{ "Event": { "published": true, "date": "2023-11-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-23", "timestamp": 1700784181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8596dc55-0432-4ad4-9a28-1a687b88e6f1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f168e26-8a13-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700752710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700752710, "uuid": "df2502e6-92b4-4053-902f-dfe55fd8ba65", "comment": "Malware payload (Formbook)", "value": "ed928ac7b97076e19f3b2e384b655d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700752710, "uuid": "fb368833-2108-4195-88b0-e1a895a6a4a2", "comment": "Malware payload (Formbook)", "value": "01c08f7f6e5e5b8056c649e8b0b5bcdcb47835323bc393bc2582f5cf720ba437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700752710, "uuid": "1ca0cb35-cc27-4395-8c66-fa09c975399f", "comment": "Malware payload (Formbook)", "value": "1aa73ebd55d57a841aa27f71f055d41985d4ef80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700752710, "uuid": "3dca49ab-7ea0-4eeb-8a4f-8caf9f970961", "comment": "Malware payload (Formbook)", "value": "b2bae545e653a2717c45e5149498b8c5c655b7963a20126f8ebb61da413d85dcac81c430d12b2ab74a7f79050ed3ff12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700752710, "uuid": "ff428fa9-6c9c-496f-a5b5-6ca928c2f809", "value": "T154F4010473BD5F62DCBE57F68460610103F6A8BB687AD7998CC6A0EB1672F011E52F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700752710, "uuid": "4047959b-dcf7-4a0f-b441-19aadaa56c0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700752710, "uuid": "76daf3b5-e217-4a84-b303-72a9f0d971af", "value": "12288:01CFJELXGkJlIZe+PZxrRI9f0NZS2DCqmh4+Q9GXaLLH500dTdQh8iMCeDy:01CFJQ2k7IZPPZxrRcfKDj3JLL609SuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700752710, "uuid": "0baf2ca8-93e2-4e16-86dc-a85a64538582", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700752710, "uuid": "6d4b7634-7980-4759-a790-f401e052552d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700752710, "uuid": "f672329f-b06f-4583-817c-c872a15bcf34", "value": "SecuriteInfo.com.Trojan.Inject4.59820.2004.30481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c007416-89e4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700732545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732545, "uuid": "21d82f7c-1a46-4e50-be95-5c53e9c51410", "comment": "Malware payload", "value": "d67acaddbe44a3febc3348f75a22888d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732545, "uuid": "2aa22a55-781e-43d6-ae01-84b6c1e4b550", "comment": "Malware payload", "value": "03a83e440c0d1d8f9390f8edf180c54aa4111a39c2b00a05650e4d47e613c754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732545, "uuid": "c0040e9a-ff76-4bd3-ac8a-79adf496d615", "comment": "Malware payload", "value": "3be875b32727db74827d630c042b2d0be5b622d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732545, "uuid": "d2c699de-6ec4-419b-9e03-10ef21608704", "comment": "Malware payload", "value": "f0ef382103e240009d1ad7566e4d4926be69e7684ce44fc98121fac0c89db4cd9c76994d50dc01d6451bd199073bae5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732545, "uuid": "432915db-e524-4005-8553-ba5e61d3eda2", "value": "T1DA546C1352F1AC61E6274633AE2EC6F4A71EB8708F557BAB33156E2F09701A2C572317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732545, "uuid": "5c365b50-c3a3-430e-995b-e0d801830120", "value": "23014caea44efcaeb50f542fe1b4a832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732545, "uuid": "51d46d68-a7df-43aa-9475-93da25b32842", "value": "3072:nX0N0TTuUimSJFE4GGnTDUSMdxYw5YX0xpqopUTcIxAoUvt1Zq7:XxTFSTfJnMSMsBkxpFWy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732545, "uuid": "f6311b42-54ec-44d2-a179-39a934538e44", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732545, "uuid": "7bec7cdf-45fe-42ee-83c8-fffa1d96370d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732545, "uuid": "f123f485-1db7-44bc-9d32-55b3d77b9f1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329b54a0-8a1c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700756420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756420, "uuid": "aaed8edd-33dc-44f5-8ca5-d41b5f6a178c", "comment": "Malware payload (Formbook)", "value": "4b21506114b2112fc11de3efe27c6e33", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756420, "uuid": "f8599352-c6bb-4825-967c-75f766629aa9", "comment": "Malware payload (Formbook)", "value": "03c36bc1893424c6b685c8c66b639656aee9006ef5ff0cc22ca8d2530e90963e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756420, "uuid": "68d7f666-14be-480d-80c2-1cf82ea8ea7d", "comment": "Malware payload (Formbook)", "value": "c3a07ab755477fdfc995a78c0d8c18a24807194e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756420, "uuid": "7f74ad8e-aee1-40a7-9251-b1a28fd336c3", "comment": "Malware payload (Formbook)", "value": "d53d50754fe57259c2e1b519c0432bbcbc80d0d73ab7f3d652655dac65a6f1fc00fb086e26c7853e0f06e1691b15ecc9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756420, "uuid": "4be3d24a-4323-4d4c-8fa5-dd018c8f7e86", "value": "T15EE423A993C46E6D43F485AF98DC24A9FC94CD653B70C65312DEE3F6193431A2EC8D28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756420, "uuid": "37113d8d-0e57-4682-9418-ec56b5a00fc3", "value": "12288:Ukl0uExyu2Ssjl4DJu18ci1HclKRdfZ9Bt05GL0BhfoOE7VHjyJlXZ5B2:1RjaJKc8oTBWI0XfEFjyJlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700756420, "uuid": "b70995e0-5aa5-44cc-8a7e-272ded85c72b", "value": 692003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700756420, "uuid": "29f2582a-6a5a-4210-8fe3-2d6954ed80e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756420, "uuid": "de4043f1-6c76-4457-bd0b-da3eae6f598f", "value": "Confirm!!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0594cc83-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728857, "uuid": "9cabc06d-ac41-4ca6-9ddf-b49fb2489092", "comment": "Malware payload", "value": "3963ca541cad81c3beaab569b08854ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728857, "uuid": "eb92a755-36ed-4fa1-9417-05fe1c80cea0", "comment": "Malware payload", "value": "04578c857ab87eea8ca14f2574ede759704c14ec9865af095232ed624c9128ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728857, "uuid": "105f17b7-ede4-4e9a-9d0d-9184dc695dc6", "comment": "Malware payload", "value": "10a69140271429687927f44f7cb46a7eb3420539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728857, "uuid": "3f88c386-9127-4753-9228-0665553b0a76", "comment": "Malware payload", "value": "7bd871b80ae20ebb9660dd4a325cd644957dd0f77222893de9c02033c9bef4bfff886319409e97621e737834b3dd9932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728857, "uuid": "3c91ad5f-07e5-4406-9728-7ce0df0c6325", "value": "T1E925330426EAC513F4FA6735757483F212B5477B1530590E7E983CAA7F32A926F0B18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728857, "uuid": "f68af0b3-94c9-4d28-9c2e-ebff91407a07", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728857, "uuid": "bb6b9eeb-bf17-472b-8860-fbded20a9f6c", "value": "24576:ZNd/lgLUeFN7nhv5yYvCxBHv8SZDgsw91cskhx3:HQLUY7nhvo0CxBEwu11E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728857, "uuid": "ac9abbe2-a00a-4deb-8168-7e75c25ed606", "value": 1034472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728857, "uuid": "ccabf485-7a71-4598-be33-5415e7c58f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728857, "uuid": "cf77a781-6242-46c2-a9ed-6def73dcc832", "value": "Documents_REPLY_23.11.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952fdda8-89cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700723514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723514, "uuid": "6fbbbb20-84f5-47d7-91ec-7a8e1bb11959", "comment": "Malware payload", "value": "c5299ec4217009313ccf3ae5489ef514", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "custom zip testing", "colour": "#E844D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723514, "uuid": "d40b3d40-a1d3-4307-b1c8-cf0111437baa", "comment": "Malware payload", "value": "04702e94785f87904b222753af1b9e149c07d578ba6f5a97e84353dd10f1ef8c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "custom zip testing", "colour": "#E844D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723514, "uuid": "d812c8f1-cd74-499a-ac79-6ab677a8dab6", "comment": "Malware payload", "value": "2f150a4a0220c1bfe833fd76f501c3845de31585", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "custom zip testing", "colour": "#E844D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723514, "uuid": "70b1ebad-3cbf-49f7-9504-809b07c1801b", "comment": "Malware payload", "value": "057c8b5962fae6e7ab24487575a2df8c6923cfd9e8269f58fa87b06e6e071eb9635b92413a9a7235e1d039cde595aea7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "custom zip testing", "colour": "#E844D0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700723514, "uuid": "00206ede-390c-420c-b08c-ea5d1ae8a198", "value": "T1925533956A8DE0279392EBF6A6E64EC743B56781EFD718492C4003F1DA04EA493F93C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700723514, "uuid": "4ca23f52-189e-4a3c-904e-2d4edfee6964", "value": "24576:fgyx+JB7V5jTv/2pOBaqWTv9sanv/o9ijsE/TXV0rjBq4ONPzI80X0nbH:fgyAn3e0aqWLFXo9VQTqXEXy8C0nbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700723514, "uuid": "4df7a1ed-7fd0-4457-8708-84a69e3094a1", "value": 1296095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700723514, "uuid": "7856e109-0db3-4517-8172-3a36bff81bdd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700723514, "uuid": "8e543494-727c-4a1b-b9d8-3b8ac0231e9a", "value": "orders2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df8a7ca-89ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700722885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722885, "uuid": "ba3043ba-8b64-4f38-a456-688e7b92c2a1", "comment": "Malware payload", "value": "13ff731ad7bb2bf910e1559cd483d563", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722885, "uuid": "6509f85e-f2ef-46a9-b620-a2142e288a28", "comment": "Malware payload", "value": "04c7f33a861a0cc5787e6659cc38eb708e4d97c9cbec707d5bc2d05d67be5254", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722885, "uuid": "89af9a28-5998-466b-8a15-0d9c3a1abb3b", "comment": "Malware payload", "value": "adae718bdbb4476d518d621f1e7acf909d28f2f0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722885, "uuid": "7797d27d-3b77-4fd7-9822-83f99f58c531", "comment": "Malware payload", "value": "86af4efaa715fdaefb3c14e9609c346f57e770ded5d751c4b5a3eebb4dbea44bd3c2c2fc0c5d394e7f6b859ab4a1265a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722885, "uuid": "7fe1e7bb-ec7e-4d33-ae08-203fbe431e41", "value": "T16276E000B6A0C236E9F705B68EBE92799579BE71172490CBB3C40A9D5E706E1BE31317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722885, "uuid": "4a0c67cb-385b-4803-8a29-936b3f806897", "value": "24576:GBudSBeZ1aJ4kyOGXv6dTpsb0yiOQdJDWnkKl/YoTyi6+AErFl0FWELgJYy3Sbvk:F82DOU6dTiYyzQdXolK8JYy3Sbez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700722885, "uuid": "8e284f2e-980f-4497-8806-8b5cdf7a8aec", "value": 7340544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700722885, "uuid": "9bdd867c-34f0-48b7-9ef3-4e140cba3cc8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722885, "uuid": "80ff9a71-dec1-4d7e-b3fe-a2c8906a067b", "value": "orders.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3d164e-89d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700723932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723932, "uuid": "6e72ae45-5acf-41dd-b05b-18c2b70d9650", "comment": "Malware payload", "value": "7d02ed9dc788d83eda33765429f6153b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723932, "uuid": "e58fcdf9-83ef-49de-94e8-09a9c8fc0c4b", "comment": "Malware payload", "value": "050911a110ac28febeed469ef59a6e60a90982c64ce5c33fbf84aeb3d7a98689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723932, "uuid": "5087485a-8d0a-4d29-acdb-d06bc2406ed4", "comment": "Malware payload", "value": "c565abeaa62dbe2ee3b6c421716be998fe5879a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700723932, "uuid": "3e7c98e0-a9fd-442d-83b9-de8ce14f18fd", "comment": "Malware payload", "value": "5554ce556cfa97c471bd526a5e92ffa645cc188504b20d567fa495fd0a28fdd22b97b2f1622d92df994bd69e3440ddb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700723932, "uuid": "5d73644f-a178-4b29-98ce-1405444ae835", "value": "T18D546D1393F26C61E9234B73AE2EC6E4671EB8704F59679B3319AE2F09711A1C563313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700723932, "uuid": "7920c997-811d-48db-b6ee-60b1bb896838", "value": "37a2e081016677c458593140198e6db3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700723932, "uuid": "df449f44-7b07-4a2f-91f6-6ebdb1edf6bc", "value": "3072:yHsnPE8QA44iIcDR51dZl8S2WoZRMHX3k08ni0rwUk0Y/UPvt1Zq7:Kn5t4LcV5rz8VdZR6k08nfUZ7A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700723932, "uuid": "9986dbd3-fe96-4f6e-a386-e91fa87ee27f", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700723932, "uuid": "e786d5ea-4b5f-4904-bb7d-a94e6a58f9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700723932, "uuid": "8b7aead6-de86-4474-8a8e-90889a2d5436", "value": "7d02ed9dc788d83eda33765429f6153b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a010e5cd-89d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700726969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726969, "uuid": "3c12cfd9-b631-42da-bdec-74d185f3c32f", "comment": "Malware payload", "value": "58792f0c0962965195d6036c6112f897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726969, "uuid": "9677a07a-01dd-4fcf-aa9e-424a93442e08", "comment": "Malware payload", "value": "050997795368951d33db12913ca5626194f0ae1aec1725998558d79559db6b14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726969, "uuid": "eaca337a-a68a-4589-b075-d044d259b167", "comment": "Malware payload", "value": "020067b54db5b66c35461dfa1324427303850cb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726969, "uuid": "579e90b9-e3d7-432d-8662-52727e3c74eb", "comment": "Malware payload", "value": "7a5b8b437f4666a34c05ebdbbb881f4183e6690e1db8add1db545902b0680ed4bca525caf5bae241cb7583f87b56cc5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726969, "uuid": "f6b6cbf6-30a2-494a-9523-9697f8a4daa2", "value": "T120546C1353F16C61E5274633AE2AC6F4771EB9708F196BAB33196E2F09701A2C663317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726969, "uuid": "f6149d5a-405f-4905-8265-8f20a9fa30c4", "value": "37a2e081016677c458593140198e6db3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726969, "uuid": "3ff51f8a-17ab-4784-b8ab-387a2e5b8354", "value": "3072:BHslPEcQAUbhb3ADTF4oDeu3qxDzt9c1llEONAzKkG31jMQS6gVUTL/mYY/yHShI:tdZDbhrA32ue9xvIllEAz3WQsVe/iV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700726969, "uuid": "884cceb0-0f66-4908-a2b9-eaf4272dcd5f", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700726969, "uuid": "0caa982d-651c-442e-9f35-22b27ded6dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726969, "uuid": "8694f7f7-f1cb-4495-93e2-3547b5f22a0b", "value": "58792f0c0962965195d6036c6112f897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f349c3-89a6-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700706009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700706009, "uuid": "fea84f81-4553-4cc9-be31-f9dbf04c03c8", "comment": "Malware payload (LummaStealer)", "value": "bb4d41b26d70a77a1c888b0559f36c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700706009, "uuid": "06f72605-c542-4f0d-857d-b305e9d56abe", "comment": "Malware payload (LummaStealer)", "value": "0557de477289cf8eaa48791ce52eefb3f922193b0d6d0d1502b2484da6fc94c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700706009, "uuid": "17bed0dc-b895-48cb-952c-1c65606bf406", "comment": "Malware payload (LummaStealer)", "value": "2806d68916c09fc5bb3342c18c2a9660b7ba6958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700706009, "uuid": "3d58374b-e974-4d12-b7e8-ed0782bb004d", "comment": "Malware payload (LummaStealer)", "value": "abf99fca9069a3aba3689eb9a91fe863de55f7b2ae0cb9a355f3d60c399ca99a1c12110721ff7f0112acb0a4bc6473d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700706009, "uuid": "4c875116-376c-4940-a293-4805a14f8e64", "value": "T14C06CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700706009, "uuid": "020eda61-de7c-4ce0-b8e3-2def6b9295d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700706009, "uuid": "b3facc8f-feb2-4dc6-a636-3e9a726a5c0a", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYx:8AqA4bNMAeLVdWRC9bO2IyOnhJYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700706009, "uuid": "c55a9f0d-d1de-45e2-bb2a-678747ee2063", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700706009, "uuid": "184ec95e-f300-4362-88b3-a0a220afdb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700706009, "uuid": "906d4d99-1e6a-4fdc-9b2c-c965fce794be", "value": "bb4d41b26d70a77a1c888b0559f36c88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70b62e9-8993-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700697882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697882, "uuid": "e56828af-fe61-4271-b4f9-2846f0b09103", "comment": "Malware payload", "value": "fa5736226d0ab879975d4d1a84eb9e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697882, "uuid": "2df0dea9-8445-4d43-9310-c326ef95d787", "comment": "Malware payload", "value": "05de2d8d50facd5b686a680c7445f9218726cc1e61a74ceb625fd469acc525b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697882, "uuid": "907a50d6-00fd-4f2c-9e79-348e6cff984f", "comment": "Malware payload", "value": "69ea6fb0bf6a3181bc9122456058b6840012a9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697882, "uuid": "6640b801-2f3d-4af0-a0d1-ec44a03b2615", "comment": "Malware payload", "value": "a09a8cb4dd631e99a049ec99521baad75b2c2145d865c33ded484674ccb8e18747ecb09a211c9abc469b9f22a7a4c41d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697882, "uuid": "4b2c1149-2efc-4f30-8c8c-29aa3f9af05d", "value": "T11745E122F2D14837C1732A349C6F52A85C39BF007E28B98A6FE91D484F397417E692D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697882, "uuid": "a78e707b-4949-4071-bc36-3713b3fa80ff", "value": "7a84276b96c31a84abae28b74ab371aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697882, "uuid": "e8bbc768-c2b6-4c45-95fb-4f0f0bae91ea", "value": "24576:55r7mNJG//19XnGJXQaXlubv9bNVyvg3EfzGr:v2OnLWQiu9bNVyIuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700697882, "uuid": "98fa6eb0-06c1-4708-95c3-809839f95377", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700697882, "uuid": "77d5df43-efd4-48d5-962b-66e334ece3f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697882, "uuid": "3720c073-eed2-4f5f-bcfc-d43a0fdc6692", "value": "\ud06c\ub9ac\uc2a4\ub9c8\uc2a4\ud2b8\ub9ac(2)(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdd38d8-89f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740471, "uuid": "bba84e8b-6a09-4348-9c88-08403e197677", "comment": "Malware payload", "value": "f022232b205a9e9c7e6de855cf225b70", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740471, "uuid": "070754bd-045a-435f-8246-b35a02a0c89d", "comment": "Malware payload", "value": "0645bac143ce394d53d9a7ad0d0136a6194e8e496119c81f898c3dd06fcb5260", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740471, "uuid": "2f982cb3-0627-4403-ab1c-1522e67cc1e0", "comment": "Malware payload", "value": "7b420c43022146b33f8ab9f74f7296621644b74e", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740471, "uuid": "8337d5bd-c53b-4ce5-a7ea-5c6634d07cc5", "comment": "Malware payload", "value": "a4edad122c9746e8017359ca5b63b0b5273c83c678b13ceb53c2ffc6578d17e9b6969ca49018ba20c29950b03061f836", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740471, "uuid": "a98829c7-b1dc-481c-8219-d189125cc157", "value": "T11276E100B6A1C136E9F308B68E7A966E993DBD70172490CB63C41EAD5F706E1BE31717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740471, "uuid": "a13c264f-776b-4c8c-ad49-1e73c7ed1429", "value": "49152:LDdjjOeXjZxg6K49VQpKwuaVWpBXbX48JYy3SbKz:LDdftX1xdK4cMbpBXbFJYhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740471, "uuid": "2bbe43f0-67a9-4366-9195-4a3f2a1e12bc", "value": 7340544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740471, "uuid": "6afdbe79-4f02-4131-9f63-631b1f24a699", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740471, "uuid": "7d28ce40-004c-44ff-9a63-3f89251cd3ad", "value": "service.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d291531c-89fe-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743804, "uuid": "f1014818-284d-4b77-ad6b-f30c820fa746", "comment": "Malware payload (Mirai)", "value": "0e34e37c011db77f89cda03ac369ab86", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743804, "uuid": "19be8a74-d44c-4e42-bfb1-d3c16c052365", "comment": "Malware payload (Mirai)", "value": "06cf553390449aea2acd0faf2495b1a4ea1eb5d36e682459692c3c7a4bd2217c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743804, "uuid": "9821c870-cddd-4d0f-82f4-fe0785c5f275", "comment": "Malware payload (Mirai)", "value": "2b4345b723d21e7f6deb046190c128117992299a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743804, "uuid": "12b52310-b869-42da-9f9f-3d53d3044965", "comment": "Malware payload (Mirai)", "value": "d73fd4d6c7b997e853b29431a94120d08c054c8d55c76d4d334de75e02f43465afd5fc320e5f0e3215f50c2cd207a7d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743804, "uuid": "1959b639-2930-4e38-81f2-2e73cc432e00", "value": "T176C2E0AF76A96A67FA5C633DE035C01F0395F12CA7AD6B8B57404032E98E41D7931CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743804, "uuid": "a1781d6c-7eef-4a48-8f06-d0e8129b799e", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHmv9qw3:RMwxdyoEUnDz+Y8tqHWXmGvowr0Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743804, "uuid": "c2f3060d-7b9c-46f8-a74d-f472cea23d86", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743804, "uuid": "5c79640c-a647-4982-88a4-6686973c4a9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743804, "uuid": "c4de138f-1785-49b8-a734-deb5c1d6938f", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbe85b8-89e3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700732198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732198, "uuid": "654f3ec7-42ab-4489-bc87-75ee7f159577", "comment": "Malware payload", "value": "99abe469d11bffa5b926c697ccda0257", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732198, "uuid": "c70657a4-6954-4ef6-8f4e-7d16f7499b1b", "comment": "Malware payload", "value": "075f48cb052ea8544c7bbbe76bb6d2ba65fb0bf1a4a3e58c1692430123f30137", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732198, "uuid": "55ea51c0-6c9d-4915-a70f-fcd1bb606bee", "comment": "Malware payload", "value": "7c8cadb968ca349196fac5dce91042d0f491b5b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732198, "uuid": "0a5cc8cb-a1cf-42e5-9f02-3c719989b2a9", "comment": "Malware payload", "value": "d6e681774cd73d487557d0bc56058f8faa874332dd416fb09d8b314a9fb768aba750d1b704aeaccb625f291fff244aad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732198, "uuid": "8b2dd8ab-ac2f-4d6e-97b2-bdec4a5cf1db", "value": "T116F0202B805F62035C1B88B392F08B2163232444573C8EC171F18064EC16FA3CCB6D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732198, "uuid": "1a003f76-fa24-4da5-a43c-624e7a57e835", "value": "12:p3emWIdspp9qlCzzjMuKDfTD0/RjMI4SGPku0/RjMI4SGPk4nX:0KS95zzouKDfTg/RoI9/RoI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732198, "uuid": "37c747d6-f760-43be-b451-cbbb33d2c66e", "value": 539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732198, "uuid": "0199e5b0-c0a1-4ba1-aeab-3ac0937f9344", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732198, "uuid": "4ac41bbf-e4f1-44fa-a9ec-87288ea4cfac", "value": "transcript.