-093e-4064-8331-0a31dafdd599", "comment": "Malware payload (PrivateLoader)", "value": "434e131214711a082fb458ddf1d18c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197563, "uuid": "121dc496-e5c6-4686-9688-6f7ef35cf4a4", "comment": "Malware payload (PrivateLoader)", "value": "e3ecfadcc199765a2ad369615ec17b5b95cb0f5a29cc45eb2e8d2e9d575807d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197563, "uuid": "babb3585-d78d-4370-a16a-6b9cc12d8a44", "comment": "Malware payload (PrivateLoader)", "value": "cdc9c56159c24492c4f5f8f968e9b5ab16171bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197563, "uuid": "81eb2223-e8b4-4160-9433-abe6d743b10b", "comment": "Malware payload (PrivateLoader)", "value": "e9d412016842aa49189a5eecea840a2d4634283809f896c9a546438bb2018a8570f2e07a1651acd593f1762ae502750b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197563, "uuid": "35c5b1e0-e61e-48be-b365-826b4670e47a", "value": "T196569DAD6B0B5AAFD1D2357499C35522E314639A42047D2F99ECFC34FAF38491EC4B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197563, "uuid": "2e475d81-bfa2-446d-b073-3f6daf9f77b8", "value": "5f15e282c9ab32f785ec67df78e330eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197563, "uuid": "0246d909-ba1d-4a86-ba34-8bffd9900131", "value": "98304:2wb0bWHT4Ld9bHpNSFwjfEgNCdkkBQEiCgXyh6246:Lo8q5vsw1N0BTjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197563, "uuid": "16a4a5ed-d3ee-4b9a-8991-fd0dbfe31add", "value": 6283792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197563, "uuid": "ffaeb45c-5561-460d-829e-328aa8db81d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197563, "uuid": "f158b663-4eb8-4bc1-8221-599f51a86bed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d728058-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678198331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198331, "uuid": "3d633e3a-b5cb-4139-a707-f22ea46c8844", "comment": "Malware payload (AgentTesla)", "value": "653730e10aabae604618925304624f97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198331, "uuid": "c8ca4344-d377-4e39-91dc-fbea49a5782d", "comment": "Malware payload (AgentTesla)", "value": "e43ae27c14f7289713efc115d191ad4b32a90dacbecdb71fffac0e5906bad3a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198331, "uuid": "e8c3e8d2-1db0-4ae3-b957-0f65195a8f45", "comment": "Malware payload (AgentTesla)", "value": "4f2efca7005e67a4b0a05d0259daef41d75ae0e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198331, "uuid": "2cd35eab-6664-47c1-8b9f-2ab04b510e49", "comment": "Malware payload (AgentTesla)", "value": "f4726f8c23942e6f374714d8c7df23062e4241cbd15e8bb15cb01148408d2a0e7ca84323a242c08e07d2c4f2b8b0154f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198331, "uuid": "f0cbe53d-05a5-49d7-894d-f889b885dc85", "value": "T111F32A2892C58E56D32FC0B9C4B41158C7B2A14B8517EF6D5EB0ACE73E867C3722F865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198331, "uuid": "b72426b7-b0bd-4046-a0fb-451db8c56fba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198331, "uuid": "ec1d7fba-ab5a-454d-ad7d-fd507d4bc41f", "value": "3072:ZADTA+rAdIR/aziHSeISWJHPDuj16Q01I5ucrkRLF0H:GDc+UiaziHfInJS16Q01kDSp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198331, "uuid": "b2cfebe1-9d49-4a9c-8b29-65a75e3831d1", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198331, "uuid": "64240863-bc47-4b7b-b8dd-254f97ed22b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198331, "uuid": "5fa275a2-ebca-4f4a-b3b1-5f075b37e960", "value": "e43ae27c14f7289713efc115d191ad4b32a90dacbecdb71fffac0e5906bad3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28813d91-bc8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678155426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155426, "uuid": "4923be47-1dc4-4171-a7c2-0c8ba250baf9", "comment": "Malware payload (Mirai)", "value": "6ec26571adb7e0f9b7a1dd9e99bcb470", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155426, "uuid": "6080a614-6b47-48c8-9e79-fa487bf796ed", "comment": "Malware payload (Mirai)", "value": "e44bd1db82a6b1fbf6a5e7d82b601c4bfd97fe1c20071c29c2950deb2f48013b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155426, "uuid": "deab148f-8925-4640-bdb2-0e84ad5269bc", "comment": "Malware payload (Mirai)", "value": "e3c47a163823965ad1dfd45a3209e07b61a0d647", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678155426, "uuid": "17752a81-0cc5-496f-ae07-e5415137f316", "comment": "Malware payload (Mirai)", "value": "bf60fcb6bd89e660bd9c5566cf1d47708a82102507fbb766b6a9e26383ed44c819ffc9e56fce495acdd30348e908573e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155426, "uuid": "990b5fe4-73e4-4567-8c03-04255ebfbffd", "value": "T1D3F2D652F8415A37C2E4137AB6AE468D333073ED92CBB61BD9214B207B9551F0D63F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155426, "uuid": "ad26fb40-1d1f-4470-95b7-4107c61668d2", "value": "768:lQRExnFvfeEG5DU805yUmMhhVtId4V/Yi9ASH8LT/Lt5OiL/N0wZkkkkkkkkkkkU:lBrfBG5DUBmMfbJFLcLHbOiLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678155426, "uuid": "00031a2c-f05a-4eb7-a09b-0627262f9ed7", "value": 36556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678155426, "uuid": "0c7ecb14-e451-4f5e-8e91-8d46e4447e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678155426, "uuid": "002e619f-c42c-45ee-8976-fb4fc8365eac", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5230f0f1-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198876, "uuid": "0893a136-beb3-4248-accf-d14610c7f61f", "comment": "Malware payload", "value": "e471a4f17eb1d887e6cfbda232c54d6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198876, "uuid": "b3dc066b-9267-4dc8-9b3f-4c626035dc97", "comment": "Malware payload", "value": "e44e1e23f57b24c043a8b2bf629769468edec3957e5f42d206dfc84d31506403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198876, "uuid": "c2753c18-5832-489c-b273-676abd6e629d", "comment": "Malware payload", "value": "c00e0aa07e4787b3fff2f2e16c44b565157f05d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198876, "uuid": "22c4aea7-a566-4637-ab1e-6709c8aa113e", "comment": "Malware payload", "value": "ad7640ee060baa34cd1337ee296655dacf348d3d4f1442d94cd6003fb3a193823035098b696606784284013cc5be2161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198876, "uuid": "da0ac88f-cc0d-4de7-bdf3-7cabba47df4c", "value": "T1F1D4011673108403D86173F214AA5A911D97BE5019B8B24B73717F5C3BB2293FE2EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198876, "uuid": "75d48da2-27df-4311-bf28-fd02508a0731", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198876, "uuid": "cf2af1eb-e74e-4421-85da-3ed85a2b2ac2", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqgL:2YtZCkDkQQAO8h6mZvrg6NEOqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198876, "uuid": "306c30ea-c007-4a49-ae9f-5c7b088ca133", "value": 613368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198876, "uuid": "fdd67694-095f-4bc2-9b04-c8ab465c7c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198876, "uuid": "12f1ce11-1f16-48ed-9a4d-332e133fed5c", "value": "e471a4f17eb1d887e6cfbda232c54d6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9152d0b4-bcb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678174071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174071, "uuid": "a7021bd4-2b0f-440a-a252-575ed0e8c70a", "comment": "Malware payload (AgentTesla)", "value": "a3234cf8b1b27e0b496c57e1c4b45f64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174071, "uuid": "cc8e0b79-1dfe-4165-85cd-151a20d79277", "comment": "Malware payload (AgentTesla)", "value": "e658e98b9c142503065aa277463959472481e79f4113e57e53504acb9094fe82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174071, "uuid": "1738c41e-9a0e-45ef-8756-9f79807c050b", "comment": "Malware payload (AgentTesla)", "value": "e896b5f545139c49e38e6ccf46119025ca45b886", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174071, "uuid": "f86c0a11-afa9-4773-91bd-eb651990f9ef", "comment": "Malware payload (AgentTesla)", "value": "3748ce81057780ab4ff3b89ee3c51a47743eb35b9a8c12bbceaade7fb150bb47b3fa0e4805bbadbec485a157ae9d804d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174071, "uuid": "a7752286-78ad-46b2-920b-234e8b7cbe5d", "value": "T1C3E4C27D39B692D6C234FA3346E7E630B5BD81923307C958D9EA1AC04F425827DCEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174071, "uuid": "c77cc01a-2a54-4c30-aea3-aa414a0d6496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174071, "uuid": "e31c11e0-b5dd-4acf-9ea7-a4ebfd915b96", "value": "12288:22yIkegET9jsIBMNjnNNOhAe/S0xE+tM5aXvYIVYhWq34Y8hTdacC4GCOYRflMJl:hTsIBMNjnNNOhAe/S0LzQz4LYWocC4GL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174071, "uuid": "8e92f9be-7985-47ac-9c54-a9f3b2ed42ec", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174071, "uuid": "678bb47f-1785-4bfc-b4ac-979fc66d4f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174071, "uuid": "74838c67-2d6c-4ce0-bf1e-a47f68ccefa3", "value": "IMG_Scan0001998291-2023 Remittance Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b465d5b8-bd3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678231682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231682, "uuid": "57cae3f9-50c1-4a7b-acd7-aa9621b20178", "comment": "Malware payload", "value": "852c0f3cb97500b6f3af9272d0bdbd68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231682, "uuid": "1664ca0c-09e5-4a18-a3f5-2b4ea206b247", "comment": "Malware payload", "value": "e6ba3f68ff5185fc663edd303665f7f49edae1dbef368f270719565f31fe776b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231682, "uuid": "3beb2cb3-228e-4c3e-8f84-ea9237f14a6b", "comment": "Malware payload", "value": "1193b29ebd370208a589da5668fcea6132c8755e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678231682, "uuid": "2e72953b-1807-4201-a7e4-95226077f4e5", "comment": "Malware payload", "value": "a7e3a91be3d52d14c69b57a776c06dd0b4f2be7c8499eece606c901a8fda86a0f22aad94dc1ad0b90eb50d76ea5db241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231682, "uuid": "c310ebea-10b5-4ac1-a010-150be3bae206", "value": "T185E47D22F2904537D023193D9C1762669835BF613D38EA83ABE93D4C8F7D6927836397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231682, "uuid": "93839360-60f2-4629-9668-3dc2ae0ef118", "value": "7e874bf734bf16bd4862979570ee87bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231682, "uuid": "c833332e-b259-4e0c-a8c2-a09a9eae2b09", "value": "12288:Uui0baqBkUQ/1JL5y+xtL9WVpeMZb7fnEhRCSTf9+wuLMH:hm1TLzxF9uzjnECSTl+w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678231682, "uuid": "843969cd-b6cb-4635-859e-9b1728e5a033", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678231682, "uuid": "5a33c8b8-ec60-40a5-b95f-f3aec057ad6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678231682, "uuid": "b93d5016-f974-43c2-9449-48c30dd8d630", "value": "SecuriteInfo.com.Trojan.TR.Spy.Banker.Gen.25343.26062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b62052-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678198608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198608, "uuid": "0ee68e53-cb5a-49c7-8fd7-20c1410846db", "comment": "Malware payload (GuLoader)", "value": "52efb6cec3f6eb66dbc63bb509917e77", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198608, "uuid": "2de1096f-d9bd-425a-8897-4884f9585f2e", "comment": "Malware payload (GuLoader)", "value": "e7e8739ed037d0d209cd301c9312c18eab202c806a147b6986f00cd129bef702", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198608, "uuid": "6bdbc65c-b373-4674-a3ff-ca18d21ce4b8", "comment": "Malware payload (GuLoader)", "value": "3d100109ef5153e47de0c5fd09aa1499c99a817c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198608, "uuid": "bde33dcd-c50b-48ca-850b-bac632ccd172", "comment": "Malware payload (GuLoader)", "value": "57a9a4fcef2a5495b8831e543426eb85330537f2cd547dd8cc3fbbd07ba735a1055a133b591cd319fe129220c4d4593c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198608, "uuid": "e1b9d7fa-c46c-4f44-9c36-59276f488e51", "value": "T1FB357D61DA1A26194D5F2BAEED824D4649BDC02D43370139FEDE138E610769CC3BEB2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198608, "uuid": "499d00d6-c04d-4a56-93f0-b7156e819298", "value": "12288:BBNxmOAlHG+IKDv7268GaJ2FZQVubNOIEfWabNx4QyhCrgqaSTTi+hy8FOiFs:BfoBm+RDDhPFewBsz4QsCrgqN6+hAKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198608, "uuid": "7d9525fb-54f0-4380-8e47-c006dc1cd4e5", "value": 1116594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198608, "uuid": "8971b234-edc5-4058-a367-eea19f61d376", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198608, "uuid": "5b80e0e4-3951-4727-bc3f-d493da050366", "value": "INTHIST_230714122537.