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5347700-89d5-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700726118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726118, "uuid": "729638f5-6351-4ddc-852d-4867f7f5fdbb", "comment": "Malware payload (NetSupport)", "value": "31ad769e886e84be8ba35cb076ef523d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726118, "uuid": "8e430385-b87c-4da7-a26d-6349c161e4e6", "comment": "Malware payload (NetSupport)", "value": "0860dafaa3db5f440b61cea445c066dcbad2285512eb2962236ad1a8366bf527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726118, "uuid": "fbb9c5ff-7875-4bb2-b6c8-b8a5d9c70ed5", "comment": "Malware payload (NetSupport)", "value": "ca20f2848ce8824c769fe5e9b823a87ee7c6d11d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726118, "uuid": "b037e619-4312-46a7-bc96-dc3c8c46a93b", "comment": "Malware payload (NetSupport)", "value": "378387f1066c8fe419f2b5992d29c28bd3605f89034f0e2c5f10bdda5c4fa11868d4ee66b2c58597f60fdbe289c7483d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726118, "uuid": "a9716e4e-1fce-4eb0-b25c-b8b9da52700c", "value": "T110A52201F3C0CCF1F1222433B972E618A67C79141AF985BFA39C2559B9361C1A6F6E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726118, "uuid": "85e39a50-1f46-4ff0-aa6c-ff61cbb42606", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726118, "uuid": "6dfaebfd-cc68-4050-82da-1f8f9e50745d", "value": "49152:Pe2YDJkISrSzXcW5FLEg95FnkLl6XVQsZL2UvMSvWNEh+thP4Gzg:PxEkISrmXcA7p8l6GKDTIo+tJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700726118, "uuid": "12e3b5b0-ff07-4bf9-83e0-f113db019b94", "value": 2160357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700726118, "uuid": "182b6fb4-54ba-49c7-8196-88bae56ae3f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726118, "uuid": "2875a239-fdcc-4273-81b1-5cb76e0b429e", "value": "31ad769e886e84be8ba35cb076ef523d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886708dd-8a42-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700772885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772885, "uuid": "317d8266-85d0-4f11-887d-c5ae1feff7db", "comment": "Malware payload", "value": "c61db2f5848ec54d1924394297506dd2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772885, "uuid": "5d44587d-c883-411a-9583-fb5d098b2483", "comment": "Malware payload", "value": "0871d9b367d3389e5014dd779a51a29c0f6f8fea47365f38ad06696bb6a99101", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772885, "uuid": "b44651cc-973e-408a-860d-e89cb148b3c1", "comment": "Malware payload", "value": "134f707171d92418773f68340c7a9f33af5a53bf", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772885, "uuid": "fca9e22f-24f7-4911-ab7a-ae3f3137a4a7", "comment": "Malware payload", "value": "16a7c5073164257821c7dfc05027ead40e4ed18a9217337a8ea36c379619095a862d37ac20b00cf9ac191563d48e76c8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772885, "uuid": "754f77f0-6818-4eee-b17e-f6fd8902839a", "value": "T187335B42FA83E2F5F86300BA1437DB326B32E4331416DBC7C765693AA9A61A1D71335C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772885, "uuid": "62467632-439a-419c-8bae-9233c9ff9ff0", "value": "1536:wN9TSHkoZmvjx0pob5HE6oW4qE6p3FoSV:wN9TSHkoZmvjxcoNEzCpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700772885, "uuid": "0eb05c58-b7ee-4cc9-9d77-7fba2a0c4367", "value": 54160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700772885, "uuid": "28e2e3d8-17e3-40f9-8f73-0a042eabd776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772885, "uuid": "479e052f-fdcb-4e3d-a326-1b0be1b856fd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fb20d4-8a02-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700745370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745370, "uuid": "2c0f9139-239e-4d2e-b445-d4579450fa96", "comment": "Malware payload", "value": "fbcbfe33cc9d29566ce2c0a4021b54fb", "object_relation": "md5", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745370, "uuid": "5beae2b6-f244-4f2a-99bf-a35db8e26f56", "comment": "Malware payload", "value": "089573b3a1167f387dcdad5e014a5132e998b2c89bff29bcf8b06dd497d4e63d", "object_relation": "sha256", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745370, "uuid": "8fb1b3f4-8eaa-4415-81e4-f696efe709ff", "comment": "Malware payload", "value": "dde44c91e9394b97a6d18f5b13031e2399853b03", "object_relation": "sha1", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745370, "uuid": "331826b9-d59b-4390-a82e-ed60cb145efb", "comment": "Malware payload", "value": "5aea51053a88678eab85094e66a673ea1975fc8d417f0696e9f4d8f1e86b759a2e8e095e443ca6b78ee12795ddcb9a52", "object_relation": "sha3-384", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745370, "uuid": "ed86b8a4-a1cb-4cf6-b481-8823017278b6", "value": "T102F412C41ACDD884C16F4A3C792D491DE36D4D3D62251EEE94E768AAAA33C507FBD803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745370, "uuid": "2c88cd01-32bc-4821-8d2c-857a7563b3c4", "value": "12288:UkMZsIXIiddST/ripBEBL0QX0EQBYnkFA5AL2AG/mYLRf18SE3i5OnsfG2Q98vjP:UTZsIXIiddSTDipBEFbX0PQ5AL2AG9LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700745370, "uuid": "d82e2ad0-314d-468f-b454-7ab47486020f", "value": 732543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700745370, "uuid": "391c0c0c-230e-4bf3-a66a-d2d9076f2170", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745370, "uuid": "49ffc60e-4842-44ea-9278-238cb415badc", "value": "cl202966126.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d05173-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700724314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724314, "uuid": "b676a9a0-30ac-460d-8587-71b113ae1fa0", "comment": "Malware payload (SnakeKeylogger)", "value": "92ea59584143492a9997cb726c50cc2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724314, "uuid": "ec2e08cc-c4ea-476f-b0b5-b840452584f8", "comment": "Malware payload (SnakeKeylogger)", "value": "09f3ffc4cf39c48f84b8eac7c29a49f9c1c576fd7c804a18374ee0e93d69bc37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724314, "uuid": "76ccc37a-ed6a-4c04-9055-26e9b3345a76", "comment": "Malware payload (SnakeKeylogger)", "value": "e921858b54293bf976396bfe4ab73fd5dfe6db1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724314, "uuid": "3e64e647-4c95-48f6-b5ac-d100d7d9e86f", "comment": "Malware payload (SnakeKeylogger)", "value": "2d16e7e4f206b2d9653ce9b7c404f4e7f54784af09f12f1e1337e07e8c6d7ba528f8450b17e24b46e3a4525efefda49b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724314, "uuid": "7592d835-afe4-4a44-b1f8-bfdcf2a93c3a", "value": "T1C3359D14B2A68B44F57CC3F440925092A7B47C9FF25DCB8B8DC779DA3970FA11909A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724314, "uuid": "fdc4b3c1-5e19-42f0-bcc2-b19fdc15f213", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724314, "uuid": "837e21cb-6ffc-470c-a933-6de80501cb20", "value": "12288:fFNlzMJr5jdij0pkTiS4+cN1283rsnBACiTt28yNa3yagV:tNlzMTjdu0MiS4+YTABAC4t3MafgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724314, "uuid": "1e694b28-92bf-4a57-a567-1c6a0a41f65c", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724314, "uuid": "f8c794eb-ec56-45c4-9376-f948c1368fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724314, "uuid": "57e28ce2-e3e2-4198-9098-566acd012692", "value": "Quotation No. 001515 & Quotation No. 001518.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ad4671-89c3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700718309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700718309, "uuid": "fc708f64-8aa5-483f-8b51-c330ab980a8c", "comment": "Malware payload (LummaStealer)", "value": "68c57b5b87864fd9a89b77b4b1e8e33d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700718309, "uuid": "d779efa1-9337-48b5-a135-99f136be77c6", "comment": "Malware payload (LummaStealer)", "value": "0a999f8f8064171ed32e808754c84570cdd517355a0086a8ec988c2619ea6727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700718309, "uuid": "48599fab-776a-4649-b8ab-b8bb065a001e", "comment": "Malware payload (LummaStealer)", "value": "f161f8be149630e1f40e01a61e0d1f63848a3f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700718309, "uuid": "dccdee08-8062-445a-b9aa-aea5d9e5b795", "comment": "Malware payload (LummaStealer)", "value": "17168f679e2dd7f2517820426255578c6e04a325be701f8d6ff9b97a58a9a54e051ac53bc15d5aa4f5533ffc263c60a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700718309, "uuid": "ccae28ef-c5dc-4f03-8261-ffc2b882e9b0", "value": "T1C406CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700718309, "uuid": "d89b010c-872c-45b9-8501-cf8205efaff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700718309, "uuid": "2bec05e3-c5ec-4e7b-8002-b95989769d88", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYH:8AqA4bNMAeLVdWRC9bO2IyOnhJYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700718309, "uuid": "b9b65e14-4eac-433a-8b6e-aca30ccf7365", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700718309, "uuid": "acfe07d0-15ba-4a9d-9505-4ac259e43099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700718309, "uuid": "a3e608ac-a62f-4296-b741-f2c897db43af", "value": "68c57b5b87864fd9a89b77b4b1e8e33d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb309c9-8a31-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700765406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765406, "uuid": "4d54faed-358e-43a4-8ed6-d8a1c5bb9352", "comment": "Malware payload (Mirai)", "value": "8fafb79e73ee95f9ffe0228259e5caec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765406, "uuid": "9764da48-e126-49f0-b5b2-e67f54bbb84c", "comment": "Malware payload (Mirai)", "value": "0b2ed52650f25e6642d1716eca1907e8e2cd8ff5cdaf7e1876d656d524e3b8b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765406, "uuid": "acf65100-7e07-4f10-a291-47b7b9ec1754", "comment": "Malware payload (Mirai)", "value": "6a3df57f61a5e3a321afe1be857ef2250f5545c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765406, "uuid": "e6c7d531-74db-448e-b6e9-f5af6ef08894", "comment": "Malware payload (Mirai)", "value": "349dc2c45eae17528d5c55c8ff63b8e0e5e7c8e872cf507ab299e466abd12881d12a798327baa91bbc09459298f3bcfd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765406, "uuid": "74ffbcb9-08c3-411d-aef8-492bc77cc62a", "value": "T11CA2D11163632D65E3ED1C3DC9AE9317F9A60BFCD0B6327569405630C94D24A3F39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765406, "uuid": "5be4ce1a-cd9a-4f69-9ac4-f155e3c78bd7", "value": "384:xvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjghymdGUop5hs:xvQn4j+ZO5fKAlxMs3Uoz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700765406, "uuid": "ad46621f-97df-49dd-83f8-bcef57dbd06d", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700765406, "uuid": "2f754ece-fa12-4a9f-8995-7c938c056ec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765406, "uuid": "77483575-7eb3-45f2-ac3a-18697ba7534a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c547d05-89ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700722909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722909, "uuid": "36345553-41c8-489f-871d-8dd9c0a62961", "comment": "Malware payload", "value": "0f68bfda5636a6518bd94347ec4e7e78", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722909, "uuid": "0db9157b-b1bb-4b30-ad88-3a6d17eb3bcd", "comment": "Malware payload", "value": "0b35d92b98c5baf4e3dc31b7e3d902d21fa0407803eaff7e2b2cba24d5d2a89c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722909, "uuid": "dc5c555c-bb60-4a78-92de-e4e06dd0c2c4", "comment": "Malware payload", "value": "011bf70d417c40bf90fe5fc3fe8d6f772d7cc0d8", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722909, "uuid": "f8f3907a-6f43-48a9-b879-b9aed467852f", "comment": "Malware payload", "value": "4cae4b7559def7cc31af2ce3cd6bef667e11feae6d27f717e7cad4b41af4773bdc1a7373de00657ad1aeccfd9d1c7c3a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722909, "uuid": "884daadc-8c45-4208-8e97-6064fe5a8d9e", "value": "T12935332F95CD5BC1FAB7A371CDD5A9F0A2EA3F4B53242C2990F13154B4389924AB138D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722909, "uuid": "ee1da4bd-abac-486b-b95f-b58749db4c68", "value": "24576:BBudSBeZ1aJ4kyOGXv6dTpsb0yiOQdJDWnkKl/YoTyi6+Az:G82DOU6dTiYyzQdXolg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700722909, "uuid": "1c0e81e6-d684-4938-8e6f-2b2868c9c127", "value": 1067633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700722909, "uuid": "afc4c3d9-f4c2-4414-82d7-3cc3076f052e", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722909, "uuid": "ef0842a5-67ef-4c80-8e94-746a859ef31a", "value": "jouk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564c9a52-89f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740589, "uuid": "fd38f119-0d52-47b4-83f0-7d2dfee72c1f", "comment": "Malware payload", "value": "dfc10ee4122a3e825c7911d8456dd939", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740589, "uuid": "13c30363-80fd-4fea-bd04-2c319b7895cd", "comment": "Malware payload", "value": "0b8bafc93286ba29bc30bb354e6e9e4b798c6db937c85600e74a0719c91cc01d", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740589, "uuid": "e55691a5-9c15-4de6-b5ae-ac76cc891738", "comment": "Malware payload", "value": "822ba86746ec61635452d062151b712d815877b5", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740589, "uuid": "19ae4fd2-dc77-4e89-ad77-a4226897a7c0", "comment": "Malware payload", "value": "4b578b6df34919376ba8cfbeb18b2d82f6c729e6f18a71795a359bdbb53ac0e753f2036541c3b950cb4ea50bf949778b", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740589, "uuid": "4a87b116-751f-45f5-912c-9127fba41f9a", "value": "T154553316AFDF6334F7E1427592184CB9C7DD2E50F328D72A3F64D81024E7A2C8BA6859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740589, "uuid": "74864fb7-f8b5-44c1-9944-0d102338eac7", "value": "24576:yFy7iwUXKZsybyigHq64VIyxFoHs4y+Lf6iixbj+HPoj5vOsLFSS9Sq:yF5XeRb6cECiicHA1v3pSvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740589, "uuid": "e2616fef-7fc7-4fbf-b707-565ca7fdb961", "value": 1305243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740589, "uuid": "58a24a29-25f4-46c8-9676-fb1c6eec1aa2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740589, "uuid": "52bbc844-1fdb-4d28-b8dc-caad7293de24", "value": "support.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5565d88-89e4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700732615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732615, "uuid": "fff1bdfd-ad7e-4189-8669-e1f4d7aab2d2", "comment": "Malware payload", "value": "42ab2ddbc2da69d924967a3532c59e45", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732615, "uuid": "13d82fd7-49b5-40e2-9487-584f592bbf76", "comment": "Malware payload", "value": "0b8dc05f6d4ece20334023881985352781c0ce8ba7c2838158aec5af3ab39aba", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732615, "uuid": "ffe8f82e-e6cd-4d24-9961-5f92045a8fa7", "comment": "Malware payload", "value": "6b053f2a468c5ae82d3bf3910e9e26882c3eefdc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732615, "uuid": "040395da-535a-4f2d-9320-a1e69f62f83e", "comment": "Malware payload", "value": "6714047eecbc82b36e77b7444bdfa35b6e42fc17649115300e4b5701813b342caf13ca2fb98c7ecbe06eaadc5210238a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732615, "uuid": "41f66dbd-5363-4fbd-9dc4-cf120c37e038", "value": "T1399601373553A40DC55847710468AECAF27A7B863A45CB2EB08B630CAF0547F7B2D5AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732615, "uuid": "1774e879-cbc3-4c43-ae47-3d3f4612aa38", "value": "98304:jyRxfuNZpeC496W0CcNCkq3sf68UYo/a4Wx585f0nK+7QZXv7:jyR4t49OCcNNqg05fb+70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732615, "uuid": "c6659524-b650-42d1-843c-a9e39dac8802", "value": 8857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732615, "uuid": "fb1b31d4-a414-44b6-b448-4f15430ce7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732615, "uuid": "a015b1c5-d052-4436-99ff-127af5c564d9", "value": "42ab2ddbc2da69d924967a3532c59e45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370ad2b1-8a17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700754280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754280, "uuid": "ab76718f-0cc2-48c3-89a8-d4ba5c47b6f7", "comment": "Malware payload", "value": "44fa5769ba4d77a578406f327fafe0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754280, "uuid": "398c8206-ca7a-45da-b659-1909dfdba998", "comment": "Malware payload", "value": "0c0b8cfcdae8cc7d8a0b193e9e14d060138396c1c3635ba1f346b2836a51de0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754280, "uuid": "4966dbe4-08de-42c2-a62e-551878c57e01", "comment": "Malware payload", "value": "680e464491fc8ea66f49c5f7e8849dee9ce26b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754280, "uuid": "b9bb02b9-b102-4b8b-9e8c-cfa648d45b29", "comment": "Malware payload", "value": "1fa2be331d27f1443dd9d57a2fc2a14f5e83850bf6f4b51e76263df8447a9e2c8fdb2c2ca763bcf122c7eb9754cb3e0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754280, "uuid": "d2a93f7b-bc54-49c8-9baa-6b560db9008d", "value": "T1D505F0006E695B5AF5B69FFE032C66180FF96D1D53E3E2344EE560EA2063B43C511AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754280, "uuid": "1502b261-1adb-4938-a2df-bcd67cc484c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754280, "uuid": "8ea5038f-0e42-4988-8017-073d4da01024", "value": "12288:Oo58ovb+tYTQcrtkxReFFKufEhUT+Bw6CVKxySp/I13aWlXhikaeuc:Ooy0StgFjqUT1bdSpQA8Xhika9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700754280, "uuid": "ffea0ba7-bc93-4921-a919-622a4a02db48", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700754280, "uuid": "fca0ed17-c6d5-4f09-942f-296286fcc500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754280, "uuid": "4702acca-b345-481e-8e67-6b94809d811a", "value": "z1n0t6KQiluA8LgQ7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9662e54-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740406, "uuid": "b5c1634e-784a-4fa5-844d-2fbc35944241", "comment": "Malware payload", "value": "9f495160321ee3c30626979f9e568e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740406, "uuid": "21b60ece-9465-472f-93c3-8f04a41f82d3", "comment": "Malware payload", "value": "0c5a46d8d282d84fc62077f0d955cdb6f5ba7e63e18d51271669e86b9224301a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740406, "uuid": "2eaef4a7-f385-4989-826f-56c6afdff6b2", "comment": "Malware payload", "value": "b4f0e6e38c710b9c8bc142e0ed9feddf52c75a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740406, "uuid": "0b1869d4-1ea2-4bb8-851c-8a8de32d515d", "comment": "Malware payload", "value": "875c54258d5a61ca9fd73e29daa4e5b585e27b4f9f620a5e03bf350f07d9f962847f764c9fa5e7cf51830a3b9415eee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740406, "uuid": "225a3460-04bc-48fc-867c-e3ea7072d594", "value": "T1E8161712AA968225D47E0475CDAA52ED53307C285F104EDB73C87A3939F32E17E327AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740406, "uuid": "3ba1efe5-0f72-47df-8976-5141c9b51615", "value": "6805b9d9f17bc82a9e79068d20b7f163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740406, "uuid": "f97d1887-03cc-41f4-85f8-f098ca3b8abd", "value": "49152:2ctar2G5D6OZgeihsiPBZGugXX37tv/iaSeGDEDnds5haXIMg2hyg/mWc2LbG/kJ:Ja6yD6etih5PBZGrd+qIsorru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740406, "uuid": "6aad4ad4-b543-46f5-97c7-b19b36d9f230", "value": 4196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740406, "uuid": "04dd9726-cc5a-43f6-a38e-70ac42254f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740406, "uuid": "f3e4fe15-ef1e-46f8-8825-ae4af2f2602e", "value": "InvoicePayPal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6476ef88-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700724292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724292, "uuid": "ab657939-dd3c-461b-bc40-07974aebe4fb", "comment": "Malware payload (Formbook)", "value": "350fdc7a417e07c0b18c27cb98c70507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724292, "uuid": "9670dc2e-73a9-40e4-9cad-e3f852a66e99", "comment": "Malware payload (Formbook)", "value": "0c745af3df2ebd626ce868875edb7da2346396210787f2230a0128b151f9da3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724292, "uuid": "aeda2a3b-6358-4c9f-b596-2e7ea5159f80", "comment": "Malware payload (Formbook)", "value": "6aba6308d713f98be704c4d5e09fd09a856d7616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724292, "uuid": "20f7759f-541d-4cc8-b919-57dd7a09b79f", "comment": "Malware payload (Formbook)", "value": "78be18107ce9cf369192f657a5aeda49af5435b52d51a21a7a388dbdc76eafae2d144d7a54fdf0ae5ed4acaa1692aed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724292, "uuid": "68e99f6e-206b-4085-ad24-8827d8255fd8", "value": "T1E215DF18A6B95F93DB3A83F95410520507F66E2D103FE35A1DDBB0EF6AE4F800A45B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724292, "uuid": "3b44e547-2240-4f33-b2d9-8962ab934921", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724292, "uuid": "f20db518-723f-4e93-ad0c-6e51ae6eb14d", "value": "12288:R74786E6jD/pLXGkJl8MekDasQH4ahjIwLJXwXT+QyDG89SiE9i2z5GOZO:t6tD/F2k78kTQHowJypkSXc2z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724292, "uuid": "72f60455-7b2a-4808-932a-c1d929e0998b", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724292, "uuid": "d4cc1295-1e4b-4be9-b73a-40035f4220cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724292, "uuid": "19bd3f8c-bee1-4ae7-abc5-f8a31fc15a8e", "value": "DHL Receipt_#8939977158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b60a090-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724250, "uuid": "ac300857-c68b-464e-9272-3cd8377dc3b3", "comment": "Malware payload", "value": "c2ece60d5f69fb28731213c0d9b6e5e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724250, "uuid": "ad793f2d-f318-4893-9717-14dc3fe73f8e", "comment": "Malware payload", "value": "0ce7e14f4f6edb88963dd174c58772783d641a100834f89fe81802c515b0bbec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724250, "uuid": "56e225cd-618f-4e75-85f4-a9d359948f41", "comment": "Malware payload", "value": "3c8cef3f7367931f62f79229df583fc7578a4d98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724250, "uuid": "c38c9b89-135b-4aff-8b21-f13e2c9304f6", "comment": "Malware payload", "value": "159fb3f3af58ecd1953124d915c5149c4d7094546afd9f854e3ff1156172d2f5732151ace77019077f26477722aecef9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724250, "uuid": "becd4ccc-dc2e-465e-b51e-d30ee418e7f3", "value": "T187446A1365D0FC61C7564330BF2ED6EC7B6EB8E19E69874B32142E2B69302B1DA27315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724250, "uuid": "cfd84fb1-b98d-4d96-8a9f-c5ec0914ccaf", "value": "c368fa427f1f3f59d6f5623ae63cdace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724250, "uuid": "0b3ae4ab-099a-4701-9fd6-50045371cb2f", "value": "3072:gpWf+OUW8uykQpcnUhFd09MqOK5GIKgBQ/eKKf435tqqJep+72:4JuyAEaurK5GIK1KfYnJeMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724250, "uuid": "f018da23-21da-4ffd-a392-4344f77c765e", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724250, "uuid": "305c1f18-97ab-4623-bba5-d45a81d33953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724250, "uuid": "7807dec6-5d02-409f-a968-1a693c87527a", "value": "c2ece60d5f69fb28731213c0d9b6e5e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917ad9b3-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700724367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724367, "uuid": "a426920e-27a6-434c-af3d-2cedfef714b6", "comment": "Malware payload (Formbook)", "value": "f42c645711d0030c53d251eda4ea074f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724367, "uuid": "a19be413-0bad-48e9-adfc-6e355c26fff4", "comment": "Malware payload (Formbook)", "value": "0d51a06bfcc35aa2712c60ddf4099712a53efde1f19663c29bead16c12fb93bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724367, "uuid": "fd0da66b-a16a-4260-b7ff-7d94a4584fbc", "comment": "Malware payload (Formbook)", "value": "315af304a6640e700c7fbadf61c0e35c1720cbdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724367, "uuid": "75541f31-0e3f-4514-9df8-3c007a0a6671", "comment": "Malware payload (Formbook)", "value": "47807c5c0eff12e2bcf941adb1a147aa9eb99499ce602001a0a705c916ec5a40b873bd150f1bf82ccc5baafdf9eb135e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724367, "uuid": "4bc15db8-dce0-4af4-af86-4c633ecb15bc", "value": "T12184122627D3CDF6E017493696B62265EBF7C3085222A95317518F7EFD241CAC40B2BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724367, "uuid": "9ddd7122-b7bb-4f20-a36b-c7941f7553f1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724367, "uuid": "1c6ceaca-1a10-4f21-978f-aacb2692b543", "value": "6144:QBlL/TTL49SGxAVxTbw2BQqgKK9zX01PnB1F9l8GwLHylpJjhYsuABNZ5l:iJTNVlbwmQJAPxbNwL0pJCZABNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724367, "uuid": "1d904346-881d-412c-9292-de7b80a1c00d", "value": 395585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724367, "uuid": "624fe1c3-b56a-46f1-8d8a-4fe3a76aa12a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724367, "uuid": "3d5228ec-006b-4fb4-8a1b-1b9aec4c9421", "value": "PI- 8945001-10-11-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b69a7f-89e5-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700732936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732936, "uuid": "d42060b1-2e4e-48f3-b49b-b1e3c210a578", "comment": "Malware payload (Formbook)", "value": "2a756855759a2a23c441c3bec5e810d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732936, "uuid": "7d8cb6fc-cc1d-4d8b-9ea4-54ee31fff004", "comment": "Malware payload (Formbook)", "value": "0da2d0750a4bcf02b61aae75dc43eba1276b094ee2a3bd4bc1f09daa9af293bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732936, "uuid": "09da17fa-32c5-4613-a910-c64788fa3d8d", "comment": "Malware payload (Formbook)", "value": "ebd4155f08d71f95fa9e7d341864f046a26a7812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732936, "uuid": "a782173d-eba1-440e-b1a2-a4a0777d5d2e", "comment": "Malware payload (Formbook)", "value": "3d82560f655292298c9c8d8338161b7fac743769547c99cfcf5ae9c66204462d0dafc017123d7beb398a798563207f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732936, "uuid": "0ec5f114-fbcf-4069-8964-0a185c1d4b57", "value": "T14115DF1876B65FD2EB3693FA5410560447FA6E2D103FF34A5DC7B0EF2AA4F500A84A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732936, "uuid": "4175fb03-7374-4e4f-bb32-7448bc36860c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732936, "uuid": "e083999d-cdc5-4d2d-9ffc-63a6767de8c9", "value": "24576:ohtD/F2k78Dpg1I2pHHuqMBCE/cZzsU8jh:o7gk78Dppmj45/cZwUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732936, "uuid": "3422ef7e-be2f-4f81-b66d-cf3e8f8650e2", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732936, "uuid": "55fc0fad-09a5-46a0-9795-ec073487aac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732936, "uuid": "b3926ef7-8552-4818-a38e-dce522705f06", "value": "Sea Waybill, Certificate Of Origin, Invoice & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a3c2e9-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724487, "uuid": "518799ae-9f73-4550-93fe-292a4b05dcda", "comment": "Malware payload", "value": "2ab391608160bc82f48480599df12174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724487, "uuid": "394ed8e0-d796-443b-abdb-82306d907003", "comment": "Malware payload", "value": "1064606237c6838a948c3ab85b2c95df70c8f85e87958b7e3f9bff9d79e2a645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724487, "uuid": "90f716a9-5558-4343-9b3d-b012c09f2bd2", "comment": "Malware payload", "value": "1517d7e5ac0868cdd4ec594396a621a0587b4d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724487, "uuid": "d522d3e7-c51f-4f74-b517-b4019343bacd", "comment": "Malware payload", "value": "55edc78a5a4501d447706c068b92951acd8efa648c0bf7829458c96afc37126c08ede952620cc0712b00092d96c90755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724487, "uuid": "8924a975-6531-474f-b6f7-4588f3050ee1", "value": "T1BF85E172ABA0C272DC6736BF6C1B8245C93A3E642E5938761FF8358D4A7978134352C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724487, "uuid": "31f36349-05c8-4683-83bf-5399f951055a", "value": "64246ffa312721d4dcd10d9cecd821df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724487, "uuid": "c9127eba-a6d1-4b4e-8315-9645cdbaaa21", "value": "49152:bZAtX8IxTqh0eJa3DZEe9sRuCVCW4wMyqChsQ:bZmXX8Za31CuCc8MXC+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724487, "uuid": "29d8ae21-01ac-4c82-b8af-f9be29be9597", "value": 1740288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724487, "uuid": "126ec645-dfe5-4bdc-9530-9cc0f88e9fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724487, "uuid": "7437a640-466f-46d2-89b7-b66291b29d4a", "value": "TransportLabel_8770422870_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601a0c87-89f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700738028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738028, "uuid": "b1293de7-fc63-4b77-8e13-eb9fa2cc9ebe", "comment": "Malware payload", "value": "c04fb6fd0153009aed24dee63047c4aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738028, "uuid": "a0517fb5-8357-422a-9c6b-f356b7307d62", "comment": "Malware payload", "value": "107732c9883b6616b6c6398234d6e44843de70e8724023d62ca3e908019e58e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738028, "uuid": "a6ece975-50f4-487d-8cda-8bc2eabc3a14", "comment": "Malware payload", "value": "120dadef65d907eb09898d7dcd3e4ee99b7f763d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738028, "uuid": "f76d7c7d-f132-49f6-86a1-e15f4e305f72", "comment": "Malware payload", "value": "6e3c454009b0aad767b33e3a59c8f86e6760d35158c5e3af06d05b40f87f0c9524f45b70edc1ee4ab9c6e9822f67b76d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738028, "uuid": "86aa2da1-80e5-4486-ac39-f63546de5258", "value": "T13F16CF223273E505E8292171C4F2D29543FF6C72D644E26F32D83B2E7D7A3D68E1169A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738028, "uuid": "2ba49e29-ffd6-4498-81cf-20ecde783821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738028, "uuid": "978d3f68-9692-49a6-b6cf-d04bdbe9c70a", "value": "98304:Zatw+JCnqtFfByLIDN8gXw4PjEkqa+2hyxUigV:Z6w+ffB8GMt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700738028, "uuid": "275eb699-1977-443b-b74c-4cc23f6a684b", "value": 4233992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700738028, "uuid": "02c38d9c-25a2-4410-ab6d-e950da9cc696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738028, "uuid": "a7e82384-4daa-4aef-a712-a7b3197e384b", "value": "SecuriteInfo.com.Win32.CrypterX-gen.12228.5690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9af4d4-8a10-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700751204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751204, "uuid": "75d6b1f4-cc1c-4fd3-a313-758dba8d8127", "comment": "Malware payload", "value": "2ce514c0a1d73959a6c2e76c3e7ac94a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751204, "uuid": "c204bc84-391a-4b7b-adce-0fd77a00c355", "comment": "Malware payload", "value": "11b86ca3c04cd0afa8e2400d92e463957d41a530b3dc251275992c89172da436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751204, "uuid": "8d723134-4772-47ec-a407-3eae23aa49ef", "comment": "Malware payload", "value": "baba1616c637c069ee5841681232cbb8b8aa2bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751204, "uuid": "d362f4db-03e2-42f2-af3f-c8bc6ec0cd26", "comment": "Malware payload", "value": "74b77ab7530fac0b5d3f39dc70d8d5783e62619e7fe04ec825307aba38caeef18402cb0a632da57ed5cb864f0eed1a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751204, "uuid": "c3f2894a-4783-46c1-9b17-46803ef38a7e", "value": "T12816085B33FDAE92C3220A79550A4125B677E801374BE7EB5F0D03A5436A366FC849E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751204, "uuid": "77e6f5c1-3376-40bf-9261-9cb69335a28f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751204, "uuid": "d9b3042b-14d1-4e6c-a0d9-c5a577095ca7", "value": "49152:0mmBpMbGXqil4mvJNYQWn9Y4zqbE4aFjVgeaXyB7ctfsG3Bb:0mmBpMbmfJFWnkQ7aJD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700751204, "uuid": "dc1b7e11-7786-4848-aa0e-ff5a20a46e9c", "value": 4291584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700751204, "uuid": "e3aeec36-96cc-4967-9e78-c7c864e75c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751204, "uuid": "938f0ffd-afec-4e37-ad0c-400293b4ed6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4ffecb-8993-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700697894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697894, "uuid": "2245c2b9-ae11-4f19-ba24-6b7fbb171d83", "comment": "Malware payload", "value": "7db13f7ba706885c31fb91eb35e9dabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697894, "uuid": "cfa22ba4-02c0-4c59-bfa2-7935a2ab4d14", "comment": "Malware payload", "value": "12b9be06cd3ec503aca9f872bb033a5c9412d4e259f2fd52208442db8362769e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697894, "uuid": "1ee67dc0-45d0-45ac-8197-f8b64b72f531", "comment": "Malware payload", "value": "51595546114bb6963565a5e3e31c908bcf82b703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697894, "uuid": "af9e4ba5-0d7e-4854-95ee-6ea07335a5ad", "comment": "Malware payload", "value": "4430da5da9145fd61589f75db1b4035e942dc822d417f5767ba46a1996f2508ec3158f88bdda8d503bee6c7f92af544e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697894, "uuid": "a7f4a2dc-a37a-493d-a560-bc522a90d7d3", "value": "T1AA55E022B3D102F1F57746B98C6B6E6A9AF9BF007DA4754A6BF45848CF307C06818397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697894, "uuid": "dac5cce5-3983-492a-83ce-07d78a4f751f", "value": "9625be519e195c359e1a03bbdf8b502c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697894, "uuid": "32ca2722-0e2e-456d-a06d-d9de70291a6e", "value": "24576:wgceNT0sdqTXjZ6MHvR0F0bxlfAWPLjpi4KlpWetM2+uizpuGJ8coTj5B:wgG16W2UDjkZlpWE6puQ8ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700697894, "uuid": "96afa8ea-8309-4a52-8603-83f21cf06288", "value": 1366528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700697894, "uuid": "955b75d3-3f7e-44f3-88a8-5e8da467806f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697894, "uuid": "c927cddd-6082-4d80-ae70-d2b27eec68a0", "value": "\ubcbd\ub09c\ub85c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b673c0-89d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724916, "uuid": "9f60dd27-be8d-4865-a78e-63df6c7d080f", "comment": "Malware payload", "value": "a544d2c23c55904dbf0f0190f42eaac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724916, "uuid": "80910d0c-88d8-439b-ae08-7b2fba0bfdee", "comment": "Malware payload", "value": "138b791bb04c3073e3e752fdcf5bc5490c4169e9f553954b025aab8414c4589a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724916, "uuid": "48c11d34-62b5-474d-a25e-3a1126a75bf0", "comment": "Malware payload", "value": "e9d920e5400b36562dfe81b900b99d35b70576b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724916, "uuid": "d20c1476-1506-41f0-89b3-c6792b39570e", "comment": "Malware payload", "value": "73c79d0f973fefbee23b225ed6c39e809c1565f3bd5282f0bbba9913e7b09e092e9a65258fd4c8691146d330a23fded5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724916, "uuid": "a5cf6bea-cc5d-43e6-82b4-939489392454", "value": "T196C4129C5BCC7B07D2FC8B3B8CD1BA5693F944B9E35BF70EAC85861518023D5221269B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724916, "uuid": "43faf4cb-a8e6-49e5-9bfd-daf178588fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724916, "uuid": "d4673c3a-891b-42c7-b85e-3a57702ec090", "value": "12288:fz9JHhp3l7Nt0P78PyCp3qkxD+XYaVikoSG6s7XuwMefn:fzXtNeP7v6XZMYackkX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724916, "uuid": "98076502-1a00-4080-a79f-da335a2f49c6", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724916, "uuid": "15f0353b-35bb-4d27-9bd4-ca3bcf261816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724916, "uuid": "4a754e6b-d8bb-4403-b2ab-37cef40534ab", "value": "SecuriteInfo.com.Win32.CrypterX-gen.2313.4774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cc6c11-89d3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700725210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725210, "uuid": "22ad541e-f213-4e16-8325-a18141490fcf", "comment": "Malware payload (LummaStealer)", "value": "ba7142a33822198c3abb6a9e5060007b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725210, "uuid": "7120b2b9-0772-4a5f-b19e-559dbbd610f5", "comment": "Malware payload (LummaStealer)", "value": "13b1509db95d309415baf5a5569b4fc4f3a12a36c6e49185716514d9ddbd2e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725210, "uuid": "a7312710-284b-4370-99b5-a81e964a04db", "comment": "Malware payload (LummaStealer)", "value": "1954a67adfd5ef925c14d04ce49a586f7a1f7ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725210, "uuid": "fbce528e-6fde-4e9b-8160-e07245147e5a", "comment": "Malware payload (LummaStealer)", "value": "75e45a4d4d39883ab8666c77ce1d518cfe224e4c4fb9a38ea6995814304faae7ee68abc0684b30118b6cb5c28bed59f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725210, "uuid": "bc998cb2-3ae9-43ed-adb0-99ebf5c42164", "value": "T10406CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725210, "uuid": "f223c5dd-ef79-4e11-973c-0d79477fb0e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725210, "uuid": "93a6194b-a0f2-4300-80ca-3dac082783cf", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYk:8AqA4bNMAeLVdWRC9bO2IyOnhJYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700725210, "uuid": "e2792067-9795-46eb-9765-38be738b04f2", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700725210, "uuid": "855fecfe-4904-48ee-8d6d-78e9db9aeebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725210, "uuid": "42869015-3af5-407a-acbf-ba3e2f45c00a", "value": "ba7142a33822198c3abb6a9e5060007b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cabbb1a-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743901, "uuid": "3f2daacf-df6d-4008-a054-6a85f9379047", "comment": "Malware payload (Mirai)", "value": "cdf9f48130bdefecf972ac9ee3841bfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743901, "uuid": "81426ba0-e642-4c30-82e5-61704a924687", "comment": "Malware payload (Mirai)", "value": "14419f22f01feb62ada3db8a464977719a958bfd75427e4c8486052e2904f474", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743901, "uuid": "0e268ae8-3431-4220-9421-1d222e595313", "comment": "Malware payload (Mirai)", "value": "7158fdf63bbd4ce4e7bfec88f4bb8f540d34df98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743901, "uuid": "6b4f9282-ec13-4b30-b58f-da70c04d8e24", "comment": "Malware payload (Mirai)", "value": "c0b15f703777b6d89ba60803a8c9ecd17326611dbd0c59a9f8fc22a8a280e5b2ca428613575a03415c132713c5de318d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743901, "uuid": "ccf62b4f-0690-4cfe-a05e-5c1d8ced20c1", "value": "T1EBB2D1A48B915703C670B479A27CCF926A3715D0D2F229361B2092BCCB524A733FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743901, "uuid": "973bd35c-d66c-48b0-9422-b10142f8adc3", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+ByCjEBhymdGUop5hu7U:4GaKQFH0rs3zWoDDRsjt7LB9U+Bes3Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743901, "uuid": "8b42544a-6537-4014-b732-0340e5853119", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743901, "uuid": "a2a07c5c-88a6-499a-922f-e44a81ed3526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743901, "uuid": "a3991313-8c1c-445f-aa1b-aea40c0c954c", "value": "cdf9f48130bdefecf972ac9ee3841bfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30008aee-89da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728069, "uuid": "b016261c-e632-410f-bf65-e9a6fa1c8b11", "comment": "Malware payload", "value": "575ebf994b75d091e8df381cce992aaa", "object_relation": "md5", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728069, "uuid": "92af2bc3-2976-4bc6-a663-9858c9a5cf25", "comment": "Malware payload", "value": "166d1a6ddcde4e859a89c2c825cd3c8c953a86bfa92b343de7e5bfbfb5afb8be", "object_relation": "sha256", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728069, "uuid": "8ddb09c3-a84e-4ed6-be8e-e2360dfb6543", "comment": "Malware payload", "value": "141b635caacd8def3a1869cfb717262207ecae35", "object_relation": "sha1", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728069, "uuid": "b31a285b-8dc0-4ea8-ab40-7e2ed70b1362", "comment": "Malware payload", "value": "7f7cf435859e99371e4df3c0871e100d8baaae82344b09f1278eebaa0a7fbd58b98605b67e7473cdafe3511473da3d0c", "object_relation": "sha3-384", "Tag": [ { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728069, "uuid": "d3051768-b9c6-4882-8b51-f00179a3012d", "value": "T1E4459D1177D19031F5F30272AABC9B76593D79305B3990DFA3C4099E2930AD2AB39B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728069, "uuid": "4f66a5a8-3337-483c-8702-cbf7284d34b1", "value": "1ec1adb7e6dcb7d894ba90e1aece4fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728069, "uuid": "7a877122-201a-40b7-9574-22cae74af67b", "value": "24576:Q5byYpfOemeas9Po2m7FIe2KLsdOGB2l4uD3bJbj4coCYHb0YLfUx:D9Ns9Vstl4W3bJbUcophq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728069, "uuid": "e949d767-5923-44f8-aa14-931bd701e645", "value": 1186792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728069, "uuid": "be91c13e-0157-4ecb-83a7-11de041795ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728069, "uuid": "4051f09b-b874-4b7a-9d0e-edd04ba4dcd6", "value": "166d1a6ddcde4e859a89c2c825cd3c8c953a86bfa92b343de7e5bfbfb5afb8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd456e9-8a24-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700760060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760060, "uuid": "2b5bf3ca-5394-422b-b41e-6ebac2bbb141", "comment": "Malware payload", "value": "6ef10cf25065f8ce8d031549115512ac", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760060, "uuid": "8dfe6efe-706d-494a-afd8-dc5e0d1282c9", "comment": "Malware payload", "value": "18d84d0c185a460fada6a02dea06b4bf51ffb6ac85fa23b9a45b2985ee7ec76a", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760060, "uuid": "7a047cfe-52fb-449d-9b1c-b8305f979b68", "comment": "Malware payload", "value": "39786393b9a327e324f1792a3d7408ae9978f0c9", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760060, "uuid": "30ea50cc-2c87-4831-b9de-8bc7c7b2d50e", "comment": "Malware payload", "value": "077eb6036ebb20f133d316943a6cccf3c74f7e7cd9fbce64ada1e54bc1dc589bbe506f47ce68ae9082d56e4076a3b611", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760060, "uuid": "c6369807-0234-468d-8951-5d7049507126", "value": "T11E863315B3A04CE2FABB683AD581D519C671FC050B20CE4B47594ABA0F27A518D7FFAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760060, "uuid": "0d039537-58b7-4675-84da-af3bb892fbcd", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760060, "uuid": "6ce8aef9-6fc5-468a-8db0-5912934dc69f", "value": "196608:lV0YCDBeNTfm/pf+xk4dfrl7RGrYWOYoKy:xYCy/pWu4NpRGrYv8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700760060, "uuid": "fcbe1e9b-a790-41ff-abdd-59abbcff5a46", "value": 8007682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700760060, "uuid": "e3cee404-819e-41ad-98cd-2fe63da16d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760060, "uuid": "6191aa4d-d9b7-4dc7-916e-7963c18bbd16", "value": "trac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b069d4ee-89b6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700712823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712823, "uuid": "cd8dc323-9c7a-4737-81b0-8faf5721c8dc", "comment": "Malware payload (Mirai)", "value": "3b5c52a16e8d7dee333e1426194babf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712823, "uuid": "da5a334c-350e-4356-86fd-97a89cea0036", "comment": "Malware payload (Mirai)", "value": "19e030edf5b121d1e6117d08270e55cace2c88e12d2e63d80d855e9b7fe30cb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712823, "uuid": "9ef8cb24-d6e2-45b8-a464-be56ebd85f4d", "comment": "Malware payload (Mirai)", "value": "5b0a7ccf6dca31eae47d780b5b75600f39696270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712823, "uuid": "ded694d1-4cb3-4cf6-8f9a-3305aa8135a6", "comment": "Malware payload (Mirai)", "value": "9e88a26c147f5ef7ce2c4a16615faabbb94791b605b7334f8ba85200b1e931eeccfd92924e1b48f6b15c55bf1bfaddd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712823, "uuid": "39e33910-6279-4770-b116-9f369716e7cd", "value": "T179C2E1E79E24BF2AE880477356AC02D56466C68F5B2D0A1BF0E5DEF24342DDD3DB0914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712823, "uuid": "fd47f399-0ca6-454a-80cd-018aabf04845", "value": "768:tXXnPkRA5Z3IjW7s/tRSqJe58sJI7BApDM:tX3cEWW7iVzpNYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700712823, "uuid": "caf89a89-a3ab-45a4-92c0-518f8f9e2806", "value": 28068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700712823, "uuid": "add1a067-e37c-408b-9b51-28b757bd8745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712823, "uuid": "81705daa-31fd-45d7-b9c9-171ee4ee2150", "value": "3b5c52a16e8d7dee333e1426194babf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a351aa-89e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700732858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732858, "uuid": "72944366-6256-4c50-b66c-772463402709", "comment": "Malware payload", "value": "0280313f1615b19671760a7973462afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732858, "uuid": "685e416f-e1ed-427f-95d8-31e77bd60e31", "comment": "Malware payload", "value": "1ad056ebccbdf6a8a32a7f438de43c68912adefd8aeb5c6de546b1676ae4516f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732858, "uuid": "d02d9f0e-0425-4994-bf65-6d1d94a927bc", "comment": "Malware payload", "value": "80f37d228cd883c53a72d3ca7643dae91bfd2080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732858, "uuid": "9cea1d33-486c-4409-9f52-e48aaa2369d9", "comment": "Malware payload", "value": "fc7e537dd30b3b1013b2e7f72c1410ecd193ea1b9b96e8d1d32bc945d01310e2d0dcaeeac2aa3f9d415820a4f0d0113a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732858, "uuid": "073bfec0-2634-4c45-8f22-152beb1cedbc", "value": "T12DE53386BA36A04CED14FD38D749D532DF544E576F8DA1698F4DCB082EBA4B0A0DDE08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732858, "uuid": "f1c03594-c2fb-4b94-b2b7-7b22f03dc566", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732858, "uuid": "4e5b9dff-797d-49ac-9958-4be9bde507cf", "value": "98304:Y3xiRcwAd/sT7S5pCikKyWRw7GfQpQx5n1aUd4:YBiRtU/QK/kKjRVopQ7fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732858, "uuid": "ff635977-e07d-4a06-b5a6-946b6afa92da", "value": 3198464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732858, "uuid": "38bc4f1a-9320-4835-af73-4fb233c7a5fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732858, "uuid": "233bda41-f48c-45d6-9478-c5ef3c1ccb2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a53236-8a45-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700774333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774333, "uuid": "f45c4bd3-cdc7-4db2-94a2-d2bbc536f5b2", "comment": "Malware payload", "value": "dda4fb7debe83135087e6e1965982cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774333, "uuid": "72293d60-4e1f-45a4-b00c-e9b876d89951", "comment": "Malware payload", "value": "1b64126ea9a672c967f64b6b379d3a1643bfda0da2bd58f66b07e16c8fd1946d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774333, "uuid": "7ea1ca7c-b4a7-4e84-a091-30036fc5f623", "comment": "Malware payload", "value": "1f5046d4f5ef48a414ec8b3f0e6bd852535fb5ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774333, "uuid": "4526f2f2-2013-4aa0-9821-46d8c4802867", "comment": "Malware payload", "value": "a9fcbacc39b8ba86266e2ee98f364efe537e264e2dd16430031a0fbacd1608303a7600a8b4675eb5062d1affe4e5b6cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774333, "uuid": "2109bcb7-6199-4f60-ae77-ad3b20e2ca99", "value": "T1E3546DD356D0A871E11746328E1AC6F4261EB8A0FF567BB723779E2FC8B12A1C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774333, "uuid": "b2824a84-df07-4ed9-8de7-941059e4a078", "value": "38512f187ce560aad231123bf7f8c4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774333, "uuid": "ad9ecc67-59d1-4f4a-9a32-f9f995026434", "value": "3072:BHN0wp7/AcRnTG1ytiiGa9k9Kap7q9lSMCMc0Ml92PtjAVFUpxzS:kkjDnqDasKap7qeM1cD9WtjW0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700774333, "uuid": "22e0f56d-0aa9-406e-97ce-9bf3291208d3", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700774333, "uuid": "086d139f-f68b-463c-9b2d-888728e89381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774333, "uuid": "2a6aef3d-49c2-48dd-afba-2d824522cb77", "value": "SecuriteInfo.com.Win32.PWSX-gen.24848.3090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659b4a27-89f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740614, "uuid": "a34e6958-0049-49c3-ac2f-de87bdd44fca", "comment": "Malware payload", "value": "b4958afe2a7f6f718c0e2d9829e05572", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740614, "uuid": "e74b2304-60d3-4a1e-bc01-9f98db85fde7", "comment": "Malware payload", "value": "1bd9734b992118aa07cb89271f86e2fdb0deda2a406242e98b6d0dda60dc285b", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740614, "uuid": "3f927b29-4f54-4104-ac0a-7206674be63c", "comment": "Malware payload", "value": "66102b789acdffea014a258e574b9c4effe3b8df", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740614, "uuid": "85b09bee-465b-48bc-8574-c86eb8001130", "comment": "Malware payload", "value": "0c09ce3912876ec36d2a38e2f6ea78db7d41e41c5a699c1d8fb871b6fda114eb988dcd3692d74eb9f432c802c8253d29", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740614, "uuid": "6f2d3f54-7532-4237-8db4-6438678de5e8", "value": "T17F3523BAE9DC01D1E7FBC372971E141A63E3354E4250BCEA80B72855F95AFAE45B0207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740614, "uuid": "eafc52d8-138e-4da8-bc7c-2e5a4257f12a", "value": "24576:BBudSBeZ1rtti9o0ToHe2S/TfPD+Mn8tYJ2XlR2b/qQiCG//OLm36X:GhbiuH7S/bPD+MEYEVReqmG/2LmKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740614, "uuid": "4335e433-02ef-47a4-ab94-935a4bfc2ddb", "value": 1059429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740614, "uuid": "91c0d24d-989c-4746-972b-241605fbc087", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740614, "uuid": "dc24a0ad-305e-4ef8-9353-4de37b197641", "value": "jouk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aeb1417-89db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728597, "uuid": "8b259458-72c4-49d6-baa6-5b3846d8ed3e", "comment": "Malware payload", "value": "04e6e940106f4a258f9fb874512dd481", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728597, "uuid": "0cd09b76-f8cd-4d5a-95f1-f8eb31332a76", "comment": "Malware payload", "value": "1bfe4316ed13b9ca08ef7fa09e26d57930dd8014a1644b00748ace75c76890ca", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728597, "uuid": "05630157-1f04-428e-bf44-39fa5c87b26a", "comment": "Malware payload", "value": "2ef6e7814c1e9dc70dfa2d0b9bd9c03bfcb22f2f", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728597, "uuid": "b5637f75-4f39-48d8-a435-308a02e6f8bd", "comment": "Malware payload", "value": "16be7967a7ee266ffea9dc5fea30bcf1bebd3924433d19d7e2c93f35ffed280bdacf80d2608048212a7bbc69fc6ef9dd", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728597, "uuid": "e860f87c-70f5-4acf-944c-ced84d5990dc", "value": "T137C4235BF300092D0EDA9FD076F19465C68968BF6B42EE4038B3458D46B7B4376A31CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728597, "uuid": "b1015bdb-17f6-46b7-816d-e9435c551729", "value": "12288:Bc5W2kM2VfqRLzvCajGiFbQLZ3JEgXpxWRe5k9N9ylDIgYkyXwV:BcI9Lqz3jGYIZ5Eg5xhW1ylDsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728597, "uuid": "0a8f4ccf-9fb1-4e89-8953-1531d81805aa", "value": 587676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728597, "uuid": "4973f2c6-7cab-430a-a91e-0c0d2f52ee50", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728597, "uuid": "9ddfb7d7-2ddb-43cf-a36a-afb53b936228", "value": "BL #2005632.exe.gz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57829d63-8a17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700754335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754335, "uuid": "11fd34b5-c1f0-4e97-9343-95dc598ced00", "comment": "Malware payload", "value": "a41f82d5f1d59cb428366aeccb69cbf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754335, "uuid": "665a4138-45d6-4839-b875-3f78402914f6", "comment": "Malware payload", "value": "1c5304310de6d6007a6ea688f43962d567ab7f25fe78cfdf8d88056e9d14f0d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754335, "uuid": "640d6687-d5ba-4bc9-bb1e-1e7adf56e900", "comment": "Malware