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135b89a2-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209937, "uuid": "3197bc26-fc10-42d3-8563-55d6aa8f41c3", "comment": "Malware payload", "value": "51cc526fc411283b8a71972844dff409", "object_relation": "md5", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209937, "uuid": "5ec8ce98-ce16-4d5c-bb6c-9e464824ba48", "comment": "Malware payload", "value": "e8cf6f82a1336b76abb170337985906454f142c5cca33f6aec3591643eaf3268", "object_relation": "sha256", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209937, "uuid": "53d1d2f8-85dd-42a9-805c-5ddce4d7cce7", "comment": "Malware payload", "value": "9ab710153ddfa8fe87a9b13b653f37869247347d", "object_relation": "sha1", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209937, "uuid": "dd7b3274-b11c-4ee7-824a-32f465442474", "comment": "Malware payload", "value": "d08729c90edf6b418688d2a04eaee141fae05d204258c4228782380fcead9f54d599a15f27f432a07f02808ca958356e", "object_relation": "sha3-384", "Tag": [ { "name": "DDosia", "colour": "#A96715", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoName057(16)", "colour": "#B64E23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209937, "uuid": "8c973573-595f-43dc-b8bd-fc252c7f1ceb", "value": "T10A564B47F85195A9C1EDD2308A26D2A2BA307C854B3033D33B50FBB92B76BD46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209937, "uuid": "66e15df6-c667-4a88-8498-3f67265d2420", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209937, "uuid": "f537a65c-486c-40c6-9fd6-0e74f45cffb0", "value": "49152:9arEDN3INeFrb/T8vO90d7HjmAFd4A64nsfJdkj4vMv7wcilLplnpKJhstN++nBe:l39UBeMEE+vQn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209937, "uuid": "6bfbd262-0df0-47e7-83db-43cf0252aa78", "value": 6089728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209937, "uuid": "0bf667e3-59e4-43e5-bd67-8073e1e51a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209937, "uuid": "cfda51da-c937-49a4-8635-22825e7b475c", "value": "d_win_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6d0ce5-bd24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678219827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219827, "uuid": "5500af6f-cdb9-47a7-87fd-f679793cfc13", "comment": "Malware payload (Loki)", "value": "f6f2196a4cb6bee06fc11f7c94e2abd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219827, "uuid": "3707baa3-91cd-4263-b936-38e0edef4da9", "comment": "Malware payload (Loki)", "value": "e8ee3634afde1b13836ca2183216b38956942300ce6f73ac218152cc7baa47f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219827, "uuid": "8051567a-ba10-4c25-8c75-f7a9bf09e6e7", "comment": "Malware payload (Loki)", "value": "38d0174698269e41c0263be5f7b51f2e2ad6cffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678219827, "uuid": "24d3015b-7167-459d-896f-dd6b84fba396", "comment": "Malware payload (Loki)", "value": "59072ff21663184a679675e74c4ae9be4b505fc8a297ce0a1332a20bf61d4465e1d605bbf7b526ffb8a840e664f9d114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219827, "uuid": "47594f18-08f4-4ded-a7d1-97ef5a5f299f", "value": "T170F4053CFCA49BD6E13AF7738557E210F3F590F2B311C8166EE2888406A5A71A2DE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219827, "uuid": "be7ad7a6-c882-45d7-97cb-f274221e27c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219827, "uuid": "5397bf8c-81c2-44af-8622-dafe1ecfacb0", "value": "12288:XOujJFWU/ts3U/2y4tpcKB4UW8U62gONo3BxXcCE+tM5X7:eu9FjFj2UDb8ULTNWBmGG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678219827, "uuid": "22c39b4a-3f87-4f43-9541-dc7e5635d20b", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678219827, "uuid": "058081bb-d954-49b1-8cf5-3a7fe35d5a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678219827, "uuid": "1cd46d71-81c3-473a-a83a-5851e8efe128", "value": "PaymentSlip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98050c06-bcdf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678190403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190403, "uuid": "3fc97bfe-f50e-42ef-9914-39448f352bf0", "comment": "Malware payload (Formbook)", "value": "e006b2c776cb6704cb29929ff02826fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190403, "uuid": "c2f2216d-e171-478c-b05b-12ecdfa588a3", "comment": "Malware payload (Formbook)", "value": "e904274bd2e5d919c63c6db8c82f908abc10d65fdba772596e2953ab708b1726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190403, "uuid": "3e28a952-496e-4183-81ec-52d8a50e599b", "comment": "Malware payload (Formbook)", "value": "f7246a55651a7b7d7ac47be9252c6d7b9714c550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678190403, "uuid": "f47acda8-532d-454c-af68-71ab2c035c08", "comment": "Malware payload (Formbook)", "value": "72ac58313326ae9b971d4e156133ef89c4629c1448751bd95b2b0014bef26133a85aff43582e456d6c075906f8fbe186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190403, "uuid": "204b8b34-f07e-4515-820c-ac71428cedeb", "value": "T1CB44122667A0C4FFF86142761A3A9233EFB5781648E8660B6760174F3E71E41D81FB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190403, "uuid": "1414469d-b801-4df8-be62-f89be2f34d9f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190403, "uuid": "8def62ad-96ea-4695-9442-2040d88bbcf7", "value": "6144:/Ya6VpsLT1Drg9m5+z9OyC+q5OAJMLfiyFL8gzMT0JUzF:/YfQRDKz9i/vJMLKyFL8gzMwJUzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678190403, "uuid": "08693f9e-de09-4223-873a-e9f7dc96f531", "value": 255910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678190403, "uuid": "22326534-abce-4902-b9d8-16419a7f2940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678190403, "uuid": "f470d3f1-1e27-44a2-9aca-ff5c629ebd8c", "value": "roure.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f09304-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176358, "uuid": "06703a6e-3805-41f7-8d04-3634519c67e3", "comment": "Malware payload (Mirai)", "value": "b65731100a743f9b5a5ecef1b3c807c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176358, "uuid": "41f310b5-0192-441e-ba8b-a8bfd8aced22", "comment": "Malware payload (Mirai)", "value": "e997a3d503d570f5910e1a21a6b3ed9f20349d5be755586501abe59ffaebf7dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176358, "uuid": "332c38ee-36df-4c08-be50-2114e3592a4f", "comment": "Malware payload (Mirai)", "value": "9226ef89dbaa3d349c1782e09e67bba131ddb1b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176358, "uuid": "b6f5d547-1415-4119-8cfd-56bc3330e6d3", "comment": "Malware payload (Mirai)", "value": "e9f3689459415a916ef11b064e730954a4185dee539e6254b67f79e6beaaa4809e7979f318f2a88bb099602f03fce89d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176358, "uuid": "8580b8fe-7204-4f5a-a214-38be8e24825d", "value": "T11C436D77C5A85DD0C54845B5A63CCAF00B13A504A6A27FF54B828E71804BEBCF64B7BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176358, "uuid": "033d637a-9d77-4691-a37b-41b06f8bb812", "value": "768:M/TKp7MYzCasmW9eF+aqx2DTeOH2FzvTeZZzV0C0XOPBoICXJv5C0N19:M/uVMYCas/aE3WTmnIsv5C0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176358, "uuid": "2ef00216-13d1-4d1b-8700-4af8b9a77040", "value": 58360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176358, "uuid": "7af08b00-25ce-4a3d-9e12-72a6ea4dc4e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176358, "uuid": "3fc0f3ad-3154-406f-8f1e-18fe88e3f36e", "value": "b65731100a743f9b5a5ecef1b3c807c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e974d41c-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1678198700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198700, "uuid": "e29c2c22-ae0c-4268-a32d-36553a8f22f8", "comment": "Malware payload (Socelars)", "value": "c40e098b934dd5baaff26717530d6d4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198700, "uuid": "b71da68a-05fd-45e1-847a-03a521f3ebba", "comment": "Malware payload (Socelars)", "value": "e9c3b78b6059b1decae5365a506fc39b21e5babd13dbfd21920f4406c3217c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198700, "uuid": "991ccfde-c59e-4f63-b7e4-d36cbb42467f", "comment": "Malware payload (Socelars)", "value": "c11ef5cc4723bd97d34bc6f11bdfc11cb2ddf480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198700, "uuid": "a338c7dd-4421-4102-8b3c-2f8b70ea5691", "comment": "Malware payload (Socelars)", "value": "ee07ee9466c8f7f09b57b40d0b9c3196887d5b3c8abf1ff033ad5320018676a3eecbe9ad997b1b42be93c39dc4c146fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198700, "uuid": "dd290055-b4e6-4d20-99bf-6db336e924f5", "value": "T16C658D21F7C26032E9E310B745FF5ABE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198700, "uuid": "3c94ffe7-8c1c-4aed-b9c1-cadd214dc8ee", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198700, "uuid": "a35d88b6-803a-4e68-a8ae-be978d240644", "value": "24576:0GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRXA5hNSt:/pEUIvU0N9jkpjweXt77Q538", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198700, "uuid": "efb44c67-6769-4634-b35b-6a92516b5779", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198700, "uuid": "1a07558c-3cdf-48b8-adb6-fdda951c0f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198700, "uuid": "0c345296-ce3f-4d5e-bc53-ffba34127493", "value": "c40e098b934dd5baaff26717530d6d4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498b48cc-bcf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1678199720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199720, "uuid": "ca9effa4-ffe6-46ed-975e-b263596dc98d", "comment": "Malware