payload", "value": "7ef3ebce94d3303e582cfe715ff3ba629e3a2bcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754335, "uuid": "98b509ae-9e5a-43cd-9178-592d1ef8c3d1", "comment": "Malware payload", "value": "9346582d57bdc0389c817705a9131979bd750d592f8c8a85605cc56f775d0fcedfaaa8b6abc6f21e49aa2ae993b903d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754335, "uuid": "bc2d610f-5183-4de5-a801-024493ac9a3f", "value": "T1EC27CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754335, "uuid": "fcad2082-09a9-41b3-ad5b-a84627f0bc7d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQv:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700754335, "uuid": "2e1a7e61-9931-4a0f-bfd8-1c6d9577ab2d", "value": 22118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700754335, "uuid": "1773039c-58eb-4db9-8657-50591a079e19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754335, "uuid": "4cef80ac-c64f-430d-8fea-1f4cf5cf21d1", "value": "1c5304310de6d6007a6ea688f43962d567ab7f25fe78cfdf8d88056e9d14f0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d69c01-89ad-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700708877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708877, "uuid": "3cbf9aad-88ed-479b-bf62-a0b01d5f8897", "comment": "Malware payload", "value": "01078438fd2a260ac1e7c232e1462048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708877, "uuid": "60f89936-768c-42ca-8904-a10445168a81", "comment": "Malware payload", "value": "1dbff91364543913e6384d3fdef9dc32578b938aafd63ec95cf3b61613056eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708877, "uuid": "98ef4330-942f-4db8-ba4e-efd83664952c", "comment": "Malware payload", "value": "9a777c3008a258dd115abcd6794461e431889d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708877, "uuid": "f1e84652-85d4-4688-a0f4-790466e11837", "comment": "Malware payload", "value": "f1db920f99b772c916c11df3fd20c557db12df45c3af78f23f18bd2ce5d9e5fbc59910c913200b279b9b8e5861e63574", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708877, "uuid": "388836e5-fcd3-4ccf-9339-a75395fe0c77", "value": "T1EA559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708877, "uuid": "b0f808f1-3781-436a-bcc0-6af31c764ea3", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708877, "uuid": "bce7be7b-b605-4e97-aa0b-de828910d383", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700708877, "uuid": "14815376-ddec-4cb4-a70b-74b06a377d15", "value": 1322233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700708877, "uuid": "810d1c6f-68d2-4fe9-a3b9-2cc22ab31480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708877, "uuid": "94332945-bd9e-4ce6-ac54-0805db463dea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eee731e-89ee-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700736604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "de0345d0-7a69-4c25-b38a-7b1cba9fe34b", "comment": "Malware payload (Mirai)", "value": "a85a50b092a348c404af590bc8b199c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "1cb6ab17-ac3b-4de4-994b-c233182f139b", "comment": "Malware payload (Mirai)", "value": "1eb7e82e2ed08f281385dfaf33ab93c9dcf108de3ddba0ba1245eac35fe1b4b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "abf06309-886a-4cec-a9fc-1a6a79523857", "comment": "Malware payload (Mirai)", "value": "26ed6efc7d74b19ffcc30a1f5dd95cc60e91b28f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "fbbdbae4-2034-4f5f-a448-72c3d7bd1347", "comment": "Malware payload (Mirai)", "value": "85f5c92515f091296a8777603e9de3876f1d47a3189a8ecde039fb3921ede178c04e83ddf7fd22aa8e7ae4795f692239", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736604, "uuid": "dc0c69f2-e9d2-47cf-bff0-e28d518a3700", "value": "T165D34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736604, "uuid": "5319f38c-bdae-4f96-befd-f945a446763b", "value": "3072:f0DvinprSHrDqtVpEB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDep+JxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700736604, "uuid": "35da7ab8-0f40-4820-836d-f351e30c9dcc", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700736604, "uuid": "4aa0a883-022a-48bd-b413-f6147999af70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736604, "uuid": "9a5b5d96-84b0-44c4-84cb-d22f2d300a0e", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8969f9e6-89ae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700709321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709321, "uuid": "41d6898a-cc1e-4f96-9923-670e2e8d0cfa", "comment": "Malware payload", "value": "d22a14a1d3e7509866a4d2e109ad4e0a", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709321, "uuid": "8f0df36f-fa40-45ef-a380-c8be9fb37dbf", "comment": "Malware payload", "value": "1f66f988f842c0b1d50d7988354ddaaaf7df2d171b8407f12fae111db7a19a62", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709321, "uuid": "c447748a-f1be-478e-9d20-846522106e00", "comment": "Malware payload", "value": "c994f23e36869fa132cb76f42e57547d5e78439c", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709321, "uuid": "bb47e6f9-4025-4b5b-8440-87c93fd7cbd7", "comment": "Malware payload", "value": "9e18f21676c51e632c4859b463a93b7452b20b21c7e247d26de2ce899ad827f4e0454bc50a3bb171b1bb9c018ca7cdba", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709321, "uuid": "ec18a1bb-a5c4-4c8f-89a2-22bd975b4d58", "value": "T10961A0932151B8E9415283BF3A5956FBC07FC224914A6045F78C4F6DF9DDE633A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709321, "uuid": "6eaae3cc-ba1c-436e-88c6-4fa9e45ebbf3", "value": "48:q+MTLimb7xB1J/HuKZA3vDgQfdJ0HuQO8hFi5QsvuiBrVxqT/s5N:BGtb1J/HuSA3vDgQfdJ0HhmAiBrVMgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700709321, "uuid": "b7ca8a56-3dea-4d63-8c71-7571f99a3a9d", "value": 3222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700709321, "uuid": "8ba8cee4-b075-4b3b-a381-f69c38b6c9f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709321, "uuid": "01419670-05c0-4100-bb8e-baf0442fe376", "value": "WiwGPyCg.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a92191-8994-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700698227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698227, "uuid": "69d260c5-5f65-4add-8724-b07c9268586e", "comment": "Malware payload (Gafgyt)", "value": "01146acb24048c16bd7636b26eb58448", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698227, "uuid": "9bb0e17c-1475-49ed-9a34-013fc9bcc5d5", "comment": "Malware payload (Gafgyt)", "value": "20287fd519ebcea05226782854d7b29fd2974223c05cf54ae20115f2f44c9ae7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698227, "uuid": "0f57ec9a-52cb-473c-ae75-cbeaafc197b8", "comment": "Malware payload (Gafgyt)", "value": "2b4e35b4109b9fd1a3f9ee9ffedeb75b5b1b12fd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698227, "uuid": "3aad0ce2-8d84-4259-a551-9718f935ed86", "comment": "Malware payload (Gafgyt)", "value": "b0fb970c61a8568c439d5341db266a07f2af552d0ce96ca4a797ef34cca9f4138b64ba8f7e1b8cb281eac1988be25413", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698227, "uuid": "dbb86933-8579-4b0d-a7ce-cbe47eb702c7", "value": "T190933B17A652C57BC08762F41BCB9A11AC13BCBD0B63A30673D4BCE82B159D72DA9F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698227, "uuid": "4199823a-1124-444a-8afb-1b396dbc418b", "value": "1536:W7WREyqkQc923v2uNi7pNF+BoD34phanvn00JFmoI5um2Xj5YZA0e:4RkQT3v9EbYBo74phanvn00bmr5um2Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700698227, "uuid": "9df2e246-96a8-43c3-851f-04fcfef635e6", "value": 92932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700698227, "uuid": "a708b7e5-b701-4b69-81d2-c32379feb4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698227, "uuid": "ebc66f72-f425-4d6d-9414-ea17cd0b84b5", "value": "01146acb24048c16bd7636b26eb58448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af2d426-89dd-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700729457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729457, "uuid": "f95bc1b2-8335-43c3-84c9-d3b80682c7bb", "comment": "Malware payload (Formbook)", "value": "51b9ff03237be0d2b963cecee17844dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729457, "uuid": "94714160-464d-4009-8afe-e2b7f97d214e", "comment": "Malware payload (Formbook)", "value": "2335a09e51dc8dd9eadcc23afa908605a0678aa0b0fd46f180e6dd628745a0f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729457, "uuid": "b29d8eb1-0582-4104-98e4-b07e3c7d45d5", "comment": "Malware payload (Formbook)", "value": "821a54aa0fd28336d98bca841a41f6b5e8faee76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729457, "uuid": "705fe17e-60db-4767-a789-d9bcad79b9cf", "comment": "Malware payload (Formbook)", "value": "9cf20a7030304df0d3f383b05d5e1dffb86b33784ec12c8138ddd8303708992d7adb4629fd5b863a0d7e772ab279de5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729457, "uuid": "d479b365-3d04-462e-b406-a3e402bc5dcf", "value": "T1EA95E1B1DF60C1B2DD772ABB6C278A55C82E3E902D19383A1FF531895E7A7813436243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729457, "uuid": "ea6c0f92-79b1-449c-a009-f517734d8648", "value": "5ad58dd99cd3bbf2c166bc1ba7c8b1b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729457, "uuid": "744c3260-17a3-4614-b793-1a5b049d00de", "value": "49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4eMyqChsyfue9T:aDqRMXpcOXX8Za31CuCciMXC+yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729457, "uuid": "76e037b0-29b0-4691-9d5b-392e422e856b", "value": 1875456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729457, "uuid": "7ed4a9ff-32dc-4591-8bb2-764a08a7ec4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729457, "uuid": "3bea953c-f349-4943-a8ba-85e21009f85c", "value": "14020611jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e80b1a-8a4e-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700778137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778137, "uuid": "11b1e316-8216-4214-b107-a173c22a0c3a", "comment": "Malware payload (RemcosRAT)", "value": "f12903e841ae2ca1a21bd6dba7728ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778137, "uuid": "86aba5e7-0585-4625-989d-352ac7cee3db", "comment": "Malware payload (RemcosRAT)", "value": "24dd50e989e9496c6833faea5c062a84aa800fd176df7c737d3d3999400cf66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778137, "uuid": "1f15da44-da04-429f-bbac-308789314c02", "comment": "Malware payload (RemcosRAT)", "value": "60471869b56514d8ee3507344bdfe52ef3877426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778137, "uuid": "bd515e5e-f554-4196-af51-8c2de500d542", "comment": "Malware payload (RemcosRAT)", "value": "43f68d09e868b70250ce18539b1c76c978d4d085803f232ab7cd2055137dc0bafe11b468b4f593faebf2c586c6f092f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778137, "uuid": "86a7b43a-ba57-4586-ae35-45c6dafa9e67", "value": "T14F84230021E1CD37E8CE41F026BDD701FAB686588317F68F4B565E13B91ABC66F69293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778137, "uuid": "f45d1d39-47c1-4c46-b5ff-1d5f3a07b7d2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778137, "uuid": "d6f4f793-6d48-4bbc-a53c-302cd2338159", "value": "6144:QBlL/TP46nLG8y6d9RrQCTKrSnlVje5ghNnvwTH9bUpOzGedWpe6SxK:iJg6q56LrLKmjS5ghNwz1UpE/WbSxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700778137, "uuid": "6c508665-a261-4813-b738-a5068c81b1c0", "value": 377513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700778137, "uuid": "a15f83b4-b028-49b3-8d6c-a65543dcd26a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778137, "uuid": "6a86d97e-7375-43ea-8643-60bed23a232b", "value": "QUO986556780090000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9b21ad-8a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700757321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757321, "uuid": "52d7c893-47e7-4382-b581-853b2d53bf4d", "comment": "Malware payload", "value": "1aca726907a824fb77ebfc0b0c68bd05", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757321, "uuid": "b4c6d22c-307f-46cd-a1da-38f80063973e", "comment": "Malware payload", "value": "259dbc9a8763fcb5ce0fcb61ae9b99726c0365758acf1d6d8a4f08231a6719f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757321, "uuid": "5b2e8c73-c81b-441d-a952-e3a59756561b", "comment": "Malware payload", "value": "0750d9dfd1aa6014d340a3427374827c2670abae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757321, "uuid": "f5d5e1ef-973d-446f-b9d4-4fb879b4962c", "comment": "Malware payload", "value": "0dd7a399d9dad3536726b5c61fa158d80d145624decd2d08977f20342a775ba49c7df8a75560195ad4c0181a26a88ad6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757321, "uuid": "0f6218e0-bff3-4ed5-896f-54fcca2dfd3a", "value": "T1EE83A552B5718BCF54C62634D21A48330AEABD7E1BAC1653C8BD76AFCFE405DA0D2136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757321, "uuid": "855a8272-2c63-4cd9-abbf-451d5ab6073a", "value": "384:UAsBHSJi25sfefXrvNFJq7oVtdRTungnZ/t+4AG8glkw6bVJNexgY/lW27m88uQv:XQHui2aeTvvJq7oVhTbn3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700757321, "uuid": "34af3df8-9081-4b26-b874-4d40402991c2", "value": 81816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700757321, "uuid": "d4118291-a2ce-475c-9875-55e478f2c576", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757321, "uuid": "16c608da-afe9-48d0-a5cb-9de25ac3ffc3", "value": "GbardSetup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1f2802-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740434, "uuid": "a780f0f2-3e8c-463c-8048-6f5077a951c2", "comment": "Malware payload", "value": "378a8e0c846bb971ade6e83cc6a3f27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740434, "uuid": "1752f764-a35e-43b0-b2fd-2f5d14dba973", "comment": "Malware payload", "value": "273a3703b5372321e55b95fd7ef3294ff1e06e6f87efe4deb512074673a2c592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740434, "uuid": "c3060505-d8e6-4696-88a3-05b9a326c70f", "comment": "Malware payload", "value": "0e89510d2f9ef1be2cd3116549b38b9f8ad094d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740434, "uuid": "6507443a-4619-407a-9077-d3cf62d58b44", "comment": "Malware payload", "value": "380500310e662577c25b30e356f4feabffd897e980671e409c9046400d2c59c24297224a3040c38a4e3bbda779354149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740434, "uuid": "fef07f3f-71c1-42ea-8220-71d647dac6d3", "value": "T1D4161712AA968225D47E0475CDAA52ED53307C285F104EDB73C87A3939F32E17E327AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740434, "uuid": "51d4a186-dde0-4ac6-884f-f1639a6d2195", "value": "6805b9d9f17bc82a9e79068d20b7f163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740434, "uuid": "90f8bde9-d159-42db-8b32-23288fc67e62", "value": "49152:Pctar2G5D6OZgeihsiPBZGugXX37tv/iaSeGDEDnUs5haXIMg2hyg/mWc2LbG/kJ:6a6yD6etih5PBZGrU+qIsorru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740434, "uuid": "85847a12-171c-4e99-a8e9-f398f7157ac8", "value": 4196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740434, "uuid": "d23cf571-79f3-4b6f-b0ff-c8883a84905d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740434, "uuid": "bb0b3a5f-ba0a-4f5d-b46c-18dbf112fed6", "value": "paypal_inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fc151e-89f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740499, "uuid": "134c950b-c40c-43d1-8dda-8d25c014cec6", "comment": "Malware payload", "value": "dbac5fa1a8d77d0ab7a4d3b0b4c69801", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740499, "uuid": "7449b285-aa9b-498e-98a5-d5b24d1e94e9", "comment": "Malware payload", "value": "28d21731aafd8625551f824a2e7d26ff26f58e1f1c68886696bb1a22b683a038", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740499, "uuid": "4fcf63be-0991-4c9b-9eaa-27ecc53109a6", "comment": "Malware payload", "value": "3d2f2701f87b596ee47ebfa541c4a4cb459b6668", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740499, "uuid": "63dd43e1-7a05-4923-922e-78832a5b3e71", "comment": "Malware payload", "value": "55d58ecb04bda4dbf97c063553fd15319b31b2de7ad100d9c0c640f6b1e926b4f8b32514abfd8d6289f1dcb263c586ae", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740499, "uuid": "53de89c8-3d6b-4c54-9ed3-27688c3a72ca", "value": "T1BC3523CF91CFE4C1CAE154328133694B6BAA8D8DA336D6940AF3F8E9750CB565C2DE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740499, "uuid": "6c3c442d-2fd9-4ba9-a304-8e63cbb08b79", "value": "24576:BBudSBeZ1lMe/jOueneXjZxg6FI49VQOCsL0LLaMV91vrypBXogXa:GDdjjOeXjZxg6K49VQpKwuaVWpBXbXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740499, "uuid": "ce299bf6-f77b-482e-9023-90d93d50da16", "value": 1059429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740499, "uuid": "0bd8f273-a054-4fe9-83fa-4ca8a640890d", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740499, "uuid": "5d9bd246-ea97-4636-a2dd-9c234a458514", "value": "jouk2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14872983-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743914, "uuid": "bcb16b43-65cf-4c1d-85e5-b6de5c531939", "comment": "Malware payload (Mirai)", "value": "e51cfc43564c14d3f5065a4bbb0e16bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743914, "uuid": "3eba1bed-db56-4620-a1fe-e04ae5d5fd04", "comment": "Malware payload (Mirai)", "value": "29a4bceaa197849c2a4b982d6708d6e16961644f4560c2684000145a3cccb55d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743914, "uuid": "bc628a45-6a0d-446e-af7c-eee4cf45de96", "comment": "Malware payload (Mirai)", "value": "efa28b3be29f395dc87b3a951db5f8979724067d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743914, "uuid": "4c2956a3-6a89-45f0-88d1-1e77a13d0129", "comment": "Malware payload (Mirai)", "value": "4cd376dea61e8399e2fc219064c5c6d5d950acb3b1e309bff35470d0acd2562ee06518d953d6d16c03f3e0366a6e2042", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743914, "uuid": "cb343759-dff3-4507-8e6c-a5900cc6b9e2", "value": "T125C2D184F0418B01CFFA28F13E44CADAFBD06F5F9A618E9136A552D26B5D2A34706DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743914, "uuid": "fa009458-566f-4121-98f7-2583027f2645", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PC4uVcqgw09X:mam+AnKehPRa9aq4u+qgw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743914, "uuid": "694c321f-6804-44d8-98e4-47d734f5d5af", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743914, "uuid": "be51b2f1-6524-411c-8667-6979c3e77c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743914, "uuid": "953d264e-f6e4-4b9c-9692-97d99667ef6a", "value": "e51cfc43564c14d3f5065a4bbb0e16bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee629063-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700724523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724523, "uuid": "46e939e3-a432-46ad-941c-e1fb6f2a8b7c", "comment": "Malware payload (Formbook)", "value": "e5b9d2fea353e5873522338e9bb687f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724523, "uuid": "e2a0cb84-13f5-4c70-bc82-a9d8aae640f5", "comment": "Malware payload (Formbook)", "value": "2c4d41d6d71163b0d176208b4f74d23f64a230d3cbbb591703e478b85cc5a697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724523, "uuid": "853ce599-9066-456a-95f9-40b7d339af9c", "comment": "Malware payload (Formbook)", "value": "116f55316e8e27ae324ccd86c14f0a80897a0a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724523, "uuid": "090180d6-ae9a-45e1-aadd-3b2ecf52bcc8", "comment": "Malware payload (Formbook)", "value": "43b8027512b35d5adbf140420392ecf993304e370091595fc9ea5f9394ae0b20f7442850ebfa58bd6a94dd64dd30862d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724523, "uuid": "c9bccba1-2478-4275-899b-559b7ce6247a", "value": "T1B88423A8BD96C4A7E98343B38455332DC37399144772944F0B532FBE2E586C7E70E68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724523, "uuid": "79e6eb42-e7d8-42f0-8807-9ae3a55d6637", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724523, "uuid": "f1d13e34-39de-4f2b-bd03-35e6a6d19c40", "value": "6144:QBlL/TuPAu7ADbGvoHD895qRtf6WRNjLVaRQxHQ81At/rQ54AwexZZlKOTHkk:iJuPAu74/WQrfh/a6e8W/rQ5F1jZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724523, "uuid": "9a583005-5c8e-4bf8-a486-04c219eeba12", "value": 391299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724523, "uuid": "cd347825-4d1b-43b0-b3d1-49363cbdb88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724523, "uuid": "193940de-45b9-4ecc-b1a1-537ba7f7aa65", "value": "QUOTATION#67353-15-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fbc395-8a50-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700778698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778698, "uuid": "737f29e3-5234-4c17-b8e4-ba4d93e20fc2", "comment": "Malware payload", "value": "d0fa4550d0016770daaf9e70fdec5471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778698, "uuid": "241d2199-7d2d-423f-bef1-b2335233a074", "comment": "Malware payload", "value": "2d553e5e85e981166351ac18728955e70c4bdd64cc504b7c1aab0c544df2c893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778698, "uuid": "54183f1f-f364-4fe5-8d9a-90d9483e2d9c", "comment": "Malware payload", "value": "af9ce63cebcf884d2941272760ea29bcf6087f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778698, "uuid": "818998c1-db86-4100-a2c4-59715a27a0c9", "comment": "Malware payload", "value": "668a59ee253729340f71715a962e70226e1504627dd6333519f986a4aa77180e90b6cd84651599cc5f6c32740061b2e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778698, "uuid": "0d842241-d469-40d3-87b8-002346e4a29a", "value": "T1D6D4AE823148DC9AD54329F348AFD53062B87D9E8125C60E3783BB2695E7393346B79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778698, "uuid": "3575aa02-3e71-4226-952b-5f6417abc14d", "value": "12288:6jxONnpW3PF4u9unyH1k4rrIUI1QHxsSiLzWK:6jxONnpW+GG4AUFKdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700778698, "uuid": "3696137d-ed01-4282-8dd3-926ec4675880", "value": 622128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700778698, "uuid": "dc754519-b3eb-48b1-9880-9385be511f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778698, "uuid": "f61605b8-491f-4284-8eef-dfb246af6856", "value": "ZARFQ-202300908-DL-12-267 268 265\u6a21\u5177\u8be2\u4ef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150801df-8a0e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700750358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750358, "uuid": "8cb19320-a0a0-4189-af16-816b5ffe3614", "comment": "Malware payload", "value": "74545f8dc69a3849c1c3a0df7fc32078", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750358, "uuid": "c10af6ef-2bad-42e4-b8e6-8d49fd407230", "comment": "Malware payload", "value": "2d8a5b637a95de3b709780898b7c3957f93d72806e87302f50c40fe850471a44", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750358, "uuid": "eb2e74fa-86f4-4853-8ed3-3c186f5d73ab", "comment": "Malware payload", "value": "a3820e2913313629832a3aa8d2ee1fd5b2ada21f", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750358, "uuid": "0027810b-1f51-49fd-9c52-d55f317265f4", "comment": "Malware payload", "value": "28423e45fc5579f5432e5503a9e80bd9816e38517159b7bdc18d85179ff1ff12e4542baa3ef0dc945c2c026db7efb6e3", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750358, "uuid": "c4cb40a9-6709-4980-a2b6-fa38f2263b81", "value": "T1D4B36C17A3A500BBF57A8678C8530E46E7B2B4150B609FAF03A0875A1F673D19D3FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750358, "uuid": "73d0a6fa-a609-4a16-9600-499d8068aa8a", "value": "0ff8b58515b3fa045e6bff9a9e0cca16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750358, "uuid": "c7859148-9a9a-458a-a39c-e676b86e1d5c", "value": "3072:P1uNKVtUx7SN7klktpvvuMJD/R8N4REf:INKVaYdklktpHuc8N4Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750358, "uuid": "39cf09ad-bfe4-46d1-b3b0-a9ce9dac74fb", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750358, "uuid": "5cfd1e3e-d766-4841-b58c-3cb60f205ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750358, "uuid": "b75f55bc-5d15-49fc-998b-81209cddd9d2", "value": "store10.node.