payload (Stealc)", "value": "cdba4bf95af8e93a8b246376e978934f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199720, "uuid": "f44b57bd-7393-453e-82dc-77801fd6fd07", "comment": "Malware payload (Stealc)", "value": "ea3c4e9cc6e8b8b5fb61c4ef5afaa0575a895b1ca9377e22e1236057494923e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199720, "uuid": "1565956a-15ed-4c99-b1b4-18ce766c8334", "comment": "Malware payload (Stealc)", "value": "8fa790f69f0628bcf786c55f97b7d0d02b3c53cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199720, "uuid": "34ff9dd5-d6d0-423a-8b26-d94bfb0d4712", "comment": "Malware payload (Stealc)", "value": "2befd6a4a49fdad412f60fbd267eb82320a60ac9615066456f8fa274559b038f438b57c343f2ee06f1c0c102c38cb97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199720, "uuid": "58ab5827-139d-4cf2-aff9-bbb8468e2adf", "value": "T17E44C03177D1C072D2A7057058F9DAE9EEBF787266748A9B335417AE0E307C09A6A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199720, "uuid": "bfad94f9-2d2a-4ce8-82aa-386d9273cadb", "value": "7ca9aeb70e388366d4b49ad6e91f0c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199720, "uuid": "73c5b2e7-8e41-4de3-b525-385c45ad7de6", "value": "3072:c+sZDILA33/HLXS3QTqxInA4ZS5hFHsmGkzco1oxg6eYg4eZjU:3LKPfhS5vMmG6coaxg14eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199720, "uuid": "b4bf3379-c8dc-454e-abbf-8ee095f80f43", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199720, "uuid": "869cc833-7e5b-48e8-8aa8-f9100791352a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199720, "uuid": "d2c8f819-5929-438a-a206-06ebc073037e", "value": "cdba4bf95af8e93a8b246376e978934f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62d0b16-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678199151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199151, "uuid": "5dd10f6b-9633-4fd8-bd31-2e4c914335a6", "comment": "Malware payload (RedLineStealer)", "value": "7d16e203ee63afab07d943c4aaf6b47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199151, "uuid": "9d62fc9a-82db-4950-a70e-9ae65a1db64c", "comment": "Malware payload (RedLineStealer)", "value": "ea685dcf87d09d3001c61b76017b2ab8fa7da6b9b7394291022beaf38ee61569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199151, "uuid": "72409d0a-62d5-4f66-acb1-4d0c502adf65", "comment": "Malware payload (RedLineStealer)", "value": "6ccfc977b5b25fa7964c70bc3061dbd85634c778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199151, "uuid": "1160d7c7-dad0-4a59-ac0e-be69653e554a", "comment": "Malware payload (RedLineStealer)", "value": "f0ad4e276f35e83513662e01a3f8325c4ffc8093a7915bb4643d08b05be7c6b46e6388be2eacda520c7efcd771cca382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199151, "uuid": "9410d410-df6e-48e0-b2d1-209b845f8f1c", "value": "T169554BBD225C552FD71A52318CFB4991F82EE3B30A420ABE6F9C8A168713DE045F3D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199151, "uuid": "2eeba698-4d6d-4078-9d72-b41e563068e1", "value": "20db1e79c216f1d522f5cd084231f477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199151, "uuid": "b8138e86-31d5-460c-9c62-06534fb0d725", "value": "6144:8b7zSTVhl5s/9AOYeGrl/SeVN0a2wScYF:y7zShc2FlDeci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199151, "uuid": "575b9434-b4ad-47dc-a474-5308ab1b3448", "value": 1401760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199151, "uuid": "511e916c-b2f9-4624-8ce6-4bcf822c43f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199151, "uuid": "ead66df2-2304-4f6e-a239-8bcb3b466a18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fb3371-bd0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678209733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209733, "uuid": "5be22baf-86f9-4125-9e89-424e7ba4108d", "comment": "Malware payload (Gafgyt)", "value": "0080f20cf3f467961d3e1230ec33e50f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209733, "uuid": "b45c6dc2-fd19-4e42-ad9d-82bd513a113e", "comment": "Malware payload (Gafgyt)", "value": "eb9c18761c2133a7de7b3787953ecb4af5a9c57784201ee979db7e825474915f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209733, "uuid": "8114192c-2d62-42b1-bea6-10670a9471e1", "comment": "Malware payload (Gafgyt)", "value": "6cb43477f816df8ec7a9838d86a8182373307166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209733, "uuid": "d19ee7e2-f1e5-4d68-94d5-a0eff438e29c", "comment": "Malware payload (Gafgyt)", "value": "c62cbfacf7b679d00a89c7c89556f8e8ac5fed7b2661511d591c90f12431cce0b28aee669fb1c13cc751d3ced628d2a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209733, "uuid": "df25ca87-5714-4e39-8b08-cd7df780aa74", "value": "T140B318436B1C0B83C49B99B02DA737F18769BE7112A351C9A90BFEC04773AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209733, "uuid": "2b6432f4-c247-407f-aa8a-b5a48ca97aca", "value": "3072:eDzhqL0vbKlnvZ0pqu9wTqsFh7tm2pgYMidIP1W:eDzhqL0vbKdvWpqywFFdtm2pgYMidIPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209733, "uuid": "0d83573f-68c6-4667-99b3-4b15740b244c", "value": 113186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209733, "uuid": "8d98bb69-600f-41a5-8018-1c5d2208d4db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209733, "uuid": "9a81ebe0-5501-4490-9d6a-500c38f2d35a", "value": "0080f20cf3f467961d3e1230ec33e50f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2918de29-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678175614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175614, "uuid": "c43c258e-0495-4405-ab00-406306142872", "comment": "Malware payload (Mirai)", "value": "9ff548efe93ed827c83c2371b8d1c397", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175614, "uuid": "cf3e1dac-1300-48e2-a337-705b3177b3c6", "comment": "Malware payload (Mirai)", "value": "ec699d9fa6908477c34ca0098c18ce60b15d114fa22e2bc6602c7996480fabf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175614, "uuid": "0f2d6e20-0844-492f-80f0-7380bc75b13d", "comment": "Malware payload (Mirai)", "value": "42709408cf6ad49ce17873c2783041e98e771c30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175614, "uuid": "2ffe5608-0eaa-49a7-9234-2f3e16505030", "comment": "Malware payload (Mirai)", "value": "e450cd3b56de0764901fee6a9dd8ab88acae8bcc26381d1b9720d7a64342c842a6add34071a7b794fa36a143f1b0e904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175614, "uuid": "c2dd923b-2c4b-4bf9-aba8-7c04f6e364c3", "value": "T18C535C8AE687DAF0DD4609B0107FFF35CA36A8323174CEB7D7D4B9579CA2542909226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175614, "uuid": "14773b64-0f26-41dc-85a1-a7948701a856", "value": "1536:PqEHLfdoNbzMfp+YGHLKd/cJg1OSStpBR3XH:9zKap+EkZZtpnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175614, "uuid": "9d22582c-4828-4a56-9957-aeb93749f233", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175614, "uuid": "440d5aae-a3cb-4963-b416-d090b488b1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175614, "uuid": "cd3ac8ad-eb6b-47f0-a48f-76c45c06fc84", "value": "9ff548efe93ed827c83c2371b8d1c397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2775c5-bcc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678179006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179006, "uuid": "cb00a7dd-eca4-4b65-8b34-1e47a0ed3e93", "comment": "Malware payload (Mirai)", "value": "da0c1e6d0deb35357e603cf1df5421a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179006, "uuid": "43fc01cc-d823-4c96-9a41-85c3ea8ffc6d", "comment": "Malware payload (Mirai)", "value": "ed25c1d7e1a1f88042ebe03c5960845be80b2596c961f4cbbb9098a5704e33b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179006, "uuid": "a2525521-ca13-4dfb-b417-7e3deb692a71", "comment": "Malware payload (Mirai)", "value": "bc24075a30f275cf2ffb84e50537c758c87178ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678179006, "uuid": "6df87388-b725-4017-b0c4-df064dd6fb2d", "comment": "Malware payload (Mirai)", "value": "6ca4f609caddb695b257c3c79980551457ab231e1966d6bd0ed3b7780b4ff9b2b3d160743209eec02b24b6b6e8e44eed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179006, "uuid": "497b6c13-a6cb-4f69-8686-1d8bc467e080", "value": "T1E3632851BC819A13C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179006, "uuid": "fddb203c-b50d-4d6e-a60e-e7440ccf0459", "value": "1536:ONKlxkmiig51kRmO//kWUzO6iAsDwY8rNRuVAvvWP:ONDWzk1K6iAsDHaJvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678179006, "uuid": "ffb738be-5d3b-486e-8b43-609af595eb14", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678179006, "uuid": "06cde64a-ab63-438c-a74e-fbe3eeb3ea5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678179006, "uuid": "2609f43d-17a2-45f5-bde0-1ba46a0bac44", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f418c9-bcb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678174053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174053, "uuid": "51098625-0a29-40c3-8794-633dd60cd338", "comment": "Malware payload (AgentTesla)", "value": "30681761dfe3849b35ec6ab06fb8a28d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174053, "uuid": "633d753b-7243-4ecc-9b88-434e307160d2", "comment": "Malware payload (AgentTesla)", "value": "ed5f3275ba66edd1e77af8e2f08ed1092ad72dd6da261bed844d0d4a292e9460", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174053, "uuid": "63194ae5-10f4-4698-98dc-75c8ca7077f4", "comment": "Malware payload (AgentTesla)", "value": "f2655e7298fb713e3bc77456028c97c9c4fb0396", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678174053, "uuid": "de9dbafa-049b-4dbb-9aac-eb5021b593b9", "comment": "Malware payload (AgentTesla)", "value": "75eef0ca76683ae4f838d04319159b5bf572e76291eb5fdee5b1ab2851c24e714c3f35a12b9cd8ce3c8eea89c61d9d2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Scan0001998291", "colour": "#B2138B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174053, "uuid": "26b9dac2-78cf-4161-b2be-f57c356df25e", "value": "T130B423B4027900599001CA15FDDE4EF5ABD1DA0BBF335F80790067D67EA5F39AA8BCA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174053, "uuid": "0b668a1f-29dc-4f0c-9de3-61849502596f", "value": "12288:vCiZkkeU1hd2pyZM89aAyB0e750Eg8D4o8o7C0NUoJ92VCXdC:X7h1hd2e6D0EH8o8udKVCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678174053, "uuid": "3a1f12c8-3566-4e21-9bb0-04c890b5e4a0", "value": 525828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678174053, "uuid": "38ebfc4f-a7cf-4837-b93c-5b4ad6cdd704", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678174053, "uuid": "daf07337-b0fc-46f7-a6ec-6a83595ab380", "value": "IMG_Scan0001998291-2023 Remittance Docs.