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2f2caf-89fc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700742885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742885, "uuid": "abc73a3e-f8b7-49a1-aa4f-f3c6b751f9cb", "comment": "Malware payload (AgentTesla)", "value": "a8bd42f621e7843b1d37b40a410acae1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742885, "uuid": "bb603a21-321c-4b74-b01c-e4e056403117", "comment": "Malware payload (AgentTesla)", "value": "2dfbf85c26d893e4dae9ca72d6677f00789c7f69ada570b93ccfccc1f37f5225", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742885, "uuid": "59d260d6-6761-4086-86e3-3d3236276238", "comment": "Malware payload (AgentTesla)", "value": "2939673ae8f1d923175f4d81e52999d8465d6691", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742885, "uuid": "87e46766-b5eb-4b12-82e2-fb5d4c1b9b23", "comment": "Malware payload (AgentTesla)", "value": "216a4d65f3e29f6d69c0aa92a022995fd2304a1202fae865cdb62006dab937c030556651c8057203217dd409f10a2c20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742885, "uuid": "399cac15-227f-4a0a-bbe7-6c396785c602", "value": "T1ECF40115737C4F25C97E6BF65825210143F6BCAF6872E30A8DC661EE2662F401E82F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742885, "uuid": "da53f954-b6d5-442a-a373-6dfebeb19bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742885, "uuid": "f9d754ca-ef37-4503-907e-ba6f163690a8", "value": "12288:H1CFoELXGkJlZCLFOfrEAlYH4Q0MCSOTfwXNpL6Yq6ZVuyBTGmR4euvCBc3qTdkS:H1CFoQ2k7ZMFOfCz0MCcXTL6YqSQ0CC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700742885, "uuid": "44eadcbc-df04-4b33-a87d-bedb12d6a5e5", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700742885, "uuid": "10e953fa-2896-4067-b601-3936e31c63a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742885, "uuid": "87a77b5e-2562-4605-9fe5-e64d76b3c609", "value": "SecuriteInfo.com.MSIL.Kryptik.AKEC.tr.31431.29608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada77ad5-89fc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700742883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742883, "uuid": "5ec38b15-4a54-4aa2-91ef-777bce7ef860", "comment": "Malware payload (AgentTesla)", "value": "f53f89257da1d668f627ee824af4daa0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742883, "uuid": "9cff34c4-20a5-4fac-9287-1d41204560c2", "comment": "Malware payload (AgentTesla)", "value": "2e1d8dd0bf1511be6665ac5739ae946357fd033b2e8bbac18ab1b9495c2eebfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742883, "uuid": "bc52e427-897e-4630-9bb0-37d932480194", "comment": "Malware payload (AgentTesla)", "value": "2dcb6c1c125f93fcc1085992ccc20739e7a9c741", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742883, "uuid": "b11d9cde-5f4f-46a9-b67c-20684d4575de", "comment": "Malware payload (AgentTesla)", "value": "bdc4637fae6caf17db768aa464bae429da383d04e075f0ba7f53a4a5bed3ad781a45628844d45ca34fbdf312e5897ae3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742883, "uuid": "e8c8d468-be7f-4124-bc80-447964f6ae38", "value": "T11005CF1876B55FA7DB3A83FA5410560407F67E2D503EF35A1DDBB0EB2AE4F800A84693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742883, "uuid": "839b08bf-fad2-4934-a1e1-695606d7f1ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742883, "uuid": "1f3ad759-5714-449c-854c-407f31c70cbe", "value": "12288:xEc7JYE6jD/pLXGkJl8Me3uimGsyTM86fpzLUI+HHnQg41aPp6nj2l4D+yJj:rYtD/F2k78ZQGsuOpFG41a4nND+yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700742883, "uuid": "ef404ca9-fd60-4abd-bb44-5781b87f2538", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700742883, "uuid": "fd7b1b5a-6b55-4749-bdfb-08752a41bd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742883, "uuid": "54bc9465-598e-41ac-ac91-ff8b660d454c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17576.21144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c7e188-8994-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700698041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698041, "uuid": "5831ed6d-2291-4ac4-b684-d6a48fa2c745", "comment": "Malware payload", "value": "fa139ae9c858237134267631faea725b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698041, "uuid": "2490ccda-4f14-430a-b098-b86885224243", "comment": "Malware payload", "value": "2f8ea8aa8c05d94beedf55231e5a354534d3c8ff9c57e6a78ee58c6d9ed533d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698041, "uuid": "268b6ee3-2cf5-4ada-9698-5a78b30a8ab9", "comment": "Malware payload", "value": "47761a9ab45df5ee6cb016252b598906c60b92d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698041, "uuid": "a4cbb8a8-0306-4733-88af-68b772224527", "comment": "Malware payload", "value": "bf78006d29c74c34d8e0a0e517f918f9ce7ac0e03c39a282ef31a493c9525629aaac2a93a6725ccd469b5e2aab694c97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698041, "uuid": "1575dcc0-ccb2-4aeb-a5a8-e9f8c6cb133a", "value": "T19DC2195D3B908166C2EF2BB006B2DB2502F2E10B5A17EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698041, "uuid": "459bdba3-f3a2-4353-8ed8-86d4bb405f5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698041, "uuid": "7c478586-9e2b-4646-8f79-bd8203bd2368", "value": "384:LLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bGtVvGD:fl8AA/6T5e/gsEZVvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700698041, "uuid": "142a8f3c-f2a6-4c1b-a2bb-73721f20fa58", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700698041, "uuid": "f3e54ebc-61ba-4876-8532-62bfb18a6697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698041, "uuid": "75cc2e37-6c72-4328-b221-0242c8e1e6a4", "value": "bRMW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4a4467-89a6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700705672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705672, "uuid": "b26d75da-4ef8-4f54-83a3-b5eb6a6713f0", "comment": "Malware payload", "value": "edb1f74abcaddfeb485077c22fb3c4dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705672, "uuid": "8ee29533-0cf5-49a3-aaa3-29bcd31045d9", "comment": "Malware payload", "value": "311b94d883fd66e67169811ea1e0d25e1b01294cb7a261fee39c288c1a519d1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705672, "uuid": "7d5770fc-601b-40b5-a583-67ad93e423cf", "comment": "Malware payload", "value": "efb10ab1b3f59b3a8c86828123833987022935e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705672, "uuid": "277d41ed-4d05-420a-8a3c-44bfdda73426", "comment": "Malware payload", "value": "aa7e5952cbb6d3818988c2358b011b98b83fd6ee525804947b6d803276ed39d4303cd0ac0623fcfc1aa08b3d5f3bb18b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705672, "uuid": "b7f95db6-8c97-4308-b11a-efd15acaaea1", "value": "T161D2D02A0605116FD926C4F64B750FB1ACB907A3A403ED2E5D7DF50BAFC54B836A314D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705672, "uuid": "7351a3e3-d79c-42b8-9937-a9c11d46cf15", "value": "768:AexBaZqScetAhAKouHGNsYJ17Jv0tOvzsJgGlzDpbuR1Jfa:7xQIFiN9utOvzkVJuta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700705672, "uuid": "51d4a1a2-c4e8-4b53-a460-5db7cb17f585", "value": 29772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700705672, "uuid": "e2319b84-572f-4295-8e93-7fd5347a1789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705672, "uuid": "fb3a540d-a447-49f1-9072-0dbe4a8bdd0e", "value": "SecuriteInfo.com.Linux.Siggen.9999.16820.21768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fdd462-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700729049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729049, "uuid": "40c6ff9a-3ccd-423e-b756-4dce423365e2", "comment": "Malware payload (Formbook)", "value": "bfe912060cf1dd12dd1459b8a4fe2108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729049, "uuid": "4166d849-f45a-4d24-a42f-f260a276b6d9", "comment": "Malware payload (Formbook)", "value": "333634b6e8955d62af9c246e72b31fb40bea3344adf37fe96a1a02d31cc5c43f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729049, "uuid": "79c16846-1767-423a-89ec-8c0f12d14aee", "comment": "Malware payload (Formbook)", "value": "d68cb09ce644dd3f9a98ec78de4335ced889c33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729049, "uuid": "198d6b31-e69c-409d-8092-d6678dffe8ff", "comment": "Malware payload (Formbook)", "value": "5e62a42a4e24a40c09bfc5ac904dbd7876597a5472149a41a44e0bd4061872f6286e596fbe5e580c4981e4d52a0066d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729049, "uuid": "1673c981-3afe-47ea-993a-8caad0a0e48a", "value": "T19F459D05B2A68B44F17CC7F440526092A7F47C9EF25DCB8B8DC779DA39B0FA11509A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729049, "uuid": "65804e7f-9801-4d4e-a54a-9e5cfd8218f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729049, "uuid": "d22c557b-6469-4516-b6b6-e47e29331607", "value": "24576:yW1zMT7ct/dnN7UEUG0Qct2v/4rhvcLcgV:yW14T7cNdn9UEdXWhvc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729049, "uuid": "0218e85c-b1d8-4599-9f63-9637420b42dd", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729049, "uuid": "37fdf9a4-15d1-47a2-8726-2460a1f8dbbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729049, "uuid": "d15bc56d-c42a-4eac-8d24-238131f4a2cc", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f88b2e0-8a17-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700754268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754268, "uuid": "5eaa8fa3-eb0f-4252-be6c-12a288dbbdf3", "comment": "Malware payload (Formbook)", "value": "3e62dcc8fc5c3eff612278d8768bb86d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754268, "uuid": "467de8fb-419a-49fd-95b2-b6b168e14b40", "comment": "Malware payload (Formbook)", "value": "33d4f40d83493428f817717c92af34b335788346735a5563e7ee515993fa8d93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754268, "uuid": "396ceffa-c28e-46f3-ab48-fd96412fc542", "comment": "Malware payload (Formbook)", "value": "e25713624a7c9c632561fdd9026fcfa1da5cc075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754268, "uuid": "21c9fc5e-7f7f-45d4-92bc-3b2db3f02c2a", "comment": "Malware payload (Formbook)", "value": "2ad93c357e892e683defbde89b672eca65f87893837b91f11f6e43ca27748a8e01f1d4ab182bf3c3e7f8d51892d59ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754268, "uuid": "2cb35a79-64a1-40c1-ade1-881fe4f48874", "value": "T1D715F1006EA95B55F9B6CFFD032C62180FBAAD0E67E3E6344EC564D96063B43C501AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754268, "uuid": "8db73ebc-0704-47af-8aed-f5f26fbe7050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754268, "uuid": "112247fa-8355-435f-9d17-476a308e1512", "value": "24576:uy172zSObdMzTmihn7cOz1mg5cAG3voBy:uy17228dMzTmeQOz1mgC3voB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700754268, "uuid": "6aa70ef6-6628-42e1-b41b-a12aa96ba02b", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700754268, "uuid": "1357c844-4fa8-4cd4-9a2b-edd0ab5dd6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754268, "uuid": "6cf82931-4e16-492b-a892-7020936221aa", "value": "rCustomerOnDemandNotice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cfc49e-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724237, "uuid": "6d3b59ff-3f14-4c82-855d-37e7f6fdbf53", "comment": "Malware payload", "value": "ba0ad8ec62aa7f31c8d4e492e57f5221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724237, "uuid": "93881934-9bef-4b62-b3f7-18f20e2caf68", "comment": "Malware payload", "value": "3570d5a817fb0dada6cd6e486695a3f8bdb4cc7b6e0bd33b8ebca43d781afb65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724237, "uuid": "2e0b7ad7-2eaf-4926-a182-a9db88ce0d2b", "comment": "Malware payload", "value": "f1b503aa6bc8e39ea4597d6a6c85c31351afacae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724237, "uuid": "c87cedb1-6959-4b98-8d18-4a8619347d3f", "comment": "Malware payload", "value": "c73a7c22546492228059db97877bafaa9a2351bc7d6f01385136f584690074a83567a4edcec087c039064fc7bbedc553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724237, "uuid": "28dc780a-0bc9-4279-b16f-a3cd57683263", "value": "T192133C4C3BCD25E1C67956BD8CE3324543B1ADB72A12EE199D4972180873AE26533F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724237, "uuid": "fbbad852-4421-48cb-81f9-99202e58bf92", "value": "768:AJStxT8js2XJc8KCADHxshXlX1fYU4YfZQp/5d8tz/pM:j6R5GCAtEXlX1fcYqdr8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724237, "uuid": "7de1179b-2798-4fee-98d8-6d9f1986dcf4", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724237, "uuid": "a8003af5-ac51-433d-8aee-b9a3e2d53b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724237, "uuid": "dd18e62f-21b9-450f-ade8-56390367b33c", "value": "MT103 Remittance11222023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcec50d-8a33-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700766505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766505, "uuid": "77846ab7-d344-45e9-8a93-1a31bdb0f977", "comment": "Malware payload (Mirai)", "value": "3c4942064b3e72b2a00e50f380273a63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766505, "uuid": "119ec328-d02a-41bd-8a87-c663fb8302ed", "comment": "Malware payload (Mirai)", "value": "37018d629fa88d9b99220982142fbdb682bda5ae46f47ee3ecebc97b67104409", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766505, "uuid": "f1d18326-55f2-411a-8bf0-82fd81af87c3", "comment": "Malware payload (Mirai)", "value": "616604beb5e97d479a72d0b57a815916db63645a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766505, "uuid": "5e704099-4cd1-41bb-80d9-7743efbbfd53", "comment": "Malware payload (Mirai)", "value": "cef63009d07da25305f2aff11f55bc746e71aff4a784229156d8525e0ba9645ed836f1c14f688e3fb49f25d7dae6ce15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766505, "uuid": "fdb22383-8a6d-46ff-ab4f-434e4d917c8c", "value": "T1C3C2D1E07726EE31C4206C3DE52A4D893A51167C91FF393664258D398EC1A9B63F84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766505, "uuid": "ab8af36d-0716-4956-991c-2c305347d0a6", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwr7f9q3UELuc:NKy4qfqoeJdXWg7OLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766505, "uuid": "4046d483-f1de-41a1-aa2d-929761e49909", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766505, "uuid": "12110de8-6514-4342-9825-7a16a0134f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766505, "uuid": "3048014f-f70a-43c4-b315-cf1f260d022a", "value": "3c4942064b3e72b2a00e50f380273a63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88369423-8a2d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700763865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700763865, "uuid": "28da263b-9b2e-4be2-b5f3-feaf2bfd9b50", "comment": "Malware payload", "value": "0b21b1f102e482467151450d221cdfed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700763865, "uuid": "962f0127-46ed-4187-996b-df60882d258f", "comment": "Malware payload", "value": "379e6a65665704da3c37590f891fe1073bfa4d71a999c8b1252032683ba32d52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700763865, "uuid": "d954809e-a0cf-46ea-959e-07202dd0522b", "comment": "Malware payload", "value": "57aae53641793d8f40455feff5f2dae7b943e438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700763865, "uuid": "9dc9fefc-bd14-4ada-8b31-5a53e7c8663a", "comment": "Malware payload", "value": "7b3553e735e767f0322062534db971e35f5fa58ac5d2992611798a557ce94b6eb0b6d1f6969853ddfd5d0c2e78e33c7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700763865, "uuid": "a1b7a6bc-cfe3-4694-8e62-a45844cce7db", "value": "T11DD5338BA582E9F6E03B99700D246EBE49EBB9D6747A941C3CEEA44D1F73116100F374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700763865, "uuid": "5e04973a-f853-4b3c-98ca-1280d9e3b7f1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700763865, "uuid": "2241bf4c-1926-44bc-b3a4-2a042c1c7ffe", "value": "49152:O2YwvLbBL8IQbDbq6hhFiucmUHq2uK3njQJJmgBkVrAhUQCe4f4/fzdedvQRY0E:XfvXBLk42UHuK3jWXWKOe4fWdmQlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700763865, "uuid": "a2edd972-5fce-45b3-b0eb-fc35c0df3239", "value": 2881599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700763865, "uuid": "07f741d1-ba41-4e75-8196-2775da13969d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700763865, "uuid": "f6dee161-3c08-4931-b86b-712f87a1d964", "value": "0b21b1f102e482467151450d221cdfed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1e2861-8a14-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700753109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753109, "uuid": "42f55e8d-ad90-43d5-950e-aaf404546ac6", "comment": "Malware payload (RemcosRAT)", "value": "37a55a743a71586c0123c4665c3538c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753109, "uuid": "2e1303fa-f48e-427b-a1c1-e1ccede01d6b", "comment": "Malware payload (RemcosRAT)", "value": "39cfed9bc36a60d1b187120ab4915411ab74110c601c3662ca0c1bcadf114d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753109, "uuid": "14aaecac-47f3-4ca9-a5c3-e269ef9a595f", "comment": "Malware payload (RemcosRAT)", "value": "3b76203e173497f148833745df0a4f92804bac47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753109, "uuid": "68060d45-e7ba-4dac-b99d-ac08893bca62", "comment": "Malware payload (RemcosRAT)", "value": "dd1ac74cedc6f19f3a1093b59b39814bce720ffcbfcd62d695c00e70af921b86fae835e7bf2592cb18a882cdd2a71a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700753109, "uuid": "0ceeba57-4faf-4e88-8548-cca76b714687", "value": "T178C4F1D63A838DE1F5F1073096628B61F795BD05AD504E2A27F0E6CB2DF1287E876360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700753109, "uuid": "e3304b18-b458-481c-a2b5-4b2e2eff9fae", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700753109, "uuid": "a0b47ceb-1d8d-4dea-8729-00bd8b7519bf", "value": "12288:UMwwkS7HrstA/a2Ew628F6Seemn/PvwNmk/UbV6GTA3:UMwwpN/BEw628F6SeLPvwN3UJA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700753109, "uuid": "5c53cf38-d47b-45ff-a7e3-d2087d556007", "value": 553903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700753109, "uuid": "ba242ff6-9035-4309-b3b6-e5936c09fe42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700753109, "uuid": "6052b850-1ed7-45d3-8231-d86d53f3b1a9", "value": "PO8732401895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5da381-89e9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700734668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734668, "uuid": "4125d058-87fe-4f9c-82c3-bc126e00373b", "comment": "Malware payload", "value": "06e0bf26b8689ddba07f2cac9a635d9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734668, "uuid": "f1f1d166-d81e-4310-8627-90d6c18c6549", "comment": "Malware payload", "value": "39efde546c22819bfa1f9929c7a8fd46c871cd68736706ede38d968b320e8442", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734668, "uuid": "bb9bc999-3324-445d-9294-74dd6b4080f3", "comment": "Malware payload", "value": "e50253eaa7c223de6b9d15f857a0fe22673cbe23", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734668, "uuid": "b5046637-396b-47ee-843a-cd0c969bf766", "comment": "Malware payload", "value": "15c7aba0d0ac4edd80f0f13e684d57778558b9afa167b6520c495ea73136e606bea88cb5bf94d8b7e24273e04e60638c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734668, "uuid": "ad07e378-c6b5-4b4e-b930-94153cb22666", "value": "T17BA38D217550D033C4EB553A41A6C6626F7A76314BA898C7BFB40BB96F603D0BB3670B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734668, "uuid": "d51bc19d-bf70-4861-977c-78d328dac8df", "value": "3787119f8b88e0b67e9e2f9c939b5007", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734668, "uuid": "5372cac3-e6ff-4db8-bf42-d3a76dcd166c", "value": "1536:oJjz0l+y4niRTvRWQd2nEdY+pqhpP9GkmDWR/inKoVZVhg+bsKv:Rsy4EUbi7DO9obVhg+b1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700734668, "uuid": "863b27b1-3279-4f9d-84ac-a76acc22a839", "value": 104416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700734668, "uuid": "e8bee8c9-1568-4aee-98ee-471e3496333f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734668, "uuid": "b68fcc30-b19f-4a96-b323-cd586480231b", "value": "SecuriteInfo.com.Trojan.Win32.Loader.cm.7271.20713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9334d3c6-89db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728665, "uuid": "e045238b-0d3a-48f8-8ffd-9281fc4ec96f", "comment": "Malware payload", "value": "12392250d128e4432f3681453f0941f8", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728665, "uuid": "2bb6691b-6b03-45f1-b2b2-2717ae2e86b3", "comment": "Malware payload", "value": "3a7b0e7fd9d1eecb0db7c7d855119334238907290fad38e5ed036e122c25a01d", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728665, "uuid": "7ba8f60f-a1ad-4ca9-b0e7-1b04e63f0e34", "comment": "Malware payload", "value": "213a1ec458b166bd879ac3690cb2e71040f07820", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728665, "uuid": "f834ba81-b51e-4bce-875a-f6c9c83291cc", "comment": "Malware payload", "value": "b523ebdf743e9b6b587f02306c519505bb4e2c611a38abe85ec16d7931a3824114db4be462460aa544a3dad5710794d4", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728665, "uuid": "7f1ff873-32de-4bd0-aa87-f7683fe84e32", "value": "T1ADC423DCB4FACEFFE95C038294E1015F1201E2CAA51EBD8E7652A6CF85C4390541BA2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728665, "uuid": "0fee605b-fd52-4094-a1fc-39e43f950c06", "value": "12288:NtEhuQamOCF497/A+SPD5Q/lt+aiYpXM7Vj7LRao4/QX2xiOesJZ2aU:NtzmdFg/A+S9IHiY9M7NXoQBsJAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728665, "uuid": "308664c0-50a7-48d9-9362-880c204c779a", "value": 589490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728665, "uuid": "0d9b0a15-2e08-4d50-9db8-aa2e9f24be1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728665, "uuid": "9b5d6017-3b7f-484e-a6c6-a124545ed96c", "value": "SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5500c7c8-8a39-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700768933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700768933, "uuid": "e9fb2b45-aa82-4b46-852f-ca177c2fb7c0", "comment": "Malware payload", "value": "f1bc7841474849a77e8e0b2e507f2ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700768933, "uuid": "ce77a1cb-0370-44e6-8524-3d921787951b", "comment": "Malware payload", "value": "3b2776d93feca48f02f530dff6a3d4d918d94ce4e61c249b9f51f24d1d090d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700768933, "uuid": "4b171010-56d5-4cea-bdfb-df07c7ea0a52", "comment": "Malware payload", "value": "eea072584a9227f763d15d784eb52c64453c9505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700768933, "uuid": "276890dc-5251-4c4f-9cfa-017ff1a21103", "comment": "Malware payload", "value": "273f771991e97bc51ecf9d3b7961dab56647e1831d97393edc0ba31adfed07875e2a9aad390b2ec47f4048f36c299f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700768933, "uuid": "8d383354-9d6b-4179-a238-2862949d8c6c", "value": "T16DC41216A6D56A32CCBA947E37B363F407EE27A5240DE5114790327CA2BE5D27C08F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700768933, "uuid": "214d98da-bdb0-43ba-a6f9-92d8fb201f8e", "value": "e27e863878b286ab3210255a9ebcda55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700768933, "uuid": "aa31a849-69d5-46e7-b4f4-809b66e30919", "value": "12288:C7oVrmFrSStI0kPUjGn61DfVwZ3pSOPXb2c1wxC3Si+hjTO6HH:3i/i4Jt9wZ3/bTwxQgVTOOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700768933, "uuid": "d5a6ee41-707f-4383-bf6e-ae7af5d8ad2f", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700768933, "uuid": "5d2d4992-d3b4-4044-98c0-5e75c2d90d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700768933, "uuid": "d3e72fca-802e-47f9-a929-429e34b92766", "value": "DLL Injector Resou_nls..scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fded15-89f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700738030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738030, "uuid": "c4a0ac9a-f0d3-446e-98e3-6d3b8c491f50", "comment": "Malware payload", "value": "23cc0f81619254309799e918ee40fee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738030, "uuid": "79aad804-8fd9-418c-9723-21d03c1f55e2", "comment": "Malware payload", "value": "3c47f28be9b0985a64ec458337ff217346a69d670cdc582f6813f32e8d75ed52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738030, "uuid": "76f7c286-a06d-4fea-907a-d43b13780912", "comment": "Malware payload", "value": "0c340dc953ac449c52c032f31f2b76925e162748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738030, "uuid": "ba14ea4e-ee4f-4278-8eb0-1c21a5a30fe8", "comment": "Malware payload", "value": "d15566476e20bea006cb8ffc42a96090ab75cb31f6ae6ac426a1d3eba89120c226c138213fc116386e66907d30718a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738030, "uuid": "db7d5502-360b-485d-81b1-8557cdfd3820", "value": "T1B9F54A5E79736D1ACE4D11F1D7AE49086B88DC261710A54B368279CEFB3C1E6C8CD28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738030, "uuid": "b6ed8212-5068-4819-a48e-7285116509b5", "value": "49152:ZYlyMhfqtgEMWQ+s0rW32DyWxHwvSVF0:ZgyMhfNGym2WavSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700738030, "uuid": "305c5b24-5e6e-4eb5-9554-b36135985a1e", "value": 3352064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700738030, "uuid": "beb8f1f9-949a-4fe4-88b3-e8ff6eb122fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738030, "uuid": "405d2519-5c51-4486-aa8e-27d81f1a0223", "value": "SecuriteInfo.com.Trojan.PackedNET.2228.15344.708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2205b8a-89e7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700733951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733951, "uuid": "e5b638e5-14db-491c-8c14-8154ef024452", "comment": "Malware payload", "value": "d5e9e6554281ea3efa2b1e40aeb9cb8b", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733951, "uuid": "a411906b-cc5c-4190-9cfc-b0491b3d966c", "comment": "Malware payload", "value": "3cbd732d1d9b72c12fd0b5338f6ea6417ec2d242f258fedab71fe48cdadccc2a", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733951, "uuid": "794d1efd-1b8e-41c3-99e4-aed88b515ed3", "comment": "Malware payload", "value": "4152ca6e3146483ab96a8cea6cad1285cd12e80f", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733951, "uuid": "c7752da8-ecae-478c-b299-457bf11fbd4e", "comment": "Malware payload", "value": "57d3512de27990e8e0fa51e8ac6f5b00ecc21b6b71697be4bc5a50d72c221ca9d336620b587cd2aefc68b28328f37dc5", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733951, "uuid": "68cee654-7212-46bf-a88c-cb2d017bfebd", "value": "T1551723C7DADE93ECC0C31F242586139624C0719FC5ED8A6D36CE5C05B522DAA85CABB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733951, "uuid": "7e7aac50-0c81-45a8-98a1-ae23d93da7f1", "value": "471bac843c91a9a3ab7ad3e9a3e34c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733951, "uuid": "e5c30044-cae4-41cf-b43f-9ca292258b1a", "value": "393216:VexY3xqC4zlB2qIbgpXAKCcOcfUz15rJE:0i8CClB2lUpX1BO8C5rJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700733951, "uuid": "dcc1bf3e-0886-4bfb-bc42-90b51ad0c46d", "value": 18786608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700733951, "uuid": "9a4a2122-629c-46f0-b77e-7f779eca3795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733951, "uuid": "ca74e229-7dbb-4867-90c9-77442b43e885", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d00dc3d-8a31-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700765403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765403, "uuid": "0dff2c60-301c-43b7-af28-47d11d4ae224", "comment": "Malware payload (Mirai)", "value": "dc77e67843b5888482ef09df0ee11f11", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765403, "uuid": "656c36a7-6557-42c6-8500-94a616f101cc", "comment": "Malware payload (Mirai)", "value": "3cda4f664e68392fed077781143242268842a8a13e998508ce4128d84257004a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765403, "uuid": "5e347784-99fb-446e-9471-21a1f23d5c2a", "comment": "Malware payload (Mirai)", "value": "d2c3d467b94cce382daaa1bc625b9f871c77eba9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765403, "uuid": "ab13b7b6-bc41-434a-a01f-39cabf5204d2", "comment": "Malware payload (Mirai)", "value": "98415fa9b7fb99039599aa1434946b57b05399e5ee82f4dfa74559083558c2258dca21429cbd7556577058661f30206d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765403, "uuid": "e27ae804-a8d8-41a8-b82d-84f5925bb31e", "value": "T1C3230231890E9EB164303C76DB99D39376F12AB1C6673023D6284E386F75A231E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765403, "uuid": "242317df-1280-4d2f-8f2c-6f0534e0d593", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3c19q3UELbUXfi6nVMQHI4vcGpv4:gECFd+A6YHAx3LRQZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700765403, "uuid": "4971fdbc-38a9-423d-bcbd-c78c5a5fdb6d", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700765403, "uuid": "72722d03-983c-4fb5-b0a3-dea2451922b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765403, "uuid": "fe1b081e-fc68-4052-972c-3c9e87880db8", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a43b572-89d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700727791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727791, "uuid": "198cb22d-9b35-41a4-85b8-0f04ea12c112", "comment": "Malware payload", "value": "b4850434440d04f32094824007e152e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727791, "uuid": "4fca6431-5b71-4121-9257-a51f0a150476", "comment": "Malware payload", "value": "3e5b0954eb08006cfb17c3d3177d29a5f68f60ce981ab52850918d5b30fa9904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727791, "uuid": "daca18ea-453e-4f70-be0a-42ffb19aa2bc", "comment": "Malware payload", "value": "88593d39bbeb5af3e93237ae096dfdf4067dea60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727791, "uuid": "ff495718-043b-48d6-877b-e43c8dd0ad89", "comment": "Malware payload", "value": "0752924b65270d23f7e0877c08627f08d71af64325e263b47d0d55009eb6e89b391a05c58c0da4899a5518f2bfb46974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727791, "uuid": "e2de8796-0f5b-4b4c-a674-e865f1a2aad2", "value": "T1B615DF14B6B55F97E77A83F95410520407F66E2D503FE74A1CCBB0EF2AA4F900B94AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727791, "uuid": "77fa620e-75d7-4ae7-88ba-bfa0b7731ba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727791, "uuid": "377c1151-90bc-4ebe-810e-e95c430ed0b9", "value": "24576:DAtD/F2k78rAzQlG1FPFM5Q410dor1ggw6v5MWI:Dsgk78rAI7r1gIhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700727791, "uuid": "4e4c2f74-3641-4db2-a0f2-637447ee4ecc", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700727791, "uuid": "144d952b-796a-40c2-875f-d5294de4e6ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727791, "uuid": "f2048eb9-029f-4352-b619-06b700ed24e5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3194.11880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ecd9a6-8a11-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700751755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751755, "uuid": "f2a74f3d-b348-41bd-82d7-f6b2431b5886", "comment": "Malware payload", "value": "4a45584a0259a3e935e1004169c16e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751755, "uuid": "52978832-a258-40a2-b455-9fcacf952e17", "comment": "Malware payload", "value": "415bf1a2b1e00420502e3ac845170724004aaac7512b96440e2eb2965846bf51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751755, "uuid": "27364249-3507-4ceb-b376-d14f1f3cb568", "comment": "Malware payload", "value": "16c645f281affa25cfd93d3c065840c273de27ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751755, "uuid": "e3d52d92-09f6-444d-b356-c5dea2c80bad", "comment": "Malware payload", "value": "76fd823af6e1f87590c7eadb29d9452a2c235c6b8f3dade62ecda93dae6b040cd48ba9252e0f42cfa2bffa2b3379d2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751755, "uuid": "5b9054e3-5e4d-49cd-a1ec-3b203e97fad4", "value": "T139545CC252916835E51306328E5FC6F4261EB890FF597BBB23775A2FC9B13A2C663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751755, "uuid": "fc28cc53-5c48-4642-b787-aeda0ed32794", "value": "c8a467701c8f12711115d82fcd038f48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751755, "uuid": "4e701a5a-9291-4b63-a13f-1c83f08d2e29", "value": "3072:MVtAva7b08unJ0HapQSqHMZCl/RZIAsF5s4ODTeUG6Jj0:9C30n6H3SIV0t2q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700751755, "uuid": "0fa3fd9c-e7d3-4111-9518-ace693c7ce87", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700751755, "uuid": "257abcce-6809-4174-91ec-88fe991fd8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751755, "uuid": "7742e655-aab0-432e-962a-47b31b1172cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a2973a-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740344, "uuid": "9bca9432-d1c3-4261-9c64-1fcf584bd608", "comment": "Malware payload", "value": "d819ec29334c2b422cc580795868410d", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740344, "uuid": "1a1912b3-7888-482e-b206-e29b4c6fa699", "comment": "Malware payload", "value": "41fac1af8ffa83dc65a6443a8a950629ab3e57211bd8488f3f21cb3d96160502", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740344, "uuid": "25e94e7d-fece-405b-9c7a-1f986bf44b3e", "comment": "Malware payload", "value": "38c6b94c9efec81846658f2528d55a21895d47de", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740344, "uuid": "44296ad7-8940-4439-805f-24dc7506d46d", "comment": "Malware payload", "value": "fc5ea38c569a69612b5fd66869ccdcf3fd9dec8da44369c95c1501c35b725968380b8147dd2bbe2f5d4ab2a1b1372108", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740344, "uuid": "94807499-6f4c-40c2-817b-99de5f4b9191", "value": "T1D376E000B6A0C136E9F709B68EBE826D597DBE71072490DBA3C40A9D5F706E1BE31717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740344, "uuid": "4d367b86-61e5-4a2f-9a70-01c509aaf10d", "value": "24576:PBudSBeZ1xLXTWsCW3J3xnBGGbyVdCZ6WTipBcVrFl0FWELgJYy3Sbvaz:wisCW3lRB9cdCxTi7c68JYy3SbSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740344, "uuid": "4ec9b661-11fe-4b48-9d66-fb1d49aead3c", "value": 7340544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740344, "uuid": "85f4cc9c-5650-4b88-98de-ffd3488e17b7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740344, "uuid": "1236c7e4-06ec-4b4a-9eb5-e3f43c1b0547", "value": "paypal.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8edc6a-89fd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700743228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743228, "uuid": "065024ab-b38d-480b-82d6-48cadf7c1e0c", "comment": "Malware payload", "value": "ea9882a9b78900c56089ba8e7e5ee4e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743228, "uuid": "6e8704be-87e8-4ddc-8a9f-86404303adee", "comment": "Malware payload", "value": "42e0eda5412a988852e1cf9bb963422603d48777e94c5a19f77804213e1f50e6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743228, "uuid": "b2f6c9d0-3177-4890-9ed3-81713bde6778", "comment": "Malware payload", "value": "177a50c97a171e9924adae3eb6c5afd7dc1ab30f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743228, "uuid": "cc2a9dc5-eb66-4d53-a6a2-639229cd5c0d", "comment": "Malware payload", "value": "6b6ea31697a7bb16a8b5afbc79ed049f18feea98b3cce3b65dafb595e2839f99e0181da0eaec1495e9316432dd8bb01a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743228, "uuid": "8a7b9b51-3aeb-49ad-a8d3-218ce670a65c", "value": "T1D0F433C9C5A17ABB5505F083275B761377AB0CF572D338F3BA93A4B0E69143B583212A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743228, "uuid": "7504511b-df56-4360-8dec-6aa642fecddf", "value": "12288:2tMmpDerFfZ/d44VXG5lwwiU9BMe8UNNyicftPGPGIcIaQ81hoNfyDA:mMmpePG5lGU9GeJy1AeSN8Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743228, "uuid": "05c1396d-655b-44f7-8d7c-68416a5b8f3d", "value": 723578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743228, "uuid": "c4838be0-b3b2-4fd8-92f0-882d2dced721", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743228, "uuid": "eb5eef43-9044-4fbe-9c40-d70ed064caf6", "value": "NEW PO (YST2310-1010).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a8c045-89e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700734201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734201, "uuid": "9b87301e-527d-45ab-9cbb-9cbd64bb12ea", "comment": "Malware payload (Smoke Loader)", "value": "6b4a72df4ede5e601c2b9b68b609b795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734201, "uuid": "3db7521f-f2e1-4df9-9e27-edc52875395b", "comment": "Malware payload (Smoke Loader)", "value": "43349b2181b49be96a57e0ac4da5ead230cbc6c048cd1c8089dd4e7428ca44e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734201, "uuid": "09fe3682-ec3c-4e05-b1ad-6e1475d0d602", "comment": "Malware payload (Smoke Loader)", "value": "b46ffa5168e8b710af270d2efefdf72d37e62b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734201, "uuid": "6e91a273-b235-4537-88c8-7b21c2673540", "comment": "Malware payload (Smoke Loader)", "value": "23ed345d0abba5ab6babe094c7a441ac2f46e37f62fd720af9628d75eac7706df85f9f85e4dbeb932451520e3d9e9499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734201, "uuid": "3a93a83e-ecdc-44fb-a82a-1e39ba9ed8f8", "value": "T164546D1253F16C61E6234673AE2EC6F4672EB8708F557B9B33596E2F09711B2C262313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734201, "uuid": "eae40342-8035-4936-9bfd-d0245029ed4b", "value": "961a0e8abc340debe08dda2cf1b81abe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734201, "uuid": "b16c2eec-e47b-47d2-a222-76c4bf602406", "value": "3072:pYX0J0oHsXhaxRCkGl2LZw02QXNg/X9zXl1yDDagMeBB6vt1Zq7:pcWmExIkGl2993sX9R1yD2sB60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700734201, "uuid": "78c2c943-758a-49e7-b17a-aba0bcbbbffa", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700734201, "uuid": "72019ab0-af03-45ea-aef3-43df9347309f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734201, "uuid": "d22f1366-886f-4cc7-b580-9db30c7a2270", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5992a6f8-89e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700733293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733293, "uuid": "c7fef604-b034-40fa-b011-2b0eeab914f6", "comment": "Malware payload", "value": "99cd0f63ce6a4a909e6547284713218b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733293, "uuid": "6397939a-adcd-4278-905b-38ff861c5ade", "comment": "Malware payload", "value": "44b456884e9d95c9c39cdcec55e216a94d7c06a26d8e88b01afe63c705981276", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733293, "uuid": "619f7124-ac36-402b-abb8-7d37427e0bc8", "comment": "Malware payload", "value": "6e62c7d313683f4cc0a6c60d307c4358f593bc86", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733293, "uuid": "00f2780e-cb0d-4064-a865-465817e93e28", "comment": "Malware payload", "value": "1298b3995986f996454338d78126cfab902b702d546c2ec92049ded7f934da2f026a1bc7bde9f7d93220a44f0e24229b", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733293, "uuid": "b362107d-1a22-4eca-befd-7cf93ebb5dfc", "value": "T12C65D01466B95F97EB3A83F95410520407F56E2D507FF35A6CCBB0EB2BA4F900A84B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733293, "uuid": "bd9c3f89-7f9e-47fd-b64e-48d0f29a1f96", "value": "24576:yiCtD/F2k78MTZjI/OuM+JEJBa5eZJTF9gH+dX:5mgk78MTZjQtuBa5eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700733293, "uuid": "45e90ee8-2ed8-487e-8913-dc6fd028ac44", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700733293, "uuid": "e51b8048-d44d-4dfe-87b2-013a0750a7de", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733293, "uuid": "d22d7d14-9944-42a8-ac18-aad35a5e5e9d", "value": "quotation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5104015d-89be-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700716099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716099, "uuid": "968f8882-a615-4b6c-9c57-535728b97a1e", "comment": "Malware payload (RedLineStealer)", "value": "3f2e420acd6d3825a314fa4a83647f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716099, "uuid": "98649b20-10a0-41b4-be07-19de0a893ac1", "comment": "Malware payload (RedLineStealer)", "value": "455e6b281f45566309822e9215e699b10ea595e0e45e5ef3dcdd371290c23038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716099, "uuid": "e0a8d2dc-74d8-4e33-b4ab-d03dc8bd05b2", "comment": "Malware payload (RedLineStealer)", "value": "0c2b1cebcb9a6de882a60f68d54632b1ea6ed10c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716099, "uuid": "4aedbc90-f202-400a-bc78-edfc4bbef070", "comment": "Malware payload (RedLineStealer)", "value": "28e6f28e6027846f98d513c83ea4c518179d16594598dee4488ab181abc4aca1e7c9f1e9dbfbec7e304b0e40a0a6fd4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716099, "uuid": "d83a3dd7-e5cb-48ae-b579-0337f8ee4b7d", "value": "T1FE06336EE9FC56A5C767677A58BB913006207BC09448E72C7D084978BFCE47C71EE282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716099, "uuid": "aea584f4-3042-4798-9516-a01a1252ae42", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716099, "uuid": "4da7af8f-1d03-4041-bb3c-72e3994afc56", "value": "98304:POKQc/jhB1hkqIf6j0Kdf55qTRlcIWto1f+j4vn9:PXzkQjZdc3Wuftf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700716099, "uuid": "10fb19db-7d03-4b1a-a1fc-f78bc3694496", "value": 3687936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700716099, "uuid": "8f89b769-6f32-4dd5-af0e-fc021758c0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716099, "uuid": "c86afdc5-bb32-4776-a669-bd0932d233f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe7843b-8a1c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700756416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756416, "uuid": "f492e56a-bf8b-40be-b20c-90c3086f7052", "comment": "Malware payload", "value": "c90b2ac97d7dadf292b4d8c4682af997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756416, "uuid": "747b0d52-73cf-49f5-94e9-6cf1c1291bcd", "comment": "Malware payload", "value": "46737a3bb0a3ab2bf869b61db8daef278cc1184f967e0f6a7affdfce349dec5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756416, "uuid": "f09021f8-fbdc-4df8-a875-c37da9088cd6", "comment": "Malware payload", "value": "ac1aedfbc20a3ea79a91d87d35cc9eeef566daf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756416, "uuid": "39c4f3cf-b5f2-45a8-b237-decd55d1dc9d", "comment": "Malware payload", "value": "b537933425aa3a4422ea47fea2db50f1055c82b17495b9ce6592abac371a65e3f1ef87e87f4b092a31113947242f622b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756416, "uuid": "22af123d-eaf1-4523-8d81-ff29ec52dd2f", "value": "T1C2546ED253E1A835E61346328E5AC6F4261EB8A0FF557BB723775A2FC5B06B1C263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756416, "uuid": "f027e6bf-a60e-4ec3-a4b4-c512e6f24629", "value": "c8a467701c8f12711115d82fcd038f48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756416, "uuid": "ed70e204-ec8c-47d1-aa10-130cc938e75e", "value": "3072:qjNw4EL1eAeXDUGzYNVnzHhCqL1/qr9IjoiIXB+sSsvUXU6JN30:BZxyXQ9V8KK9ooiSB+szv4jN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700756416, "uuid": "6ed8937f-26d7-48ad-9156-e3a2346e6b86", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700756416, "uuid": "ac24bd3e-e1cc-454c-bdec-c293856450fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756416, "uuid": "9a2a7c41-4f02-4ebf-ab5f-2231de6870dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f08fb2-8a02-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1700745177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745177, "uuid": "b31eaa44-e6aa-4673-a330-cc6e43d3726a", "comment": "Malware payload (NanoCore)", "value": "980746bbc209911ddbaaff46d856a78f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745177, "uuid": "9ca6dfe9-e6f4-4e5e-a25f-ecf750c6ef81", "comment": "Malware payload (NanoCore)", "value": "496bbeff36c20e17f2967fb96527b48ab329d1cac12347fdbd8692c46dd36786", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745177, "uuid": "030c469a-b36d-4fde-9eb4-ea97efc1bedb", "comment": "Malware payload (NanoCore)", "value": "283b8da4e00d54668ff2c98645a4f6f0853a0d35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745177, "uuid": "ae897ee0-0c86-43a0-8e04-778fd58719b5", "comment": "Malware payload (NanoCore)", "value": "d367022fd0b51c261afe9ca389117b062ffa9953c02798c648d88ea769cb82372d31797649d0f617e9e66fddf8f74ddf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745177, "uuid": "e55567d2-20a4-4594-8eae-096877664f75", "value": "T1A8F4020573BA9F25CEBE67FA5821A24143F1787F6936D6598DCA20EE1721F001E92F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745177, "uuid": "0911460f-f793-4554-a6b4-97a37e989354", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745177, "uuid": "a3a5af14-4c36-4da3-b9b1-7546a4c2b441", "value": "12288:H1CFqELXGkJlaxoem1jMipixc06ycvpxHPi4ou0oTJOHBRAIMHEkjLzq:H1CFqQ2k7axoV1Ai4u069A4JdOHBRT2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700745177, "uuid": "81565494-3e3b-442a-be84-05657147c989", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700745177, "uuid": "5c77109e-c4c0-47c5-9f40-07f83524b638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745177, "uuid": "ad910329-39b5-48c5-a12b-73d13695e349", "value": "plugmanzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b062d1-89e2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700731461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700731461, "uuid": "72cf1ef0-da8a-44bc-89d7-df01431e6839", "comment": "Malware payload (Mirai)", "value": "0022bdf51d31d84bc99f8f0c736c1195", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700731461, "uuid": "3b16ac0d-d762-45dc-af9c-9d1f4e380707", "comment": "Malware payload (Mirai)", "value": "4b96681887078fac6a8e4aec5a6f0f59c3ad3a9c38390b11529df0cb9725d262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700731461, "uuid": "9935cc94-f563-4c03-ac37-1b4c3cc5579b", "comment": "Malware payload (Mirai)", "value": "43978af97e51516228891fc422f47164663d9d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700731461, "uuid": "5d64444d-9e3a-4d41-ae0a-8b92ebd96dd1", "comment": "Malware payload (Mirai)", "value": "13471f803b03c4e0f8c5d9b479840b2474268c2aca0dae091beee8ee0c40d6ab7dd4bdf2236f2a0b873944021a785d8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700731461, "uuid": "4bce5fea-da78-4fa6-abb2-864197582a5f", "value": "T1B64302E2E944F0F397702C33E02A1096E2573F64D1C322055252AF9633DAB4B39B58EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700731461, "uuid": "2f831a1f-0168-4fa0-b1bd-a78c9248ada3", "value": "1536:cThyKv1ya3Ph5UddXaD/b6+PExuB8b4Z4epie:TUxhQXafpPcOXa3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700731461, "uuid": "1ef96f35-2aa1-4b46-8cb1-f52e32512b05", "value": 55584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700731461, "uuid": "08513973-2ce8-438c-bbac-857990b356b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700731461, "uuid": "706bee3a-c2bf-4ecc-8c9d-8f07ac07bf7d", "value": "SecuriteInfo.com.Linux.Siggen.9999.31101.1978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476c8a47-8a0f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700750872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750872, "uuid": "5b9cdd05-5198-4156-aac9-d967dc4d14c5", "comment": "Malware payload", "value": "6ec067ff2cd91713b33e08390796fda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750872, "uuid": "9d5e8752-0c6d-48eb-8706-34b4e854561a", "comment": "Malware payload", "value": "4c9e023a3df13dc1985827b37b8b03b1a6a3703b9c7933a1262e60d94dca05d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750872, "uuid": "0c292b19-577a-4e0e-bad9-0c5fcaa51adb", "comment": "Malware payload", "value": "0f7c3804199abe7677e31aedf55ba67b70b2e0f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750872, "uuid": "6096b920-100c-4bd2-86ac-6fa0eab2d74f", "comment": "Malware payload", "value": "bbe83376365b89009a99eb054a1b256032654c8e7f271c225f20382ce50c8fc7d8857bddbd4f1b52129913306ba2145c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750872, "uuid": "0034f6b6-d58d-4634-812b-fd04ed7ecf8e", "value": "T146546CD253A16835E5134632CE1AC6F4661DB8A0FF167BBB27376A2FC8B13A1C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750872, "uuid": "8e04a3dc-1858-439a-9500-57ba1d4f65b2", "value": "c8a467701c8f12711115d82fcd038f48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750872, "uuid": "e2bf4466-a74c-40e8-8556-013100536bed", "value": "3072:fb7BtAwa7q28anJvZO1K34SwUcIbS/sa6hojDk2BYBEBskUJ46JfH0:fPkjGKnNZwK348cIbWh6hR2WKBskU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750872, "uuid": "269cf41c-90d2-4da4-8b46-87bf0925728e", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750872, "uuid": "16f57458-955a-4300-8528-06a5be868d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750872, "uuid": "bdbe7c19-8bc8-431d-b105-38858d352734", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c4eb5a-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743920, "uuid": "826dd8f4-e303-4171-b2ac-d06b13b2da2e", "comment": "Malware payload (Mirai)", "value": "f87f6669275ae382e877bb6274d1b0e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743920, "uuid": "1a944b75-83a8-431e-a9aa-056ad3c7f528", "comment": "Malware payload (Mirai)", "value": "4dc75355468e6c88d472ff22295919c4fd2c10d7cbefebe0034d45fad5bebc25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743920, "uuid": "52649fd0-7e54-48d3-a340-6c0c7b966340", "comment": "Malware payload (Mirai)", "value": "fc6694717f8a241e4fbce558199bae384de554aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743920, "uuid": "6e50c308-920b-4147-b455-d04c27bc8a0c", "comment": "Malware payload (Mirai)", "value": "84b8a1f8c5601164f6439c0b7ffb5a049327b2596cb71eea0a780aed65726e30f326f72437e40d855ced5585144d5b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743920, "uuid": "76e623ca-21ac-4047-aa56-2d85cd80ad8d", "value": "T14ED2E11CD99CBD09CAAD7DB951CE96B5398CB1C0A35DE5CD17224448F617D8BEC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743920, "uuid": "e37f7606-e64c-4daa-aecc-53d6726f87ef", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNEJbUWUd:kbDs06t4BEub4sU/MbUEYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743920, "uuid": "8caffdd5-9d55-4959-88af-94edb30feef4", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743920, "uuid": "3c514cc4-5343-4016-a665-4737611f135b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743920, "uuid": "380e88bb-598e-4b9c-b578-a5c7b2120dac", "value": "f87f6669275ae382e877bb6274d1b0e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ded002-89fe-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700743618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743618, "uuid": "3e626e51-26cf-48ba-aa92-1fc9678a13db", "comment": "Malware payload (Formbook)", "value": "928bebb9e1b55b7b5dfce8ad0958c6f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743618, "uuid": "ba5d1f3b-344f-400b-9c19-715c04af3791", "comment": "Malware payload (Formbook)", "value": "4e888a7a812be647c1db3c45b41997976b81fcac54dbb3c2c53087518c036287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743618, "uuid": "fa758e0b-a6d8-43c2-8400-f7a41c16d132", "comment": "Malware payload (Formbook)", "value": "cdbc528db55cb888d0892d346805b80215d44419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743618, "uuid": "57580bc6-30ef-4aa6-96a0-3af287d7e015", "comment": "Malware payload (Formbook)", "value": "6670f36fb35e05b2218d44b44bc5ee74c34bc34ac490d08842219540e1363de0fd727b73820173c4f24e6aebe54cdd7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743618, "uuid": "3fb4ddc4-9427-47fc-bb66-82c199bb3a46", "value": "T109357B05B2A68B84F17CC3F444526092A7B46C9EF26DCF8B8DC739DA3570F911529A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743618, "uuid": "faef0fb2-7573-4d4d-a34a-ab924cf52582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743618, "uuid": "55574f18-82d2-44cd-be39-2725a12c3b98", "value": "12288:oeJo4zMJr5sqNJCM9bmZKdowOwee21tVw6kT69iyIPpu1c20B01hyagV:xJDzMTP/3KAowOPeut66L9O80QFgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743618, "uuid": "93d7305f-1799-4ceb-97da-bc1518a6bd63", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743618, "uuid": "896a08ec-d403-4b57-a56f-04465eab2327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743618, "uuid": "d7f1d44f-9691-4f1f-8877-f6cbfc450a60", "value": "DHL customer form and parcel details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f58db92-89e5-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700732927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732927, "uuid": "fe6b1035-23a5-49be-85fe-d7298d924d64", "comment": "Malware payload (Formbook)", "value": "aa5e759e81c0c2f713e76bdf4dd06531", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732927, "uuid": "68afacdf-0b6c-4e26-88fb-dc45cef6da47", "comment": "Malware payload (Formbook)", "value": "507f8b2ecf4809b87a244f5df99cf9f8fe83f9c4fb9b35e8ef4f4a40c85c5d5c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732927, "uuid": "78d12393-b6a3-4f58-8784-81e07c7ff8d0", "comment": "Malware payload (Formbook)", "value": "d59d54b1c9c0bdbd2972b021b225398f67347ab3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732927, "uuid": "7eb11c4b-57ff-41d3-94de-e18fb7793997", "comment": "Malware payload (Formbook)", "value": "76d9b9961149d58bb52705450162883e20ac279267679709d773d0564dea4fd68f1c5829d956d24ec62eedd20b51a492", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732927, "uuid": "aebf52f4-bab1-4c52-99d1-b1ab21031082", "value": "T1B1E4338974C03BA4C0F80EBA9F425D7270817C6B6421F57366E4B686E3FBE50B025DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732927, "uuid": "aa621c85-208b-4aa9-92b0-cfed42cf0f58", "value": "12288:1YUWNntPJDf/nT7DcKi3dyHnoo/kXdv9+aR5PDTuYGLiN4yhHRCwsY4:yVJDnIF+oUkXdv9+aRTGLiN4yhHL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732927, "uuid": "ff77abb0-869e-4c6c-84bb-bf9d1262874e", "value": 719558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732927, "uuid": "af8e3c98-76b9-45b3-af49-abee625ad612", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732927, "uuid": "fff5ad35-b27b-4d4b-8a66-f83f9bc4356c", "value": "Sea Waybill, Certificate Of Origin, Invoice & PL.