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3384e3-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1678176025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176025, "uuid": "1c6beec3-65de-45a7-9b03-6f4f2bb983f7", "comment": "Malware payload (AveMariaRAT)", "value": "f53759c4875b48b9a03295f6324e2c4b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176025, "uuid": "020aa359-92a6-4518-a536-a934158881a7", "comment": "Malware payload (AveMariaRAT)", "value": "edb8e5632be4abe56057e7358be590d934c761dafe8dca82641aac4fded1095b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176025, "uuid": "f7f7c491-8bf0-4be4-84a5-a3254e7358b1", "comment": "Malware payload (AveMariaRAT)", "value": "b882c134ab9e1901b7204fc9eb54a39c43cf5b91", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176025, "uuid": "39a3a41f-3bd4-4cee-bde7-2830a6bb70d0", "comment": "Malware payload (AveMariaRAT)", "value": "b504a71658ef9d881f5c6cbee43058d3533afb7bfdd35c603dec58e3c6503d6eb46b328c3ca732cbf0d5530a4c4841e5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176025, "uuid": "c0629f55-5de3-43ac-b507-fda6f36e2036", "value": "T167059EE42F5D7263F786E1F3280426A7DBACB95D6427C0181EE2108F81CDE7C5552EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176025, "uuid": "bb3be010-5fc8-4ce8-92ea-e028a551ebde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176025, "uuid": "016186b7-7eb5-4d8b-bcb3-37bec283b8f8", "value": "12288:sD5/XGZeMuDxhv+bZdDdhGZde4ov45iFl35/BCBT6:y5vGnuObZdusw5+xWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176025, "uuid": "f899b00c-fcad-45e4-becf-ecb1a05ccfda", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176025, "uuid": "8293e04e-6526-499e-9906-4399545cd437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176025, "uuid": "9be6c5e0-dc4f-4078-9d33-0669cf59d13f", "value": "SC3109Y5I0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1327f82e-bcee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678196622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196622, "uuid": "1fd87d39-fa7e-4112-b5bc-0129a898d6ff", "comment": "Malware payload (AgentTesla)", "value": "083e18189b2554787d659dd19b624a4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196622, "uuid": "1acf793c-9698-47fb-9931-12a15a4dfdf8", "comment": "Malware payload (AgentTesla)", "value": "ef5249455977661d7256300d73ad097966ee8516ff345e450c3bf78309320c12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196622, "uuid": "fb055fb3-84ef-4363-a3f0-e983f9b12116", "comment": "Malware payload (AgentTesla)", "value": "e0f1b1d8fedc8d5acabe1aa6f34ec400cff0d28b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196622, "uuid": "8af0bbd1-1a42-4242-93c1-dfe4efa293ab", "comment": "Malware payload (AgentTesla)", "value": "538d086fc2a20fa60e491ac2c4a56d02438526c7be19148261539d222b5e78c8c4c8b7694da3617f92e3259ce3824a16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196622, "uuid": "d8e9da69-02a0-47ed-bad1-bc2d9a4977d8", "value": "T1E755F1039138AD4BD102C7BCBA6F7959120E7C3671D2A4CA754DB74A4733FAA5ABF108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196622, "uuid": "a54158e0-a1de-4f84-8f2f-eb93de8d3785", "value": "24576:8LK6BiZtHlxeWQmmav30xfu5BlqOtHlxdWQmmav30xu6Fg+8i4PD1:8LK647TQmmQ30Nu5fqs78QmmQ30Q6e+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196622, "uuid": "2fcf06f5-3a79-417d-9baf-95c893edbe14", "value": 1294336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196622, "uuid": "2df65806-3d4c-488b-bc85-52cf786d408d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196622, "uuid": "430431a5-2653-4933-9b5f-6791ecdb560a", "value": "OUTSTANDING PAYMENT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fe0511-bcbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1678175708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175708, "uuid": "792b5dd4-9a17-4e0e-9d13-6bb91d381c96", "comment": "Malware payload (NetWire)", "value": "d616794167af5c88812aabaf65120fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175708, "uuid": "10183dd4-5b06-4753-9a5a-30a8fd0fd7b8", "comment": "Malware payload (NetWire)", "value": "efc5c94996f4af7ae3a2d17dfc73dd7fe3f84269e73bb611e5806f2fd131a646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175708, "uuid": "6c85ce82-cc91-4761-a260-a5315bb227d2", "comment": "Malware payload (NetWire)", "value": "ad1289875a05ba89cb6e10b08b95ee45bdf79d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678175708, "uuid": "04eed84f-3b4a-4048-ab07-6bf8afc11bbe", "comment": "Malware payload (NetWire)", "value": "8ec35b45b9d04197fdf70d362f31b0fb715278271d290cb57f1f2dd18a1f1d9838b7a7a22b87b344cd969ee68f2a36d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175708, "uuid": "1b39f0dd-d28e-4a73-9108-9c9a305ae281", "value": "T13F15BFE42F5D6363F786E1F328442AA7DBACBA5D2517C0181EE2118FC1CDD6C5112EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175708, "uuid": "569376b0-200b-4e0b-b931-1c5439b3cb46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175708, "uuid": "12f33c61-a4da-4027-96ef-96f1be97addc", "value": "24576:Jg7gUMoMnm9cU9VHb5Z763rs7u8BeV67s7nCrt8dB:vWMnGcU95nAsyTKug+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678175708, "uuid": "45af8816-039c-4d4a-877e-54e4e729210a", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678175708, "uuid": "9861392f-ab00-46ab-ab22-c8641fdf9fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678175708, "uuid": "eb390e99-580e-4afd-a68c-6ee094682431", "value": "89468038.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9cab39-bd24-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678220123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678220123, "uuid": "1a581a24-2c77-4a6c-a43c-ef95ffd821a6", "comment": "Malware payload (RedLineStealer)", "value": "29f4c77edbf8e40a541b5ed8786e82a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678220123, "uuid": "55ca0a75-1b6e-4360-96ba-0f8a72fe086f", "comment": "Malware payload (RedLineStealer)", "value": "f0ec980108157002c8ca92507a2caa1f9a2cfa548959c7b1a2533ab7030966ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678220123, "uuid": "002af67a-b655-46b5-85c2-6679b8c37eb7", "comment": "Malware payload (RedLineStealer)", "value": "4b6f10fab7719384a37ed86c4c2f4c5487d97887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678220123, "uuid": "986742ad-3c6e-4332-be8a-689204cb9cd4", "comment": "Malware payload (RedLineStealer)", "value": "bb22924ebab3000840583e5926d40c37d426b300a6e68c896220a92da2ee7cd9912607d7344cb0c2ae8b6c6e3fb551bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678220123, "uuid": "8c9fa1de-93b2-4773-ac94-4b6a269de7b6", "value": "T15BF41221B2B1C063D28F85B89630DB8699FB747356A5859B373C07DF8F203925AB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678220123, "uuid": "aa891fd9-de0c-4e41-88c1-ccc3bf401880", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678220123, "uuid": "bc2bfab8-e948-4f0d-88db-1d1ffb5079b4", "value": "12288:YIde9k0n3P+Bgik6gsjZ7FZenrpALWNro8iMYvBgXO4xjOmk8q8CUfa7m3UJbKXa:YhJijXZmpE8iFvBgXO8jnkr8cmEJbKc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678220123, "uuid": "1ad12734-a23c-4853-b54c-94530aab8b24", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678220123, "uuid": "5621bd1c-4fb1-4f95-9a4b-242cee4c78b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678220123, "uuid": "8e7e2c6b-40b3-4b5b-b823-b6a29f307955", "value": "29f4c77edbf8e40a541b5ed8786e82a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202d29bd-bcc4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678178605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178605, "uuid": "bf504475-990c-492f-8a93-47f66f8e57cb", "comment": "Malware payload (Gozi)", "value": "f1a6cd0e789711d616a3eaf0da992098", "object_relation": "md5", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178605, "uuid": "c24d97a6-3542-4db0-8d17-906677a25c49", "comment": "Malware payload (Gozi)", "value": "f168d4dbcc2a3e70e6c75a70404a62173e46b24f18ccfdb8593f68e9ecaebf08", "object_relation": "sha256", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178605, "uuid": "acab90a7-738e-40eb-b024-eb50921db751", "comment": "Malware payload (Gozi)", "value": "7b97c473409cefa0fc5ef9dbb3de61401aec2127", "object_relation": "sha1", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678178605, "uuid": "308aeba7-9fc6-477a-ba37-6a492cf5673a", "comment": "Malware payload (Gozi)", "value": "2158b19a134d8bf0c29d65b53ebee135a14237223b3141a41bf838a70c126c40312a9cd764d16a15eac0057e5858b2b7", "object_relation": "sha3-384", "Tag": [ { "name": "7710", "colour": "#BED5EB", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678178605, "uuid": "33b5cf40-035a-4e9e-8f8c-7f85a579fd67", "value": "T144F05C03D987902AD24F8B3471B564125D12379FEC0CB2C2953800C84495DB60B43A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678178605, "uuid": "94c0bd93-1396-4aea-acbc-bf22a458b59d", "value": "6:5jQp2hMzKI3gKvUl/Ctgq5XgH0GFyaH9U9f1WCrt2F+AO0Bt+hgs0lp+AhzqPn:5jczPp2gVQyaH9UN17wO01s0lp+WzqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678178605, "uuid": "e4759b11-b37d-42d0-b322-2fa13261f369", "value": 474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678178605, "uuid": "0664278b-f359-44b7-acc9-6d6ea4c4abb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678178605, "uuid": "5bc58169-73d5-47bb-af68-87e90f60c4f4", "value": "Documenti.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a41c48-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678192142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192142, "uuid": "c3918963-397b-4d93-8947-406e10567944", "comment": "Malware payload (Rhadamanthys)", "value": "a526b69375a52ad3b9d8b12468259ee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192142, "uuid": "c5c2dcaa-39d7-466f-8f6e-8779268de80b", "comment": "Malware payload (Rhadamanthys)", "value": "f17b2ecce5a84b6c0a34cd138bfd975d36d6ec1e365cfbef79b463a97ad375e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192142, "uuid": "334dfd58-8a48-4c5e-8a22-bb27889bc74c", "comment": "Malware payload (Rhadamanthys)", "value": "17b1065d9f8fa646e401312899c9547f5aa088d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192142, "uuid": "c31c81a5-b60f-453b-9077-c905a6089d08", "comment": "Malware payload (Rhadamanthys)", "value": "bae151199fae34ab6e639399b7697f0daa54e6502d548b76ba8c4fcbc856fb5b89a816caa458c1467ef97baa57a0a41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192142, "uuid": "f05989ec-9800-4ab3-bf6c-d13accca4437", "value": "T10D933944ABED4A57D6FE66B9B8B052400FBAE5876062F70F5D8825FA0C13F404F2539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192142, "uuid": "1ed4fd5b-a1ec-43d7-90a6-9236b0ee3b98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192142, "uuid": "cc552651-358e-473f-99f2-29020b94655b", "value": "1536:yN1KMYorUNWvwZhcZ/OoU33vx+W9RXMivgSeeCBwiQLakuE8JJs:yN1KXlkE33h1weCqiQGkurbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192142, "uuid": "dd746a1c-4fc8-4a87-ba4d-c81b5336401c", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192142, "uuid": "e94d13ff-4789-49f8-afcb-583b4a4869a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192142, "uuid": "fdfa586b-0742-4274-8b61-154a1a7b5458", "value": "a526b69375a52ad3b9d8b12468259ee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f891ecfb-bceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678195719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195719, "uuid": "2f8abebb-84f1-449a-9e16-25e2973d58c9", "comment": "Malware