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9851d6-89dd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700729327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729327, "uuid": "474206e7-15c4-4423-b475-9781fd6f11b8", "comment": "Malware payload", "value": "92ee518a91c0bfd16ab6fb9042aa3661", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729327, "uuid": "b31dd948-0ddb-4a98-be8b-0194e7535d61", "comment": "Malware payload", "value": "5554ddca9ddef7f8c158e55aa13b1e8da3b98b7d2adb075cfe8050d7fd27b69c", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729327, "uuid": "90344797-f3ce-4f77-b317-e772639da837", "comment": "Malware payload", "value": "ccd25788c5d9de2cbe6665f9e7cbbeb44805c2b2", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729327, "uuid": "33def3c7-c753-43a9-8a0c-fc2e3f9faf6b", "comment": "Malware payload", "value": "15492266de8e4cbf856ff562cd5d9ef0db65d0f12da227ac088d783d50754ea922b9cdc0464490770595d04222b42079", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729327, "uuid": "3b4fe357-bd07-4401-82d2-2c31949ffab8", "value": "T1B9E41244B3EC7B21E2FAD3F95630355853B77A586962E3890CCB60CE5362F001A65F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729327, "uuid": "d6ce3ea9-f601-4fdd-8ae4-bdb508bc3f49", "value": "12288:W7/SLXGkJlnYcN6ShEdBAw2yJQHN9LRF0/1XSPqwvhQK8M3a6wcDe:l2k7YzQ7coNB0/1MvKKp3a6wcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729327, "uuid": "d346b2e1-a09a-41c1-b606-08b235188493", "value": 707910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729327, "uuid": "69ea78bd-2872-4631-85e1-d2e636fe0870", "value": "application/x-ms-wim", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729327, "uuid": "bf0bada2-77f2-44ce-a511-d8159d5a7502", "value": "6082_SHENZHEN NINGBO_Payment Details_13, NOV23.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9264ea16-8a3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700770325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770325, "uuid": "a2a6400f-099f-4c8b-97c7-12bb865b937d", "comment": "Malware payload", "value": "fa811536d784af9e852f666b4a7d9f9a", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770325, "uuid": "85544ee7-68a9-4af5-b72a-d93ca769357a", "comment": "Malware payload", "value": "55faaecc0dd6f950b2c5ea27aeb2fe10864a2e0a65e5662066824c8bccb5e91d", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770325, "uuid": "7f5cdadd-f0d8-4d71-9bb3-75fec513aff1", "comment": "Malware payload", "value": "cba207cc55efcdff8457a703f82e224f00a4bbde", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770325, "uuid": "2776337e-9709-4b07-971a-1c624804f47c", "comment": "Malware payload", "value": "60e5e3384d7ad1f5e8421b4e2925112b7e1bf8ebbc7c733f52584f7e7bb32c762427f0dfe75c345695a2301c2968c4d1", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770325, "uuid": "b016ab10-dd35-4b73-9ac0-f4db42db1b86", "value": "T1B1D5BE2A35CAC537EB7E86316669D77A61BA7EE00BB100DB63C43A1E1E305C14276F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770325, "uuid": "5f93c989-f56f-4739-afc7-21b7b911a582", "value": "49152:lmDUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZzgDmon5:930ZnqKzFnWntuxkBn/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700770325, "uuid": "9315a436-6868-426c-bf33-cf296bda80e5", "value": 2910208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700770325, "uuid": "b2cbb25d-6b23-4e3f-8bf8-2f2af8df94ee", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770325, "uuid": "1896ccc1-fb3c-4d99-800a-3a034f7647af", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c79c7a-89bf-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700716405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716405, "uuid": "7a718fb4-ca52-418d-a852-7db482f53fb2", "comment": "Malware payload (RiseProStealer)", "value": "e1914797ec77eb49fdae185eb764214e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716405, "uuid": "1c5e0070-7edb-4416-afc5-b2106ebb9b72", "comment": "Malware payload (RiseProStealer)", "value": "57fab2e1a2580e95559b258b6601502e0fcf47e8a6edf75291c6fefb262cf9bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716405, "uuid": "cf3c4f7e-0d2f-43c0-8143-aa9a949baac8", "comment": "Malware payload (RiseProStealer)", "value": "86f9f79be32b6d747022d8b4033504b9937dba13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716405, "uuid": "b9384118-6059-4781-ab16-6a40a85e2135", "comment": "Malware payload (RiseProStealer)", "value": "d09b04dd2e118b09ce5fee5dda61f8188fdae2de5fbacb26ed5b44c6b80cd952d0f52bfbded216339f8bbe74985a4711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716405, "uuid": "da4b8590-531b-4064-bab4-581d5ff95516", "value": "T1D2559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716405, "uuid": "8c7b4fe2-ffdf-4423-bdc5-a42ef65228ea", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716405, "uuid": "f7af8631-2a5a-49cb-8f17-7a536722cf0d", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700716405, "uuid": "217cc197-670b-4ae8-99cb-dc74b3a32d34", "value": 1322251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700716405, "uuid": "2f54e3b0-df0f-4916-b2cb-23b04eaa9ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716405, "uuid": "a694f368-7569-45a3-9f5b-1cd0b3573a6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29631edb-899b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700701000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701000, "uuid": "45b0d7dd-9a8e-436d-891a-dd852dad772f", "comment": "Malware payload (Mirai)", "value": "660bcaf4a7206b5c6177ba3ffb5b2bf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701000, "uuid": "b463ca2a-4099-4015-b8b0-3bd933c3ac2e", "comment": "Malware payload (Mirai)", "value": "58aded258ab5699394aaeae3c873af5c1e132ffade55a4e5687fcc3c4406211d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701000, "uuid": "258aba91-9832-4127-8d68-447e2ff0cc58", "comment": "Malware payload (Mirai)", "value": "e5f452452221700b3536e7e966b54ca133895494", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701000, "uuid": "cec16125-d7b4-48dd-98c6-9c6c47a29017", "comment": "Malware payload (Mirai)", "value": "217b7b1aa2d76c49da02140d83a7a985fcadfade6640617ec64e4f023a0483fcb95580564d648958c314ad162a066273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701000, "uuid": "b35b7053-8707-46ba-8c78-b32852ccafd6", "value": "T131232881F947C4FADD0B0C7204F6B27F8733D899502AD35AEB14A936EA7331152DA68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701000, "uuid": "906da8c0-e972-4ce4-bbb5-a4793eb51564", "value": "768:rz+i/Qdb+1nwt1+2fWG+Iu2Y+MiWq+96JXIjIBOSiXGsWLTUh8FnQ2AwoYqqvQrv:rz+i/Q9+1nwH+2fWG+Iu2Y+MiWq+96J2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700701000, "uuid": "621c86a1-5a1e-48b5-92ef-90f181e35594", "value": 47632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700701000, "uuid": "e6223821-2ead-4f9a-ae01-76ab29a7448b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701000, "uuid": "60065f21-8db6-4172-8d95-4ebf72a68667", "value": "660bcaf4a7206b5c6177ba3ffb5b2bf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83999ce2-8a3a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700769441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769441, "uuid": "a48c86b5-85d6-4db7-a10c-65445ac4fc44", "comment": "Malware payload", "value": "946073b20c0edcd80d7f6a3bb84809ee", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769441, "uuid": "ef21f648-d659-4289-808e-1fe58ff93f41", "comment": "Malware payload", "value": "5afa072a5c636294e7c9bc2f7acc5c4f3fa3416e8764eedd1210e98d63695958", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769441, "uuid": "b90dd3ea-8db6-401f-b898-17aa092d420a", "comment": "Malware payload", "value": "c8d82a14f3195ea3ae4c7c4047adf43e9eb19833", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769441, "uuid": "ec81f19f-d0e3-41ea-98d9-d26160de23aa", "comment": "Malware payload", "value": "c169b846fb2911f0160d158675087800b30881c7e27647d01fe144a4a29a04958adf05c26b1c741cc42d536cf36a4144", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700769441, "uuid": "10e418bb-2a45-472f-83de-be40badadd5c", "value": "T16ED5BE1A35CAC632EB7E82306679D77A61BA7EE04BB104DB63D43A1E1E305C11276F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700769441, "uuid": "0a77db00-a3dd-4145-b6e9-fb698704b2d0", "value": "49152:85lQ14uW8zBQSc0ZnSKnZKumZrFq4Fb6HXr1iWnYs4ntHurpllQ6acuxtZASwYcb:X490ZnpKNFnWnpuxI78Gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700769441, "uuid": "245e14ef-55a4-4fb8-9e3e-b3b56c1eed82", "value": 2886656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700769441, "uuid": "05d79179-be41-4e1f-8164-0a95541640a4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700769441, "uuid": "89063107-7b0d-43ec-8884-53c92184ccbf", "value": "Cheat Space 1.4.3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703151e1-8a0e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700750511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750511, "uuid": "e0952f7c-2f96-4226-a716-256009f09cde", "comment": "Malware payload", "value": "78ea627f1dddce169de7dbd97a1d10e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750511, "uuid": "6d509d70-2e5c-442c-b2d5-18a459c1d786", "comment": "Malware payload", "value": "5c1beeacd2b06dfb2f3e42494583c6fb0ab197496058d9785e5cf937a965c82d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750511, "uuid": "93552db4-225f-4464-8402-447a12e7a2c0", "comment": "Malware payload", "value": "98cfb4c165ed6385d671374cfcfc0a9985621a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750511, "uuid": "ea4d1aaf-6270-47b6-a1fb-8fdfe380fd8e", "comment": "Malware payload", "value": "a9d98a41a5d7219c1e5ddcb0c73843bf2f4c7abb3e92bae4a050c198ef68773dc3d01e21dd4eb212100c0b2ed3344838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750511, "uuid": "f091965c-ac9e-44b3-83e1-d1a68995d5ad", "value": "T15DE533582892C47FF68D0FB034E65203EF48C9699CDCAF457679A2E35CA17B8A319F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750511, "uuid": "02aaf348-a223-43f0-b6d3-577b9fe40e6d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750511, "uuid": "202b8a07-a5f5-47c2-a5d0-a46fe6240837", "value": "98304:l8XKKeJ7sTm7p/hTxS4A3ujj+BU7UYQgjZoEBgBfjUdXr:ged/hlSOjjCUArYoEALUpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750511, "uuid": "d42fc1ec-d351-40be-b62b-9b446745b7b8", "value": 3253248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750511, "uuid": "6b359363-63e1-471a-b585-d8eb4344b070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750511, "uuid": "d2403a80-63f9-4677-9b28-1c9d5095a1be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a98fe5-8a40-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700772104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772104, "uuid": "d6b8d88a-63ea-4412-8c69-4e8aea5ddea6", "comment": "Malware payload", "value": "5709f756cebd3f0e55b37d1d836d9f7f", "object_relation": "md5", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772104, "uuid": "4fe721b9-1307-48d3-8b45-5472de8f0fd3", "comment": "Malware payload", "value": "5c2764b9d3a6df67f99e342404e46a41ec6e1f5582919d5f99098d90fd45367f", "object_relation": "sha256", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772104, "uuid": "57ba1341-aedd-4fcf-a835-51dfc7606913", "comment": "Malware payload", "value": "3f800df45048c343e4d71935d80aa7f7b9a573af", "object_relation": "sha1", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772104, "uuid": "5be7df02-9d16-420b-989b-fac54a9b3459", "comment": "Malware payload", "value": "68dfeeceb688993b437db9c15d65b07984da2a5414efdf761e1a9edd6dbbf808583921e5ae473bb6e80579ef6307dd68", "object_relation": "sha3-384", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772104, "uuid": "fbbb92ba-4647-4666-b2f5-6348669b468d", "value": "T1B403E0BAE51BCCCEF884AD5141BEBA3C4148713FCCDD31DA056AAA516881D046B3ADF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772104, "uuid": "e949c2a3-552e-4954-911f-e1f2c82f57bb", "value": "768:Xyopv/twMwtJMKiykVxxCP4Z4fwqAfNxmyysWQGWVOK00mKQC:BptHwzMKiykVxxCP4qqS7aS0m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700772104, "uuid": "d57a9f47-366e-47cf-bc30-f7d9b8a2470f", "value": 37937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700772104, "uuid": "50695335-301b-41d7-9cfb-86a5447ff433", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772104, "uuid": "b0e740b8-933f-4efd-bae1-09eb27c359b2", "value": "E-Sendung_DocuSign_FakturaEL0QSZ9P.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c82ec0-899b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700701017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701017, "uuid": "7b6fb015-2967-4074-aa19-ec53c48ee602", "comment": "Malware payload", "value": "fafe756b0afca36c4a2ecaa7d8d4a7ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701017, "uuid": "db9e9f1c-673d-467e-a437-0f5e5bdaa089", "comment": "Malware payload", "value": "5cca1775cda90c1dcafb7d4b97509d557c24d0d4feb390db10fb0c106e9078c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701017, "uuid": "c8079113-d359-49b7-8fc6-430e17ff3e74", "comment": "Malware payload", "value": "a7dca912da51f29b38f690f982f53c035baf2896", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701017, "uuid": "0a85fd21-7367-415d-8391-6f63dd6a100b", "comment": "Malware payload", "value": "8fee6a6f523b8743d68b28cadba7e9719d825f33b9f4c6234de797390fa6fec3a25a9c0484e7a59b22c1576fa5ee0ccb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701017, "uuid": "18b48ecd-7cb9-4ba7-94e8-15e82afe5ea0", "value": "T17653A71D6E218FECF79DC23407B799226758338533E0D685E2ADE6146F6024D681FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701017, "uuid": "a272efe2-e999-4b5b-a50e-5e2ea86ebf41", "value": "1536:C2o1jI1yI1o1e1fI1ZD1MoLO5wWjeWF86UBkE:m1HL8wWT86m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700701017, "uuid": "87cb58d6-3707-463c-a91a-f73c317dd049", "value": 65416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700701017, "uuid": "f3d2d17c-b400-4ba6-a7dd-48ee501544f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701017, "uuid": "dc95ede2-7d2f-4824-8dcf-b1b88de6f741", "value": "fafe756b0afca36c4a2ecaa7d8d4a7ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea5fbfc-89e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700732952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732952, "uuid": "11810605-4736-4a0a-bf19-1405048009b9", "comment": "Malware payload", "value": "d2ab981477283edf61e74f076e31fd7e", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732952, "uuid": "e74176aa-6cf3-4af9-b0d6-29f216ae837d", "comment": "Malware payload", "value": "5df727a8b5366701c1ae0c2d6cad957a775c05e7ae6bbea267fefcb2900afb8a", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732952, "uuid": "7f5c832e-89c4-4977-b297-c130f3823d71", "comment": "Malware payload", "value": "df3ba4d680c700ab91d677e224d61c2680d228e6", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732952, "uuid": "d31f515f-1ce4-4405-9346-4ae12234cad2", "comment": "Malware payload", "value": "12000fdb98adcb577fe15fe44f7e328b5e7c662d96742ebe58af8dbf87f78c6dabf1391a0f7e9ff92dd94094c00f7a3d", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732952, "uuid": "6e78f6cf-11a2-4126-abfd-29173f1d93e5", "value": "T18DF4235F84406CD9AA71DEBB5892052C890E3B2CFF4E7322969477D08E825C83DF79E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732952, "uuid": "7d989cb0-c8ed-4bd2-a125-2bc535fa13bf", "value": "12288:k8szLV6/GMRFLCtMDGLMpe1x5sx8Y3pNY8x4i/1CMWy/d/nkdnBGhBYQdVF6L4Gd:Cz09R1nKbY3bbLWy/d/k5Ihb+4Gl4FTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732952, "uuid": "002c2204-bab9-448e-913c-075483793921", "value": 768994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732952, "uuid": "f4079f3e-64e1-46f1-994b-8b38549ef8ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732952, "uuid": "3de6ac3e-996b-46a0-834a-5915402513dc", "value": "Quotation for items.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5da55fa-8a26-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700760909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760909, "uuid": "ada0ae1f-0fbc-48aa-ab0b-8bf2ee872f0d", "comment": "Malware payload", "value": "568754abba5b315352e3b3277507d7bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760909, "uuid": "8db49b96-f8d1-48bb-bd1d-77dce2826cca", "comment": "Malware payload", "value": "5f285bb742556345bbaa964650d4d23d5b32a2ea3816c65c099f492ac8d5a10f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760909, "uuid": "005d85c1-9172-49eb-a322-28e217b3449f", "comment": "Malware payload", "value": "88c9a6c273440ab6c59860bdc942eafeea58fa3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700760909, "uuid": "5f701e1c-ec17-4e22-82d4-e226fa4e9c67", "comment": "Malware payload", "value": "b9be637a20cd2d8ef4485e23f80aea2e951dc97169755d5f8abc402a3b1fc10bba3748cd5db57f0f205a27c607a4803a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760909, "uuid": "7310818e-a07d-49a7-be51-519c342dcca0", "value": "T184D5338BA582E9F6E03B99700D246EBE49EBB9D6747A941C3CEEA44D1F73116100F374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760909, "uuid": "753765ac-3999-486e-8ee0-9f8ea6474cea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760909, "uuid": "29eb0715-2066-4c51-9d88-6ffd1e04c909", "value": "49152:O2YwvLbBL8IQbDbq6hhFiucmUHq2uK3njQJJmgBkVrAhUQCe4f4/fzdedvQRY0E:XfvXBLk42UHuK3jWXWKOe4fWdmQlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700760909, "uuid": "ffebdce3-fda3-43f9-bd69-f5b03a0b44ba", "value": 2881599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700760909, "uuid": "edd4d67e-204a-48d6-a6c6-56cfd8f02636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700760909, "uuid": "476d2478-a480-4f14-bee8-e6a333f9c5db", "value": "568754abba5b315352e3b3277507d7bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9d7bcc-8a34-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700766831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766831, "uuid": "52197b99-860d-4884-bf49-b5f0ede33fdd", "comment": "Malware payload (Mirai)", "value": "5a4843c913356941f3cf1310d900f9b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766831, "uuid": "4b1065dc-ba80-4635-9d54-ab4275585780", "comment": "Malware payload (Mirai)", "value": "6270665cc3dd34d831d23c3b05592dcf043ca3dd8b9f2ce9843b1094ca541549", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766831, "uuid": "f759f2b7-6036-4b6e-af89-b3a32608ebc3", "comment": "Malware payload (Mirai)", "value": "271b34898b8476b518b0b0264398bc024dfe8f25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766831, "uuid": "7090eb7c-25a5-41cf-ab62-4e2fcc536db6", "comment": "Malware payload (Mirai)", "value": "3e0b791e5792b391f43100a5039c65550872ce0f923c44d2a364be2da2661f555d2b6a4b9d85bb1d98eaa845e73d3b1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766831, "uuid": "974139a1-ddc4-45ac-bcd0-fb6b275214dd", "value": "T1AD336C36E029DED0C6560134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766831, "uuid": "b910af52-6f9b-45dd-89b1-3a5d809f8e28", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766831, "uuid": "7dc63c6f-d172-4e85-840f-a81b93c3cd07", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766831, "uuid": "dae1d4c1-b1cd-4832-bff6-7a4cf41ec5cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766831, "uuid": "fd370313-0f3c-472c-b2a9-ab6021e707ee", "value": "5a4843c913356941f3cf1310d900f9b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36563d12-8a1c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700756427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756427, "uuid": "1d66b0ec-0525-4ccd-b637-705fa701410e", "comment": "Malware payload (Formbook)", "value": "a5d8e292694beac904ad6e84bc98ba32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756427, "uuid": "979d5ef3-547d-42c8-8b60-d5e19b5b98f5", "comment": "Malware payload (Formbook)", "value": "64d39c5ca1acfee70e9e783ae33212a0f271ba323077a7c2b0a135706e3e37c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756427, "uuid": "ba61f3f2-c304-45ed-b6fc-0e7367b832c0", "comment": "Malware payload (Formbook)", "value": "3594d799f68699420e21ef12769872c4dd8721ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756427, "uuid": "9c9a9267-4b53-46fb-9970-09d5208d6288", "comment": "Malware payload (Formbook)", "value": "2724f79e262c47e7d8d3fae6b4922a2a0e770335c92d337ca42dbc0af4393acb7fbe9789168e9a6df2c02cdba892b013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756427, "uuid": "81454c6f-1fee-4612-8529-23dd24d30bcb", "value": "T18E05DF4D93214787F0292B75CA2D7E1903702C7D75D2E3D4BEA6369BEAE1B921833127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756427, "uuid": "bff4244c-8145-4ac1-80d5-affaa76d6b8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756427, "uuid": "c1d35d88-c1ca-41c4-9746-31ef416b37b1", "value": "24576:BlrtD/61g2k70PDeVxZqytEXhF9uXgoTydXQ:R6rk707c5yXhF9/Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700756427, "uuid": "bb65ca90-8023-4292-b778-d25ac30874e8", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700756427, "uuid": "fe5bc1bc-339b-437b-9a9a-fed0f3394164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756427, "uuid": "1615b03d-f404-4f06-b878-1ab1b4455a18", "value": "Confirm!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc59c1b-89dd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700729406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729406, "uuid": "7ad75b1e-fd94-4951-915a-c76b8c7ba411", "comment": "Malware payload", "value": "cc0d499380c5708cab04121cd2c9cb11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729406, "uuid": "5653e6e6-a0d8-46cf-8153-16a96cbbf0f0", "comment": "Malware payload", "value": "652ba07d338b62addd7f4dd25d23c4cdd2e2222f0df3a2721b3e9b583b1265d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729406, "uuid": "7ded62d0-7510-47c7-a6b2-a719d4cab7e5", "comment": "Malware payload", "value": "f3e380d9b47e3b9acd7c6f24d2da814d09f7df92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729406, "uuid": "ce3e8cf4-f888-40be-becc-6f51a1910cdc", "comment": "Malware payload", "value": "5e9ab3a26390ede1a143bdac7d267cbdd5a4034c0d6776b989f472f3e77bb436ba411a660f0fbe88e29ad75b7f8e66d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729406, "uuid": "390f4f51-40a6-4177-806d-72290afb959c", "value": "T1B003FD603AFFA14C72B37F651FD9B59A8E6FF7722A16506E110413474A23E44CEA1B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729406, "uuid": "b32c6012-f41f-4ad5-b5d3-df767c68afd6", "value": "768:WVOsefQcl4B0QaXq+QmY16if/GeA1U1vKEWChBEEUXEcEtrSIGe+rGezS7d:0On4HaXqZAKAyEQhB/UXEcEt/+NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729406, "uuid": "eed4d3f8-f71b-4e1b-b360-653100e7dada", "value": 38564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729406, "uuid": "9fc81011-c861-4ace-b4a1-b0737771c3df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729406, "uuid": "9cdcfc11-3d61-488c-a725-992a77d66e29", "value": "image items.