payload (Mirai)", "value": "3f5c9335d690a7efdef403a3c5da1aff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195719, "uuid": "6b78a0f9-ab26-4f9e-b5c2-0e086e419d95", "comment": "Malware payload (Mirai)", "value": "f2087d1215c4d6aec737e8226f876768d9d5c389ac75891d877323e589a9e283", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195719, "uuid": "9fa90795-1a04-4490-bcd6-418e742af9e8", "comment": "Malware payload (Mirai)", "value": "64d0a907547e48b14b15c48fbc7087b3d784e1c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195719, "uuid": "b0e50b66-686a-448d-b17b-06c9f9568002", "comment": "Malware payload (Mirai)", "value": "f1f047cc9a8e7fb40ea8290631c61716c259661fa41c72d88d4bfe1529859458deb95e690213bdbfc208c3e06c5eafab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195719, "uuid": "d09113ca-ddf4-4850-9026-6dbc84b3966e", "value": "T11FD2C1BDE1986A97C59F7CBD09AD01607D8571C6225F5F9B0317404C32BCA9BFC1B064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195719, "uuid": "cfe80cb1-68e0-4f6d-b50a-d63d4b038bdd", "value": "768:11uUtLrVDsAp6tLb0oDMfaxGwvLekyqtGrC9gJbiWUp:1bDs06tE0XxlLekykGrigmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195719, "uuid": "8c505a93-25b0-40f4-8781-f1806d29c8bc", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195719, "uuid": "ca08e234-1439-4d8e-b218-3d24dc0bc192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195719, "uuid": "63199dd8-8fd0-4c4b-8716-cca00ef09bfa", "value": "3f5c9335d690a7efdef403a3c5da1aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a8744a-bce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678192088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192088, "uuid": "ca24a452-2ee4-4169-98ea-a0540401b4ce", "comment": "Malware payload (SnakeKeylogger)", "value": "0e475261d9a0853d107f51b11ec26dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192088, "uuid": "20dfcc6a-62a9-4d6d-9984-8bedbe8265eb", "comment": "Malware payload (SnakeKeylogger)", "value": "f2919d54bbf74198eb4bf4c43f7cbd394acff9af2e57f7b7ba9e59fd6a57f79c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192088, "uuid": "6f5e89d7-1f76-43aa-958a-3b919c182494", "comment": "Malware payload (SnakeKeylogger)", "value": "2587e087ccdb6ba43ae457534a5a04b026394484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192088, "uuid": "7f643a3b-3064-4f81-b206-cf793408400d", "comment": "Malware payload (SnakeKeylogger)", "value": "41dfa50ffbf994babde5f267be6702e37d794a6d2e43dea6ae047a431c00f57650347a94a6145ea87a60137125719e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192088, "uuid": "fb87e4ec-e190-4102-b83f-4ecf3a8a96d5", "value": "T14E05271B243ED002F45D21B61B12272FBE78D66D5E67E2F53686546BE00AE223FC1B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192088, "uuid": "3257f8a8-3152-41eb-a4fa-2ac4d87dcd91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192088, "uuid": "12d01149-e19a-45f7-92ae-485e67defb1b", "value": "24576:M6CCF1W6ZesX2vB9OLmnQIOVnCribKQY+uELXIs:M6CCF1W6ZesX2vB9OLmQp1CrRJW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192088, "uuid": "ef00c474-81fa-4547-b951-7910c25b406d", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192088, "uuid": "9b163594-ee23-4874-8d96-68fd627cae12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192088, "uuid": "9d28c2b7-8b28-4694-a743-cfa9feec5949", "value": "delivery notepacking list PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d3bd11-bd0b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209213, "uuid": "680e0a75-823e-44e1-8890-705afa0029e6", "comment": "Malware payload", "value": "770453c5d3ed689a451d55e947764742", "object_relation": "md5", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209213, "uuid": "df90250d-c394-4458-957c-e4ec123c3d20", "comment": "Malware payload", "value": "f2f80e624a3bcaec31ecb73a8d75715189b7baa73176fa773a986ff80c19976d", "object_relation": "sha256", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209213, "uuid": "0aa56ae0-b0a5-4cda-a1c5-aa584b62cc1e", "comment": "Malware payload", "value": "1971af01230229e08c15ff0810dcefa3e9a29ff4", "object_relation": "sha1", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209213, "uuid": "d94ed1e5-b9b3-4160-bb0a-ceb73af4da28", "comment": "Malware payload", "value": "816bfd8b7beab61396e4ad38e027383326d7daeed0d6bd692c6f34dc1b764cc60dabdb99a0ae25c111f526029a34fc73", "object_relation": "sha3-384", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209213, "uuid": "a1bf2841-e5a7-4fba-9b09-94ce73ed8c63", "value": "T15184BEC0CE9648B0DD8E68BD41FEE927053A1E2D0316C6E389943E05FDB27D766B528D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209213, "uuid": "69e0d2cb-f327-40f9-a122-f9448f3298a6", "value": "e406d311f6b10b8a1b598b66f1b0f5cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209213, "uuid": "b73244ed-9e83-4c51-b7e1-481ff46dbe54", "value": "6144:Ve+9dH7mdgjTTi96d7B9+stcTNWY76POE9F/nvaGYuidCHhhF0K:VeMdhjCYOTNWY76z/vaGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209213, "uuid": "0c17ae3c-d92b-4487-adb2-0efb90aa9a51", "value": 396696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209213, "uuid": "d7b64428-bf70-4f44-8ea8-d9cb168bd308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209213, "uuid": "788d6248-e257-4299-9f87-9f40ea1914d5", "value": "glumnessesEquators.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26f2101-bcf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198715, "uuid": "545f5eb1-6402-4c97-bf1f-eccfcc6b74fa", "comment": "Malware payload", "value": "26a116302bc35f1519ad71b743aa3a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198715, "uuid": "e1d05938-ddcb-4887-be52-d363216f2458", "comment": "Malware payload", "value": "f331b64f03a4492875a92f6417030d7be5c0e11a413e81f3e08f8241870b9e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198715, "uuid": "649149c7-9dc2-4e6a-aeb6-d538b91452e0", "comment": "Malware payload", "value": "0df5022b444c0e0eecf0aba874f86bd07e18f264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198715, "uuid": "db46180a-24c8-42b0-97eb-4e8dc8bf4470", "comment": "Malware payload", "value": "b14f3a4621982d0cd610db14a2ce291375892f690ff0c7919dcb82e3b372fb21edbd295a3df884022ee943cc541130ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198715, "uuid": "958ec97e-fbe6-4846-a478-398744e8d9ad", "value": "T1CDD4022667148463E4A637F7093A4BA25E6A3E112978730B57313F587733193DC0EBAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198715, "uuid": "2b9a92a6-2822-482f-b019-aca1971cd2bc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198715, "uuid": "3de5ed77-0584-453f-94e9-3a819b771bcc", "value": "6144:2Ya6npxtxAI8vlLSuxJkhbDopBkOOPPwot:2Y1pjWjvUukpkBknPwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198715, "uuid": "0ee70a4b-5c0c-4774-b127-8e72b5c1d618", "value": 613744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198715, "uuid": "896838c9-5ce2-4f76-9566-453b432a6f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198715, "uuid": "b568b5e0-dc80-48de-8d21-f88b924cf2f0", "value": "26a116302bc35f1519ad71b743aa3a67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0412f1-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678176370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176370, "uuid": "c98ed4b4-ef7d-4efe-a36a-ac52da8283e4", "comment": "Malware payload (Mirai)", "value": "8dc12365b593209a0694897c2c872d5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176370, "uuid": "cf2bc39c-884b-4abf-b1ea-9962e3dbbd9c", "comment": "Malware payload (Mirai)", "value": "f3519dd059478e556a12636e8ab9fb34c9f6df4a9962743de6bfb52262df90f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176370, "uuid": "87407e79-e50b-418a-9047-e6cd6ff998ce", "comment": "Malware payload (Mirai)", "value": "720db3075730cdbaaad03cb2482f1dd83d307934", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176370, "uuid": "337b5697-ac93-4665-b248-f71b7bb6744c", "comment": "Malware payload (Mirai)", "value": "15b52a24563d92063b45c80f5557451950ebec1054f6e3ce4af8c385dfa741c0bb1b86956fbd369ca0f4e262dfff57c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176370, "uuid": "97d70d8b-cfa5-4cf8-9e83-71c4f632fcae", "value": "T145132AE2B800AD7DFC5EE77EC61B0A09F1317258598206376663FDA79C322D45A67F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176370, "uuid": "85fd07c5-0700-4cd2-9f44-9a64af2a878a", "value": "768:e2kjeYovtwoQFjWKOBGlykkXz2jPum8P1zGTz1GtAvj1jQ:e2kKyFjWKOBEkSjmm8P1cz1G6vji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176370, "uuid": "cd4f2ad0-d7f4-4129-99d3-f52a6a4ca52c", "value": 41568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176370, "uuid": "c58062f5-1e50-4903-83ec-cf363b9774ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176370, "uuid": "7d20720d-c19b-4f95-8f78-9609edf908c6", "value": "8dc12365b593209a0694897c2c872d5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45611c7-bd0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678210314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210314, "uuid": "37742612-d2e5-4e0d-b90f-3268adeca4e4", "comment": "Malware payload (RedLineStealer)", "value": "71a5afdb05429313e88e8cb9d8625f87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210314, "uuid": "ba2d6c61-fbae-47a0-bad8-04a4c8d4a573", "comment": "Malware payload (RedLineStealer)", "value": "f400e7797e267ecf94f95740aff8b443ff77f47f5bf434ad9c301bce119c5641", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210314, "uuid": "fe0001b9-ce92-4663-9977-633e18a5394c", "comment": "Malware payload (RedLineStealer)", "value": "d27f62f48856407e6e6994683bb197db330e7c32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678210314, "uuid": "1c1f3188-df90-4e70-a976-fde4c30d0239", "comment": "Malware payload (RedLineStealer)", "value": "38b5bdfd1b2e3190afa21431cbf8623143ac5fcf6820d86a50414742dbdca0ad4bfc2ad49892df4b5d9aa94cb2db7078", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210314, "uuid": "c8cf0396-adeb-4d30-bc89-63f4c5e89b1f", "value": "T1D0F4120276A2C0B1C1EB2C759875D699EE7E74B279A5CD5F3339179A2E207C09A33307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210314, "uuid": "99ae1e57-be3f-4ec0-8572-70ee0a375640", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210314, "uuid": "264a9b85-8242-4b02-b2ca-3c4a2c84817c", "value": "12288:YVqraFJRzTlPCgtTyF/8ZWFCZjVaipb5GLHJqOKAfUw2vwO:RKJNs0TyNwZE85uHf3EwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678210314, "uuid": "e4a29f25-203f-4277-8aa8-27d5be1849e7", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678210314, "uuid": "fbebbed8-92e1-4e7a-ae07-88cd7f997cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678210314, "uuid": "20d5e257-a004-4951-99e9-6fb41f0a2fbe", "value": "71a5afdb05429313e88e8cb9d8625f87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cb52e1-bd1b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678215924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215924, "uuid": "080aaed9-5f24-42dc-92ea-373f91356319", "comment": "Malware