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db09fc6-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743930, "uuid": "01653ac6-ce22-4a60-ac26-c5884c88699c", "comment": "Malware payload (Mirai)", "value": "2c9b0b30b61fb4bb18196aff9ae3aa1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743930, "uuid": "721f463c-07d3-4b6c-8489-20b4d0fedcc4", "comment": "Malware payload (Mirai)", "value": "680f7a100b967de484d119e20e70380a456e2ce8cce5a04637df4aac61db01f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743930, "uuid": "5046bd55-08c9-4546-8b74-731ca1e70b4e", "comment": "Malware payload (Mirai)", "value": "f3f4ddffa196e1a5507bace700b8508829013430", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743930, "uuid": "8b425a06-9a87-4607-a4fd-9fee2ab20655", "comment": "Malware payload (Mirai)", "value": "51be0c7ac6a30a7d95aeb9c8edea0d1a6b2927f1ef4100b71cec5445bf9947359ab78e0310bf3a1b6da2f202b13d1cd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743930, "uuid": "671e90fc-18a8-4ef6-88ea-57dc8ca5ff44", "value": "T131E2F16393726052DE782AB1F9BA85CF6BBC4BECC17630A316056618299B0439F3C4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743930, "uuid": "fd4f500d-09c9-4b7d-9f8c-47f38c34a258", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9Xht9q3UEL5I5:1orm1vpALgUJCLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743930, "uuid": "b5aaa966-234f-40e9-9236-dc93dba58f81", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743930, "uuid": "d680108c-883c-4656-82bc-39a5d9173902", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743930, "uuid": "d54ac240-6c10-455e-bfbc-72b9e28bedab", "value": "2c9b0b30b61fb4bb18196aff9ae3aa1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9c2ad2-8a33-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700766500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766500, "uuid": "26a19683-b33a-4e45-b08f-921ec25e3093", "comment": "Malware payload (Mirai)", "value": "c3c9893ac9d41b9cc26a4a82828c4dc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766500, "uuid": "d5559524-0b9c-4730-af92-843370525254", "comment": "Malware payload (Mirai)", "value": "6985d0ce78884605120b8ed3d0f1ff5a3507f61d5a224db14cdaba187500423b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766500, "uuid": "98c09c27-c1f7-4201-bfa7-6e7669244223", "comment": "Malware payload (Mirai)", "value": "c2031e5d25eb3208a263bce30fe9927f47cd3d6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766500, "uuid": "b49617eb-c62f-494f-a218-4cf5104d0220", "comment": "Malware payload (Mirai)", "value": "583438fe07ac215214463172505dee1b80bbaed67e6df33f191619a65c454f810f3f0d332c92486b42d573b1773f3200", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766500, "uuid": "1c7c80d9-0b53-4c08-a9cd-ac00b8a6df24", "value": "T1B733FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766500, "uuid": "73288417-0c6e-498a-b3f8-405664aae31f", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGm:r/hqaJMeteqK806MHdkfQX6HuCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766500, "uuid": "d6b5d342-f09f-4530-b0d2-5a52bba214fd", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766500, "uuid": "cf4cba41-f9d3-429e-abe8-3b23f2f4b144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766500, "uuid": "d6ce307b-c954-4e4e-b6d6-5482e14e37b6", "value": "c3c9893ac9d41b9cc26a4a82828c4dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af13074-8a34-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700766823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766823, "uuid": "a9b72c33-2cfa-4637-851e-759f05bda1e4", "comment": "Malware payload (Mirai)", "value": "625e9f43339f5fbe67bc928d0f3af252", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766823, "uuid": "91ca2121-ca12-4c4b-9067-8613085bf2d8", "comment": "Malware payload (Mirai)", "value": "6a24acb40762a1f3c637ffd6b1dbe4e735a4043a3755e2c71be9bdb964ed79ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766823, "uuid": "761056a8-3054-474b-9f70-bc08e7e3f559", "comment": "Malware payload (Mirai)", "value": "ad7ac7b4d0e2a6c30a17dda12401e80ffcada4e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766823, "uuid": "945c4a44-5cce-4fd9-a3e0-96531b09a150", "comment": "Malware payload (Mirai)", "value": "31844b9e2078a0c6fcff19c037130c4ef16f38fed87345c4afdc6073ecaf5d38714989449df6ccd8766a4ebdf26ff2f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766823, "uuid": "52e55478-17cb-4bd3-a7fa-f7c4a4d5b786", "value": "T1E4B2C0CC61943084CA8D7C7C178D4A664F6CA0D0BAED9F26E350CD98B3BEA8B745D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766823, "uuid": "db8b0c9e-251c-46d6-8f0c-f0cb0b20cc74", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp6ZqSWvw:4QlS07FUXqIYSXQKquOqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766823, "uuid": "42de9c78-b811-4072-9c57-50c22ba5fcde", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766823, "uuid": "0709a1c5-839d-4976-9a85-0ba893725955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766823, "uuid": "0a61daea-dccd-4bc1-8bc3-f40ebe92c8de", "value": "625e9f43339f5fbe67bc928d0f3af252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c17378-89b6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700712812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712812, "uuid": "efac413f-ddf5-4da6-9bae-a5fc228b37c2", "comment": "Malware payload (Mirai)", "value": "65ec014b5a11c78b8bdf0aced777184e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712812, "uuid": "4c601476-4cb5-4823-95c2-45ec74a9046a", "comment": "Malware payload (Mirai)", "value": "6a3a24b1175e550f0d0237472d7f937968fbdfa5e200c9ca7f5e70eea48f8533", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712812, "uuid": "38bb2585-8f35-4f76-b76b-f9617d92893c", "comment": "Malware payload (Mirai)", "value": "14b95aa0d0388fc87d8fa7f94f08654deec1a376", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712812, "uuid": "e9c97969-d401-4ab9-9070-072bb18cebbc", "comment": "Malware payload (Mirai)", "value": "a83fde5ec1e958364b4e3a376f7e4763ba5e41676127fad6dd3fe98e76bc13b4d63be8f23c56f85a007adb9464dd189d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712812, "uuid": "5788773b-c215-48bd-b784-d2037ce009fa", "value": "T1BA536CD6B8129E3CF98BE6B980230E09F521731546930B27B7A6FCD37D73194D946E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712812, "uuid": "4ef41f5d-7605-4db1-a276-7d470821b929", "value": "768:CewC7tPUFA5CnYtJPV2vOm6NneNbWA75NuYeehwxSikSfzP8uU6NfyoT8lpIQ:Ce7CFXnYfANbh8YRZYP8uZNfN8rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700712812, "uuid": "4a7fe552-4b0f-45b5-bde7-0a6a8ff166be", "value": 64932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700712812, "uuid": "a7b97e60-64bd-422e-91a1-cc331203514f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712812, "uuid": "31b29cbf-ebef-49d7-a5e9-c36de67c3120", "value": "65ec014b5a11c78b8bdf0aced777184e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204cf2c2-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743934, "uuid": "ba172f9f-17e0-47e2-a712-80a83ed1b4de", "comment": "Malware payload (Mirai)", "value": "2f1899962ac7fa1db4c168a50fcad035", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743934, "uuid": "00430643-0d48-4579-b104-e5ffdfa6f594", "comment": "Malware payload (Mirai)", "value": "6a8e4e626bcf36f8161060ec5ff840ed0f2a0e2473c2eecf2a4cb84b2232caec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743934, "uuid": "f36edc99-da1f-443d-b00c-ed7b0db2f59a", "comment": "Malware payload (Mirai)", "value": "87cb8e15f56ff013c363fc78a3af989f142ed8fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743934, "uuid": "45c78926-ec86-4ddc-b5f7-f5286e8f7d8e", "comment": "Malware payload (Mirai)", "value": "b1bc52d20b4afb6df5fd578f9276e9ffcd4e826051166ad64b751d325c0d8828705f53376080d302c150062b6e6f90a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743934, "uuid": "91114cfd-e7e6-4e90-a1c9-55e7031f6438", "value": "T16D539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743934, "uuid": "6c7ce28d-ca22-4960-9e11-8a6d1b01608d", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743934, "uuid": "ca82584b-06a3-4f6c-94d2-e2d7aa30bfab", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743934, "uuid": "80d342ef-2f95-4292-b7b0-db4702dff9b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743934, "uuid": "43dbaf52-79aa-444d-b037-bd9de830607a", "value": "2f1899962ac7fa1db4c168a50fcad035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87672bc4-8a42-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700772883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772883, "uuid": "fb4ccec4-973a-4f23-bfcf-93a47d2d43bb", "comment": "Malware payload", "value": "a9c928b8fc8076bb6dbf3f91477c5a5f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772883, "uuid": "5baab7c8-ea41-4055-89e7-f0bffcc16dbc", "comment": "Malware payload", "value": "6ada8525343c073367168d789ed3f54f29d4f8a58ff33eb13ba9016fbcf18058", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772883, "uuid": "dd97d41f-ee39-46c7-bbc8-d2581b46ae22", "comment": "Malware payload", "value": "0e45b6c07cd85870cbc8b2be8eb8f5b1982ded6a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772883, "uuid": "f40af0da-c721-46b4-a96c-9a2634d044e9", "comment": "Malware payload", "value": "85d5614385d7696ef76ba1dff991b3aed3b7fc21d4ba09b1c99efb1d05ed2cf71c887572fa14a895e315738e0526ebf5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772883, "uuid": "820c67ad-36d7-49c0-8ef4-17d8756d6bfb", "value": "T157D34B56EB408B13C4D62B79BADF420533239B64D3AB33069928BFF43F867994E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772883, "uuid": "7a88f78b-fafc-4b85-9af5-04a69d6fc4dd", "value": "3072:1Ey09A7+M2Moz+N9VCdaSS2h7qKDenZ4LoFJbXazzOgWAM/9/krUD3q:5vVCdaSS2h7hDC40JzazzfxM/9/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700772883, "uuid": "f08d3740-7480-4ee3-9a84-1327bacf2aa0", "value": 138321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700772883, "uuid": "6ae18c22-2b16-4517-8374-d6d4b1acd2ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772883, "uuid": "2d88b499-1a0c-448e-b791-365a2017ac09", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0957ab0d-89a6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700705670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705670, "uuid": "41c3a3d9-ce3c-48e9-a54b-503d2806020c", "comment": "Malware payload (AgentTesla)", "value": "2d55b8efeab12d38f105973eecff0b0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705670, "uuid": "d9a9934e-f648-4f06-b458-3361eb7fe7ac", "comment": "Malware payload (AgentTesla)", "value": "6af6f1e03bf8c177c98b8fe74b5dd447c19d8e8534f4a901935df29242a04dbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705670, "uuid": "5bd3f1f5-d6c3-4c42-9dd0-00440f8c321f", "comment": "Malware payload (AgentTesla)", "value": "b6574a76c7fb27f58686def8059177963795983a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705670, "uuid": "58d45859-f824-4775-a581-8b82f0f0697b", "comment": "Malware payload (AgentTesla)", "value": "708f4aa3d80ada80bf0133c5fb58eeab736ecfb7d0e27dc26587cdbbc6e74903359518cf9e580d23f163df1f05103f2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705670, "uuid": "2ef2f677-ea2e-4f12-9d99-159f284ef515", "value": "T157459D04B2A68B84F17CC7F840525092A7B47C9FF25DCB8B8DC779DA3971F911909A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705670, "uuid": "a57ae3e4-b6fb-4d99-abbe-dcee41516491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705670, "uuid": "fe0a5df1-eec3-47c5-b19d-a076cbceb926", "value": "12288:tjxMCzMJr5Synv8cMJCw5vrc0zf0vfSx6nqGDBMv1OuZe884Y5XNm20ugV:lxMCzMTBBMg7ORH5gwTugV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700705670, "uuid": "57726188-e930-4eb3-9559-a101ae79caf3", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700705670, "uuid": "f304e25a-2920-4a13-80d1-45d03675fbfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705670, "uuid": "63bf853b-8ab4-4036-89b9-1cc92c94dc32", "value": "SecuriteInfo.com.FileRepMalware.17912.13309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4b4bbe-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740334, "uuid": "35e38c14-4958-4614-ac1a-965e616ccd5c", "comment": "Malware payload", "value": "42483dde6562de903a3de6ab5a8e08aa", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740334, "uuid": "fce73a33-6bb1-4f34-b9b3-619ccdce303f", "comment": "Malware payload", "value": "6c8020644081839e28657ae6b7ee1c432425c4b15e5aee776f6fd9dfdb6e72bc", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740334, "uuid": "c2dccbab-f1d7-4a9a-85da-20fbf654e53a", "comment": "Malware payload", "value": "955aa314795a988885496187b60fcc457314eed2", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740334, "uuid": "61dd9440-c21a-451b-9540-684d298b1bd3", "comment": "Malware payload", "value": "772b2c92042c7439b97d2dffe9c43c21618f22b87a519ac4e939832f02921b91d722c3f5b92489cff82616b95857f7fe", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740334, "uuid": "43611f7d-b2f7-453c-a0c7-6299f12b8729", "value": "T18855331595B1C73EF2321333A78B3557D7281B9637F12E15BF60A01A288FB9A3B4E505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740334, "uuid": "30691a68-e25c-496d-ab32-55012e00cf4d", "value": "24576:oW88mHfBTxlu6Pw2FurlgV/GTupgJ/Pt07GMMctXAg3kMz:q8mHpTxljw2FkMeTEGW6Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740334, "uuid": "27254e2b-f854-416e-91ab-e298c7d83192", "value": 1309731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740334, "uuid": "547ce802-55b5-48d1-914a-dd015351993b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740334, "uuid": "188b8ee0-c71a-4e2b-aa01-68fe47adb5fb", "value": "paypal.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b2be69-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743910, "uuid": "ba253865-0038-43f2-999d-2a189b6c24b0", "comment": "Malware payload (Mirai)", "value": "8f0c537e30df749cbb84f9f6455c7fce", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743910, "uuid": "9a2a2777-7a55-4e6f-a40c-f40113f42b43", "comment": "Malware payload (Mirai)", "value": "709ab1c025933acca3c8a06772fc433b9fe27638e121996dde5afa4ae00be134", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743910, "uuid": "1692f48a-d22f-4edc-824d-471c0e55ab0f", "comment": "Malware payload (Mirai)", "value": "c060c6f5d13dcdb3cb654dfd7a8fc2abd10361cd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743910, "uuid": "027bf519-f848-4ba0-8720-74de79277fb8", "comment": "Malware payload (Mirai)", "value": "6b653c367abad50ce92f6954457c4cb77bb2ecb5ca33de2814c4414b64d01f4bdde129acd2eb1da0b8cf95b47ff62ddf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743910, "uuid": "316fd448-18fa-4246-82f4-c796a81b0f95", "value": "T101D2D0A984E7F6B8D0EAA5B5003D06C4FD76B216C21A17B308E97576EF534D90D30EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743910, "uuid": "1ee50bfb-c81c-4eba-b1b0-7a507407b7ed", "value": "768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBK8PhNsSx0sI:kYJdJZiy1aBnQfTqBK8pN3tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743910, "uuid": "3767dd89-4607-4346-a169-3ed2e6879e2a", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743910, "uuid": "c3aac6d2-e972-4e1c-8bec-91a6f118a948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743910, "uuid": "10a0b300-1cae-44f8-96bb-fd1328825717", "value": "8f0c537e30df749cbb84f9f6455c7fce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d1096e-89ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700722868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722868, "uuid": "339add34-f916-4599-af36-956d56a09921", "comment": "Malware payload", "value": "6e27d544ac13de67c0c1b573c6a7ef4d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722868, "uuid": "41ee667d-3436-457a-88c8-c4dbe93be64a", "comment": "Malware payload", "value": "70bcc3b1407f7dd2c403231a4f2c1e374b715248be005684b6d1e36c0b3a6ffe", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722868, "uuid": "5283898c-486a-45a0-bb08-ca0e621c6405", "comment": "Malware payload", "value": "2825558fe7b2f7ee19bee5afd7fda0abcd73413d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722868, "uuid": "c6fd70ad-4136-4ec9-b0ba-20562e166001", "comment": "Malware payload", "value": "9ae20f856c5b8d0d9d1217299f4dbd2df5201c71cae3d87007d27932e472e0d243289fd4317565b857ef79cadfdd2c39", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722868, "uuid": "ad61c46a-d813-4041-810c-24a4c4e9a9a8", "value": "T17B5533D0A37B0020C911D9F193B893C6187E27F543E0E9E64F1ABDADE683739C2549DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722868, "uuid": "d0e57ae7-31ca-4eb8-8d07-51fd7d107bbe", "value": "24576:5/WB4dlq3HVyei6ATm+g/c5dgq82JbpVig0mvnKt/jbC2XZpLQ+LnmBWDXRNL:B9dlq30EATrgEzcOpB0mv8jblnLnmBWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700722868, "uuid": "6ce4cd44-16dd-49f1-8106-e33054fcadc5", "value": 1307197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700722868, "uuid": "7e16a596-1ba0-42fc-a6e2-8c4aaf6cc7a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722868, "uuid": "767d9fa2-b945-47c2-95cc-2b03f36531d3", "value": "payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aecc9cd-89a6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700705673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705673, "uuid": "aac50a09-0e31-4933-a56b-a1cb94a55e0d", "comment": "Malware payload", "value": "4c0782ea113a6ec83e4d23388860dc4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705673, "uuid": "f0c4bed0-c9e8-47e0-b540-94134734b6b4", "comment": "Malware payload", "value": "711577caeb4805081083de0aa3daa0fc3a7519a9a1c7b37737317f99910b0a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705673, "uuid": "6625633d-0de0-44e5-b92d-d96aad6ccdc4", "comment": "Malware payload", "value": "e388d9a7ec9d0930079138803324b9009f74c301", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705673, "uuid": "75f57120-f97d-4a18-98aa-71f0e9b487ca", "comment": "Malware payload", "value": "0780b7e2eb71f47943dcfa10a83076cef8bd8595209e06d87de08c8341d2b914364170a5f20c6dbb554a1716aeca82be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705673, "uuid": "84d301c4-a9a3-4dc2-8098-00b018993881", "value": "T1FE42D08217522289E221DF7D3B9C340BC05C593371395A107E66D60BD82E72848BD69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705673, "uuid": "e43e57ef-42eb-4326-bb7d-88f2c057977b", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsD5:yb2eX3zAKuiNPZRwwq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700705673, "uuid": "37e16315-b6a3-4243-a943-2f5088bcdc18", "value": 12952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700705673, "uuid": "ced649c4-2613-4ebf-ac7a-0539ab13f333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705673, "uuid": "839ae9e1-ac7a-4ecf-aa83-7cda8a202dcf", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.20649.393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fa94e5-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724427, "uuid": "577e8e3c-3c95-4d3e-bc71-cb9106c38c58", "comment": "Malware payload", "value": "611880253f1f8cca26d26252fc1580c5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724427, "uuid": "03742a96-c4bc-4133-bf29-eb641cef7a17", "comment": "Malware payload", "value": "714971d8fde4253f72440e5880af794ae86ca0b2557df3b9de2aca24990c1c9c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724427, "uuid": "d8f5ed71-58ae-4a0e-8ad3-b92e58529398", "comment": "Malware payload", "value": "63e3fcede0a318361353a037adfbf43385b9b82f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724427, "uuid": "c891aba8-40c6-4af6-a662-855b32a2d3a1", "comment": "Malware payload", "value": "02947caa109bcbce91417af5ce78fb157093dfb0fcfeedf35b9713ee93c780c6ffa439c23d9faa8c9356c35db4831213", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724427, "uuid": "a4d14f50-4578-477a-8ab8-526499ad460f", "value": "T13EE423EECFB8D1591AA2A0944417376345D976381C26BF51AEE3F708DEA03E398D2D07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724427, "uuid": "927b4d9b-84d6-4b95-a0d7-d51ec2a4c7be", "value": "12288:5AAO+vSAGFUedpc+A7T7mH+CgUjNM1gXK+DMETkHjn1bsfc2Ch79Q4MevIsW:5AoqAGFXplmqM1gDHoD+VCh79Q4h/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724427, "uuid": "5034cfaf-2ba9-4b34-b7ac-aa44a4d8f20c", "value": 677525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724427, "uuid": "08a937a5-cd5f-4fa2-9f97-1c79b1a5a926", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724427, "uuid": "18acd06e-1348-40cd-8605-44fe732271e0", "value": "NewX800Xkg.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc322be-8a29-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700762101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762101, "uuid": "d7d4dfbe-4a22-4635-804d-09e0fd865ee5", "comment": "Malware payload", "value": "a2d6f4047b8e4c56bcd9b1c73a1eaa81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "turkceyamaci", "colour": "#88DC88", "exportable": true, "hide_tag": false }, { "name": "zero day", "colour": "#A87881", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762101, "uuid": "53b766a2-2c9b-4529-99e0-098227b28d1e", "comment": "Malware payload", "value": "73216fbdd11ff85e27b39e1cb08a16fda08fe5dc400b3d1632dd3e00f41ca46a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "turkceyamaci", "colour": "#88DC88", "exportable": true, "hide_tag": false }, { "name": "zero day", "colour": "#A87881", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762101, "uuid": "195d0d91-8392-4828-934b-6e5e04c70f76", "comment": "Malware payload", "value": "b43498d0a794806f02e76c4acee391f19be22896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "turkceyamaci", "colour": "#88DC88", "exportable": true, "hide_tag": false }, { "name": "zero day", "colour": "#A87881", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762101, "uuid": "2c8f77ff-13f1-4293-8f51-f6b78001888d", "comment": "Malware payload", "value": "13d64038902beb8f1e4a55b5e67b0dcfaf3fb466cfbdff0fcc040c429b2a0d288d51fc255f06c65369557ee9a46f9f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "turkceyamaci", "colour": "#88DC88", "exportable": true, "hide_tag": false }, { "name": "zero day", "colour": "#A87881", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762101, "uuid": "a49d5387-159a-4be2-9b68-9c1c4f7e7b2b", "value": "T1E1F733317286C53BD16A06B02A6DDBBE4129BEB10B7140D7A3D43E6F78B59C25731E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762101, "uuid": "ebc51c44-77dd-4c30-83b0-f84161b9c74b", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762101, "uuid": "ca5f6519-05ff-4d77-b90c-fd52f0ae1687", "value": "1572864:h2lqhpZDykekSjofjyjsUSnSTt2mjN6LIFTtAmriZnm:Ylqzp8kSjobmsUQC0mjN6Qbsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700762101, "uuid": "5e7a3e0a-4d84-4702-ad1d-6ba5d581f47c", "value": 70833050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700762101, "uuid": "ce189c9a-565d-4b51-b956-d744632be2d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762101, "uuid": "2f98ac5c-3289-4417-8143-e79027d46200", "value": "ParkingTycoon TR Kurulum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f28a0a7-89ee-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700736604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "25541ceb-0af5-4b6a-8bbb-14df074f813c", "comment": "Malware payload (Mirai)", "value": "03fda67c0ccc09c4f19cb02ae2e343b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "c15aaf7d-f943-44fa-97e2-ee4850fddc82", "comment": "Malware payload (Mirai)", "value": "73eb5c9dc4991129b7e74b13912a3571bd58184ebcd60b2a15693dcbca381f97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "1da9fbf8-daa3-435c-811c-ac4045a31a50", "comment": "Malware payload (Mirai)", "value": "a8a0fe15275a301cfceedb4028924ef52b37cafa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736604, "uuid": "5391c20e-7a4a-4f6b-8fb6-fad48ce1bf6e", "comment": "Malware payload (Mirai)", "value": "121314bada173165bde311889f4cce82db5b46908a67a4ec1320075438e485cc6364df15cc99305e93a4ad5860d76c83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736604, "uuid": "8a6c7cbb-ab53-497b-9d7d-b2dd6d6f1784", "value": "T186536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736604, "uuid": "a7ec416a-5b86-41a3-89dc-16ba4c07ec85", "value": "1536:Z7qARubgzY/bEJy0RcpF80LDHhklv4JQC9DSW:NP+eY/bEJG/XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700736604, "uuid": "add1745a-cf64-4358-88d5-a8aad8d9237d", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700736604, "uuid": "f0b3654a-5dbd-4f4a-bfe8-873e20628c3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736604, "uuid": "ade03bba-b1b1-4b91-9275-f490f7fe2262", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ff9512-8a50-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700778912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778912, "uuid": "11563be2-5e29-45e3-a816-9ec81ce01367", "comment": "Malware payload (njrat)", "value": "0988d861ab7e46ab09356809ca04545b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778912, "uuid": "921e1385-5733-4801-91f3-73ea4187e21d", "comment": "Malware payload (njrat)", "value": "7481123828123c8e5cb9555674dd05af6dabb6032b363d14709006f61f7d8059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778912, "uuid": "3d17f8e1-ae55-4dc1-b9ec-ac0eb43e2b5b", "comment": "Malware payload (njrat)", "value": "fc74ba58089d75cde7bbc79d53cfecedcd764f82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700778912, "uuid": "f42b72db-a5c2-4878-8a20-64515278dd6d", "comment": "Malware payload (njrat)", "value": "f63fb6ffe4f48a09ac9261c914ab85101e0b959b620f56f33a3735f6d4ed05e4300fe2c9c951f86019ff8f99aa214a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778912, "uuid": "36e7e70c-338d-4bbb-a26c-d5e5b6b05ca9", "value": "T1A854AE11B6D180B1D67319345AF9A7316A3D7C201F398E5FA3983E2D9E30590AA39F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778912, "uuid": "1a9f5a6f-9e7a-47a1-a833-8ccfcf6047de", "value": "73d12a96fab08773e2657237992c3c27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778912, "uuid": "6c687bea-a7d2-43ab-95fb-da7441cef6cf", "value": "6144:qB/ZSsg+5cpLqKQk9nGNH0CWJkn6DBX+t4lgjfsz5A8B:Sy+0LFQk96UVJkyBX+t4+jfAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700778912, "uuid": "0548fd29-62d8-4e21-b9de-71b1e67edb05", "value": 280999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700778912, "uuid": "f76929e2-abee-4a06-9493-d40a7507b3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700778912, "uuid": "789d185e-40bc-4d28-af09-cd344d03797e", "value": "0988d861ab7e46ab09356809ca04545b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88cdd9c-8a45-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700774335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774335, "uuid": "581135a5-73e8-4c1e-8898-28376f9cdad0", "comment": "Malware payload", "value": "74f118cdebba138ae492ce6cdaea068f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774335, "uuid": "319e5ec7-f067-41aa-99d8-07aaf85098df", "comment": "