payload (DCRat)", "value": "2b3d63e657df24a39c6b81a44c29ef1c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215924, "uuid": "16c19a99-617d-46b1-bab1-3c42b97fff98", "comment": "Malware payload (DCRat)", "value": "f5943aa806d8828e433b048522096303f73d796305e366d46318a98ec92e58cb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215924, "uuid": "2d3e33f1-c357-45de-9bb0-a97086edb45e", "comment": "Malware payload (DCRat)", "value": "865b9a8ca94fe3dd890450386a090159ba9f6650", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678215924, "uuid": "10ee51a6-1be7-4337-9e3f-e02543c6bb02", "comment": "Malware payload (DCRat)", "value": "6b87dbf8c2cc62171202fda9e0f1c05a5f9d525dc6df912c956a9cc4fb94fde62227f7dde75b98919f386ca120624769", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215924, "uuid": "f5d6f619-69a7-4404-bb14-12579ac3845b", "value": "T10005F5027E44CA01F41917B3C2EF464847B0A9916AA6E32B7DBA777E15123A73C4DDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215924, "uuid": "89520e7a-2287-4880-87ac-589a1b17abee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215924, "uuid": "e61e9e54-c375-4a26-9834-a77d9ac959e7", "value": "12288:viOrCOtZf5+tyGIdZ00xyuGSlJuLl72l02Nzg4CW:vxPjf5+tyzZ00suoU3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678215924, "uuid": "fdfd06af-5dfb-4491-ad31-d65eb901b572", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678215924, "uuid": "1e1674ac-a54d-4443-92ad-564817553697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678215924, "uuid": "e54c4134-af54-40f5-85d7-8ee059e00741", "value": "2b3d63e657df24a39c6b81a44c29ef1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b84b3c5-bcdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Bitter)", "timestamp": 1678189415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189415, "uuid": "9ebb6ee5-0037-4e81-a051-f15a30aea269", "comment": "Malware payload (Bitter)", "value": "986f8e182124956f0062bc9720ede7a9", "object_relation": "md5", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189415, "uuid": "2436d663-404c-4459-8363-1b968352782f", "comment": "Malware payload (Bitter)", "value": "f5e066da37fc9da2ca68678aa1e001c4428e9476dde8a927cb76fa9389038b06", "object_relation": "sha256", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189415, "uuid": "18cbe7aa-f210-431c-8ce1-484f13e0fc24", "comment": "Malware payload (Bitter)", "value": "9697f8d1f8e4ac3b372f890fa591fb36fb0b1b5f", "object_relation": "sha1", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189415, "uuid": "e88bc92a-6004-497b-80e6-a53e7200b66c", "comment": "Malware payload (Bitter)", "value": "a611ee3bf466157d914393b7eee9e0373cab3a13c452fbf7014dc8befe925418fd3e8deeb09683ddefa57e49969c2f43", "object_relation": "sha3-384", "Tag": [ { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189415, "uuid": "3803e97f-06ca-4077-b160-aa3051a9b499", "value": "T18AF23D0497AD4637CFBD0BB8A4F1621103B6C29B7622EBA67D84B0D91D533D48294BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189415, "uuid": "5826248b-c1d8-4a0d-ab99-dcb9e4fb7079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189415, "uuid": "78fdb825-aaa8-4777-b42f-40abd0b0c6d8", "value": "768:oev6P7mAwpfJAZ9iBVi2HI60Gn9J0T6LGxHhYZWBCxI:oev63wIRGoToGxHhYZWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678189415, "uuid": "727f5be1-072d-47aa-bb67-ebdd268907dc", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678189415, "uuid": "be84cc7e-36e4-41cd-86c7-a3c03488225b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189415, "uuid": "c420f89b-0a02-4457-87a7-5980196a8d9c", "value": "f5e066da37fc9da2ca68678aa1e001c4428e9476dde8a927cb76fa9389038b06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9589c08a-bce6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678193405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193405, "uuid": "b7c97736-3b85-4905-b6f4-b55fa478c120", "comment": "Malware payload (Mirai)", "value": "a4363ba0af13fb826cbcdf9cfc566480", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193405, "uuid": "af1ae12e-df2f-43b7-b1f6-c991a51b20a2", "comment": "Malware payload (Mirai)", "value": "f64a1f7a67f286fb68d75dc6592109dfc2f7fce1a81719d07cd0d9a85e0f2eca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193405, "uuid": "88fd44f5-cf24-4f8c-aa20-49a282472b71", "comment": "Malware payload (Mirai)", "value": "f04a792836acb46d052a31fbb32eb91339df7472", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678193405, "uuid": "9286ff90-3786-4c75-b966-0887a40b49cb", "comment": "Malware payload (Mirai)", "value": "6ab5a0412265db221184ee09917c3334bb6d3ae652fa7c7e66ee601102a2b5c9e593479b58116c28552c664b0af49954", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193405, "uuid": "c4b191ae-8e4f-4f1f-9dd4-b7b4d6d3882e", "value": "T16CC2F1BF76995A2BFA18633DF435811F03A4F52CA79D6B9723400432E95E42D7532CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193405, "uuid": "f3f02d1f-080d-40d4-8985-50120fd21605", "value": "384:Mg1DMwk8JPyGnT8WyopNEOtTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZH1Nwg6K:RMwxdyoE0nDz+Y8tqHWXmVlV0NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678193405, "uuid": "9feafc9d-cf41-49bd-9cab-cb91e1169d1b", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678193405, "uuid": "de9afced-65d8-4a70-ad19-77d9f8213358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678193405, "uuid": "5a20925a-5b0a-4217-ba35-446be7f1a6cf", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac8eefb-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678195991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195991, "uuid": "12f9d5a0-fd06-4472-91f9-3f9e307491e3", "comment": "Malware payload", "value": "b8bad6d56d119fc93cf861331e3e67d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195991, "uuid": "dbd687ff-c8f2-4419-944d-55b265de90ab", "comment": "Malware payload", "value": "f73b9c4e756baf9c90bdcb735f59a6dbed5d9c71a7f42b94b6d3955dfa7910d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195991, "uuid": "c738c91e-1e2d-464d-a64e-4737b9c464e7", "comment": "Malware payload", "value": "5a660814281f03a71d2a12fea2abca061a9abce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678195991, "uuid": "072a1389-e685-4faf-842b-a9f4b21711f4", "comment": "Malware payload", "value": "df4a8285d068e74fa15e90754fb659c61b941d92e11f82e6e1b21ce18178f687d2c1bfd9f66d1a7affc4ff0c1fc56a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195991, "uuid": "5db05831-ccd5-4307-9ef5-eed61fbff8a3", "value": "T19F75AF343EEA9019F173EFB54BE4B5DADA6FB7633B07981D1091034A4723A81DE8153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195991, "uuid": "1ab21080-0e4b-4674-bbe7-7588bc149d1c", "value": "24576:0nkF3wTrwt3JDbPgKW/eNaHmJ6FmtjqjL:8OAS3OKAm0eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678195991, "uuid": "c1df99c4-b08c-41b7-b235-d1a4339116a8", "value": 1626624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678195991, "uuid": "38ce43f8-19c7-46bf-b0e9-113241b3d9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678195991, "uuid": "4b1ee503-680e-4b2f-85ac-272e46c71919", "value": "f73b9c4e756baf9c90bdcb735f59a6dbed5d9c71a7f42b94b6d3955dfa7910d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fe2d16-bcf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678198929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198929, "uuid": "753a483d-5c10-41e2-8b50-396d28ef9cd2", "comment": "Malware payload", "value": "c2c1974f1a2f5a275c57d2cafbd3f4cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198929, "uuid": "8a331dcd-2309-4136-991d-4a6a80bd5d18", "comment": "Malware payload", "value": "f832abb0d355484b4503b954e5f2ea56875ee80d6755f2cd6a6edef6cb3d2066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198929, "uuid": "b068f110-49e4-4dd8-8b5f-c9c968a9ca5e", "comment": "Malware payload", "value": "448f7fb3bc257b1006596cfd53fd014aebbf1cf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678198929, "uuid": "39a4363a-e1bc-421b-8a8a-c9a02bbdba52", "comment": "Malware payload", "value": "5b4ec796f159ee72b46f5afafea6907ec250558597c61eed37e35a7bb6f681cfdf5bb7b278e7d0005f0424b7ccd690b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198929, "uuid": "34ea2990-65cd-4d13-ad28-c9dd636b9094", "value": "T1C1D4011673108403D86173F214AA5AA11D97BE5019B8B20B73717F5C3BB2293FE5EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198929, "uuid": "cb28ed3f-7357-49b5-b325-944939d3b96f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198929, "uuid": "a341c119-d733-4278-b852-1ba3e6eed3ba", "value": "6144:2Ya6nZnCxe7OeMbQQAdA8hvymZvm/igEPdBB0xOqg1:2YtZCkDkQQAO8h6mZvrg6NEOqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678198929, "uuid": "1fbec246-ae70-41b2-8688-259f158b8a0a", "value": 613688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678198929, "uuid": "2a14121d-69b6-4ad1-82b0-e35d83f1a7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678198929, "uuid": "eeb50566-2326-47d3-9c05-1d6e1d7c479e", "value": "c2c1974f1a2f5a275c57d2cafbd3f4cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea2211c-bcec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1678196158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196158, "uuid": "8f980031-fced-481a-a4a8-313b99d5408c", "comment": "Malware payload (Socelars)", "value": "74f16e75b4d394e20beafe3b6c749e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196158, "uuid": "30449fc0-fa7f-43d0-85af-fff5c7a78497", "comment": "Malware payload (Socelars)", "value": "fafb40e0e937651a690e66b92f3ad4abb31e071b68543a83cd696cd1300913b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196158, "uuid": "7f94e585-6293-4742-8f39-b198a659d294", "comment": "Malware payload (Socelars)", "value": "aadbbe486b4fafeb5a1c23be9a75dd2bfc6fe5e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678196158, "uuid": "75599ef7-cf3c-4407-b327-d9444a7cd36d", "comment": "Malware payload (Socelars)", "value": "4ec5c30762d7718e4797155137071b18f5e58e87c75fc1cd0dfe6dd107f8e83dc98cc229626a5b8a05267c1a36d321e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196158, "uuid": "66295783-e40d-4601-a0de-4f6927eb96a4", "value": "T181658D21F7C26032E9E310B745FF5ABE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196158, "uuid": "94d28385-3e43-475c-9290-d1cc32b4599d", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196158, "uuid": "842fc43b-849f-497e-963a-3c0a790b2116", "value": "24576:UGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRT05hgSr:fpEUIvU0N9jkpjweXt77Q5Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678196158, "uuid": "a0c3f2dc-8e15-4645-8348-d2d2f8540121", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678196158, "uuid": "0013057d-7fff-4a0c-aa06-341853a2eab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678196158, "uuid": "14aecada-44ba-42d3-a73e-4ab9fdfed634", "value": "74f16e75b4d394e20beafe3b6c749e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714c94ef-bcf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678197639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197639, "uuid": "d97f825e-7f76-42ad-8c60-0813b138a46f", "comment": "Malware payload (AgentTesla)", "value": "d9e0cec7763c55cf3f67b1afd26de7fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197639, "uuid": "fb309a40-443d-4760-b5de-ca5291235c19", "comment": "Malware payload (AgentTesla)", "value": "fc3ce8c870e0d1de56fdf0959496b5b94d88eb5eea648627114a80b4dddb234d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197639, "uuid": "60fad55b-0fff-49ce-afd5-819c706b3793", "comment": "Malware payload (AgentTesla)", "value": "6533f4b9d3a927d90e2fceed10450cd9ad2818d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678197639, "uuid": "832f3b20-e669-448e-8a61-7b32dc224447", "comment": "Malware payload (AgentTesla)", "value": "39f3a0ec9fa900d671eecb6fd36663583813658cd60e73e63da5f34190a1090cc5af72a919725d815bf0878f46b695e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197639, "uuid": "1b9b1f8f-2bde-4aa8-96ff-a469c6bef136", "value": "T119F31A689EC89B56C32DC075C5A151081EB3A247760BE75D1EA1DEFB3E363C3322E865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197639, "uuid": "bd9c4c5e-e7a2-473d-8708-9b243d751ff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197639, "uuid": "e13168fe-17ce-4478-ba2a-9e567189dfeb", "value": "3072:9+xvqvHhtMS1zmk4K7N5y678BEP054KwukRXrcatDN/:sUvhGIyuJ91Wr613dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678197639, "uuid": "e7312d53-8a20-4dc2-8435-326bc279df50", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678197639, "uuid": "1794a0a4-acac-4e7b-aa37-64a509e34f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678197639, "uuid": "1599e853-e3a3-4745-9664-d7baae5824c3", "value": "fc3ce8c870e0d1de56fdf0959496b5b94d88eb5eea648627114a80b4dddb234d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b83712-bcde-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678189919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189919, "uuid": "d2c97074-c2ec-439c-ab5c-5b9d75f96c06", "comment": "Malware payload (Gozi)", "value": "3e76b00a73d9032e9dd855ab4af9c978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189919, "uuid": "2db58490-3b70-48c2-81a0-c5dba40c67e7", "comment": "Malware payload (Gozi)", "value": "fc74e8faf8772293f2947c803c5309c64310c38d8e3f8efe18271004a9b96bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189919, "uuid": "342b929f-7e5b-43f7-902c-080406093ff6", "comment": "Malware payload (Gozi)", "value": "c288a83e8aeb37e98fdb8a11d8d97e3f70406349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678189919, "uuid": "ed470b20-4397-47b5-bd9a-4e3191d01727", "comment": "Malware payload (Gozi)", "value": "92242777014038d4e41a34d64bd1d59f9340d5cd004b3bfbefdf1e91ab0a021e4d826a16cc5f7504a384a4f207bcccad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189919, "uuid": "d64b58a0-a5d6-452f-b7e2-bc7eeffa19bb", "value": "T18844CF2177E0CC77D6AB05B08935DBA13EBEB472666586DB332407BE0E306915A77323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189919, "uuid": "9e1602b5-d046-453d-80fd-35ea17eba0d2", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189919, "uuid": "518014f2-89f5-46d7-b72e-517c202ad493", "value": "3072:7/YkCXLy3dms/A2G3cFG3m00PA82mojEeywFgRNJDIGPYovOxYSz4hZeR12oDNb:bf4L+toudAuojJ/yZhOxYSAZsQMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678189919, "uuid": "e6014ecb-9308-49c6-8781-f632600b7399", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678189919, "uuid": "c0a04959-8253-45ac-9002-017e6f669bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678189919, "uuid": "06a677d4-8c5a-4b05-b82d-d22600e03f33", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1802766-bd28-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678221879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221879, "uuid": "a6bb58e1-2961-48ec-980d-f50ae23f15c0", "comment": "Malware payload (GuLoader)", "value": "973d03baf56649b8b0fb97a3b495c034", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221879, "uuid": "4bf274ba-f842-450a-a22d-9243b9fa62da", "comment": "Malware payload (GuLoader)", "value": "fd0b02703d5e977c8231a392c40f5db08bb1e582b7ba525ecd6981951c8b0592", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221879, "uuid": "22b44edd-5ee0-4bad-ae96-59d1b3b9f826", "comment": "Malware payload (GuLoader)", "value": "f95476568351850cf7e0535af95f02a612613417", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678221879, "uuid": "c89a3033-e3fb-42ad-858c-289f1ae7448d", "comment": "Malware payload (GuLoader)", "value": "de8776328f27c3fd454c869f8d81cbaf13fee2e729deb00af840f11c46740fef318fa54a75e2a75752a5cfe549a1703c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221879, "uuid": "5d3ad7ba-5dd2-4d30-b73d-83b794df11c5", "value": "T12475176BDE16571D0B2B17ABACF18EC14CAD84294B26016DBDFA134E6F0215C83FE719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221879, "uuid": "f23c66ff-9ee0-4447-b1a5-ed6d0c0da6cf", "value": "24576:Th72fI1WQNwD8PvxgwRtX7oDOOwD6fLSG0fDm1J8S2Wa2F8ANPsTFLH5:FayZ33kj+G0aY5SN41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678221879, "uuid": "2e70aa36-e761-47c1-8b8c-76a3fa5c9178", "value": 1608252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678221879, "uuid": "9bd80e8b-ef98-483f-aa5a-eec5b9d056e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678221879, "uuid": "3ad5e2bd-4811-40b6-b59c-4aac9db4a115", "value": "DHL-CUSTOMS-REQUEST-802487487001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7be060-bd0b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678209199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209199, "uuid": "d01971bf-3c2a-47fa-91dd-bf376a917fe9", "comment": "Malware payload", "value": "3607ad95e33dd12803af676597df5c6a", "object_relation": "md5", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209199, "uuid": "9bffcc76-9265-4558-9aed-5ee9a8a8d98a", "comment": "Malware payload", "value": "fd14ec3cdfb9034a19e48717b697a4d1b169c02d24be9ac06b7c876388e1d9ae", "object_relation": "sha256", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209199, "uuid": "c5dee0b7-8f91-42bd-9a2f-3c76d8101bbc", "comment": "Malware payload", "value": "9a9ea64a482b4f2b45c3415bd58319938b1a2b9e", "object_relation": "sha1", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678209199, "uuid": "36141be5-843f-497a-a19d-01b6fb940da9", "comment": "Malware payload", "value": "cbaf02cdeadb4146f0329e0872b409949cab1bd70eb9df087b27f534de487bbfb91ecb2272d2a820d585f95bca4210b4", "object_relation": "sha3-384", "Tag": [ { "name": "1678202783", "colour": "#D5F6B5", "exportable": true, "hide_tag": false }, { "name": "BB18", "colour": "#9D39F5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209199, "uuid": "abf65b30-8951-4852-9544-06376c24c9e9", "value": "T1C1D34F484F1716A107273A27A2696878EAA91B2EC380055BF47F7152FFFE54CD8E0E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209199, "uuid": "d6e9bc87-fc0c-434a-89f1-33f7da1efe15", "value": "3072:nfSLLkbDAw/ZgEGxEr8j1bT4JorjKgEgKRN6Y:fcLkvTgG8jRTYQh2N6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678209199, "uuid": "9173e877-048c-4a16-bafc-50acd70d0c13", "value": 138533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678209199, "uuid": "75a5b7ec-27a8-41dd-a154-0138111f2170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678209199, "uuid": "9a5cf7b7-7e16-410f-a1f6-580da94a3e43", "value": "Invoice#DAi(63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2c7438-bc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161100, "uuid": "d8e3fd45-3e71-4a18-9c0e-def3801b7910", "comment": "Malware payload (Mirai)", "value": "0b9e89b9c8c5700a1dd1561ffa62db75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161100, "uuid": "38976d01-f51f-4dd8-801b-01317594cf0f", "comment": "Malware payload (Mirai)", "value": "fd3c4b52191985b57bdccc03e83110e56bc67b83f026464ef44becdea5750ea8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161100, "uuid": "6a4cd7d4-a40e-414c-83c2-e96b439c89dc", "comment": "Malware payload (Mirai)", "value": "50cce0e14acf513db66f7dc1351b2adf912e7805", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161100, "uuid": "67e6ee13-ff32-473c-80d6-bc382d570f71", "comment": "Malware payload (Mirai)", "value": "fc77d93b8901ff535634dac1ee4bc49f4c9c5a8c5134ab70f8439d2603a1a0fb537ec22bf5f48a98ed78673303de454f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161100, "uuid": "ca26b5b0-3d57-4183-a6d5-5f87ef2c51c3", "value": "T18AB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161100, "uuid": "7f4c7b8e-f722-4f00-9919-09fffd81999d", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg14/LWy:c9sSyzz36YaWWgg14q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161100, "uuid": "2c369179-fd64-42cd-8cbb-fd350245de8e", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161100, "uuid": "d43c4d49-5699-41b0-a409-0fe09936a616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161100, "uuid": "7ceb1a0c-8f40-4fab-beb7-9a86c4d64979", "value": "0b9e89b9c8c5700a1dd1561ffa62db75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c909148d-bcf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1678199504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199504, "uuid": "e598529c-94d5-4e69-9f61-ab5076507078", "comment": "Malware payload (AZORult)", "value": "806c44a4c0b7b9ff4438130eaf3ecb47", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199504, "uuid": "a1391525-5567-4401-931b-15fc21718a7f", "comment": "Malware payload (AZORult)", "value": "fd8f662e52007bc2f442c91ca41645fa3b71c68a355fce02c2e7a65be40c7715", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199504, "uuid": "ccdf747d-c85f-43ee-a930-d7999dc08d97", "comment": "Malware payload (AZORult)", "value": "d732d2647a7233eed5bcf464a4c1813e2002bea1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678199504, "uuid": "7452d9a0-ee35-409a-86d9-72b1aed57fd4", "comment": "Malware payload (AZORult)", "value": "9c48e1a2532e4b225d8313527f04cc0c55d3bca321d765dc976d069b1b2e5594a056eaebb9df95fd65d878d38e361e69", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199504, "uuid": "c4a3b4f4-a13e-41fb-9aa7-135a6fa384c0", "value": "T1F9457D65CA1A261A4D1F2BEAEC820C4565BDC02D437701B9FDDE238E650369CC3BEB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199504, "uuid": "231b71dd-bb96-4a89-b3e6-fbf7429bd3a2", "value": "24576:4u5pAyMFdHdT9Q8KwRZpLt2AaSQjMCzunW+jE6O0:VUpFcOHdA4REA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678199504, "uuid": "0c576117-43bf-4f5d-94c5-046371be8495", "value": 1183537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678199504, "uuid": "8f6ba29d-ad57-43a6-be70-8ea132b81163", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678199504, "uuid": "d037b568-dc9b-4fd1-ac45-860051ef3000", "value": "937129_022_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495271cf-bd15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678213464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213464, "uuid": "9d53e8b1-9992-47fb-9636-7133bef59222", "comment": "Malware payload (Mirai)", "value": "c4f86e27af9c792bbf15d50e8f352e9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213464, "uuid": "585efece-7f66-438d-9f70-ba9b481522ff", "comment": "Malware payload (Mirai)", "value": "fe659dca64f287d2d86bdaf52cfcefb71ccb2b8e6577886fe987348ca3342ed7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213464, "uuid": "7e0a96ad-09da-460d-bf49-40ffb464c0ef", "comment": "Malware payload (Mirai)", "value": "79c9141e86eeace2c85726b02c64bb37b4ee5e81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678213464, "uuid": "5abb3528-48b5-42a5-b24c-65d31c6b3e1f", "comment": "Malware payload (Mirai)", "value": "fc1e0b21fe21c9df6deae1aa823a899051756243a790bb52dcca9afc7f9251bdc6f6a23ad64477ced735785ae1e7ef07", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213464, "uuid": "ac20fdf3-140f-4200-bfbc-9c233da51b5b", "value": "T18ED3B60D6E159F3DFF99873487B7CE16AA4833D63AA1C442E15CEA415D6028F240FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213464, "uuid": "6ae7c666-fa68-469c-aeab-56a4bd893ebd", "value": "3072:Z/2X/vrYH6ZSY5tBl8PgAmCoP7IQQbm7GDVDZCtsYi1NWvJdZ4FfZnOOfu08SaJK:Z/2X/vrYH6ZSY5tBl8PgAmCoP7IQQbmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678213464, "uuid": "a51c09a8-8b37-40e6-ace0-16410c83291c", "value": 138796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678213464, "uuid": "5c67d13c-d7d6-4607-ac0c-3eeeee90144a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678213464, "uuid": "df68a271-1231-4b3b-b12a-258c19ee02b3", "value": "uYtea.mips-20230307-1824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a54835-bd05-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678206861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206861, "uuid": "e997be42-510e-42dd-9a4b-5140650b4b80", "comment": "Malware payload (njrat)", "value": "2ab71ec763a28d078420eb668f682eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206861, "uuid": "115aea94-8776-4415-8506-9223301e99ab", "comment": "Malware payload (njrat)", "value": "feedf0ce6bd3277beb6c61ce041e1f7da8728399d3096ad8b635fcf1705c3531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206861, "uuid": "6df632ab-de1c-4a12-8dce-e1a3118fb6e1", "comment": "Malware payload (njrat)", "value": "8050878b77d1e536b7470e9c0c7390b2dce53bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678206861, "uuid": "da8c4398-e037-4eb1-a5cb-becacf2aa24b", "comment": "Malware payload (njrat)", "value": "0d23a33103aa2d6d555f972cb6dd9ed2c70590704f4e867ce248a937259d93eb5e89f0c041637e2e1ae8e70d8a5c0c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206861, "uuid": "320a0814-1d25-4186-b045-2cf53180b332", "value": "T179E218067BF94215C2BC1AFC8CB313214772E2478172EB6F5CDC98CA5B676D04295EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206861, "uuid": "6b4d3ec6-5684-41e5-8eab-eb4fe927801d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206861, "uuid": "4da80c99-d8c4-46b0-a6ec-09d8c45847e0", "value": "384:i0bUe5XB4e0X7OVKelKrvp2WTZtTUFQqzFKObbj:7T9BuCwelKPcbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678206861, "uuid": "f4360450-5457-45b8-9da9-cf654820b69d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678206861, "uuid": "bf074f55-32a1-486e-b70d-531467c4ab13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678206861, "uuid": "53288615-edbd-4816-a3ed-460f0195dea3", "value": "xdddZ7E7gtVd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72881c0a-bc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678161134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161134, "uuid": "c9c6ba05-f04c-4ab8-9896-f2e91bbbc387", "comment": "Malware payload (Mirai)", "value": "27d5819e45b7009eb9fa36e7ef424de3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161134, "uuid": "ff8bba34-533a-4666-9c97-6be4f2793a2f", "comment": "Malware payload (Mirai)", "value": "fef580e44b93445294fd7b3b67cc5373542ce40e8f477798def4ff8937dd9a98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161134, "uuid": "fbe74849-89f1-4edb-b798-78b16520b075", "comment": "Malware payload (Mirai)", "value": "c65ce88c2ed049da236e845afaf357c7a8c44ac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678161134, "uuid": "4aa04ddb-4e17-4fbd-85e5-6c120eec7225", "comment": "Malware payload (Mirai)", "value": "e4e89016693084072a9a1224dd6d3678241751526037486206ee4458beb013fbc42a65b58a08c984616a4ed9deace249", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161134, "uuid": "be1ebb3a-ab4b-4c90-820a-3af98d69949c", "value": "T17C82CF3011AB75E9DBF10431FAAECEC697160BF8D1FC36E31658AB78894600251F83CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161134, "uuid": "c64b0d13-c7ee-497a-b38f-c9661a7aa887", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMachymdGUop5h5la:6/V0P6+kom0tVAoNvm+to1cs3Uoznla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678161134, "uuid": "4c043842-ae95-4335-af86-54a146d206d0", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678161134, "uuid": "de4d8482-5610-4d67-8ee8-427e9e2a874f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678161134, "uuid": "c32c69c2-38c2-402d-8dd6-c09de18c85ea", "value": "27d5819e45b7009eb9fa36e7ef424de3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3131cd82-bcbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678176057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176057, "uuid": "7304d3b0-5050-410c-a02c-f142dea16967", "comment": "Malware payload (Formbook)", "value": "494dfaacbf7ed398218ca21c6a7eb27f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r23", "colour": "#BA246A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176057, "uuid": "4ef9f3d5-f05f-48a2-b04a-0f89325c36d0", "comment": "Malware payload (Formbook)", "value": "fefa8c6ef6331d4b932fbc04b108033a6b64fa6938b41135d6154ff42b9efa39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r23", "colour": "#BA246A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176057, "uuid": "1330341d-88da-4412-8cdc-8836b2960391", "comment": "Malware payload (Formbook)", "value": "f8affb404524c61456f217c880fd00360609af49", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r23", "colour": "#BA246A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678176057, "uuid": "55db10c0-c5fd-4d48-b304-6aa611195e4d", "comment": "Malware payload (Formbook)", "value": "986dc4791287544ee2d78f7281be2b78173527c300d6b4991be4dc7353cd972973d926789da3c9487f0f68a6f905ee17", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r23", "colour": "#BA246A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176057, "uuid": "fd8747a6-e472-47d6-aec2-845f2694a79f", "value": "T16EC4338654ADE492EF0E8B7E60C637798137B64C47CA70531EE36920282166D38F6DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176057, "uuid": "b3422508-fca5-40b3-9d5b-7fc96503cbc9", "value": "12288:3njUc3e4yYKlXiA20ZkyxYvqZY9GY+qxfTyMA:3QSKkA20yyH69ZBTdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678176057, "uuid": "69401b74-ca24-42c7-8101-af6d5dac4256", "value": 587135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678176057, "uuid": "a3cabfa6-9591-4b64-b9ba-9e2c00068c72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678176057, "uuid": "680caab3-854e-400a-9793-889df972c0d8", "value": "new order list.r23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9435c7c-bce4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678192687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192687, "uuid": "605ebb4a-6a95-49e9-8edb-be0a15909d57", "comment": "Malware payload (RedLineStealer)", "value": "ca95b7602c5ec98aa9b686514dec06ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192687, "uuid": "4b64d0e5-76d9-4601-bd8e-18d5d1dea008", "comment": "Malware payload (RedLineStealer)", "value": "ff09a98f202feb3424cbc314292bc0ebf41e307acab47156944e16f5899435fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192687, "uuid": "4b303a62-bdc6-4bc9-bc22-a514fd6a87c3", "comment": "Malware payload (RedLineStealer)", "value": "3acbc1c92890552691ac5d672ddf799882508f89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678192687, "uuid": "1e799d4e-58e3-451b-9200-e5df0052d20c", "comment": "Malware payload (RedLineStealer)", "value": "279f27c8ad64dd58237b9e78a359a78665764705a1d5a6a13fe70f378fbec228ef51e5b262162277bdd4d22b7cf81272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192687, "uuid": "6c7cc856-97a6-487d-a3f7-2b81e3676729", "value": "T13F74F121BBD0C0B6D6AB19705935EBA01E7FBB721224755B339817BE0E302D19A76F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192687, "uuid": "7c355d6d-d080-4c56-8aa8-17d1931c0cab", "value": "edad5341d4cd5645dbbd9128c7d92249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192687, "uuid": "9d2c01d6-eb38-4399-9f99-edb48a4a6811", "value": "6144:w6LFsYeFLjMHUdfAEhVG5AvlZad1nyBCIyloy8OMNb:w6JsBFXntG5UZafyBCEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678192687, "uuid": "802ffd6a-543c-427b-bab3-5b614f1b6e53", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678192687, "uuid": "650d6742-d549-401a-937b-981e16e2408d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678192687, "uuid": "ed5121bc-4f46-4f51-9b37-907c11841f29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15fb779-bcc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678180218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180218, "uuid": "c4e94de4-b725-40a9-a62c-1bcd9756038a", "comment": "Malware payload (NanoCore)", "value": "e268b3e2ea0c4dbe8e3378e8c740505c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180218, "uuid": "16b8eb93-7696-4918-b37c-1be478663efc", "comment": "Malware payload (NanoCore)", "value": "ffc0d656f87a8cd4ca271e5ae5789b27dcc46ba7ea2cacbf5b68b055c0b51ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180218, "uuid": "d4e86890-71b7-4d27-8d98-8addabea64db", "comment": "Malware payload (NanoCore)", "value": "82686ab008207edb6fc2c9e5212f79e9dbffe2f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678180218, "uuid": "7585f564-690a-4939-abdf-33272fe36df2", "comment": "Malware payload (NanoCore)", "value": "0597b32b8b4b474fda553eea9f5c87d185cc40ff235cfc5f07235a6a32f90ebe417ea3d29932e04fb981558782cd87e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180218, "uuid": "85d518f0-4d5f-43e0-9c90-e68e4bfb464f", "value": "T138F423951398907ECABA83B6583213501270F211E547C76C3DEA71DF2DE3A879372B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180218, "uuid": "1763e1a6-e246-4cbc-9de0-5aaa5c580d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180218, "uuid": "139b6c2e-086c-43f5-8e2b-749fb7105d11", "value": "12288:MM6xLEOj+xK2kMMUVxoaD86f51vi6I5Vjv8T7GdalA4+Xraw+K+y:Mdn+xK2UUYyj8sT7GkqrL+Xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678180218, "uuid": "ab9b92de-834b-4974-bfd5-38704996a3bd", "value": 761861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678180218, "uuid": "0b1be8dd-a7f9-4bd9-8696-0bed40ee5605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678180218, "uuid": "7e808e32-877d-4aaa-a95a-5b3f1f19c7f1", "value": "FFC0D656F87A8CD4CA271E5AE5789B27DCC46BA7EA2CA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }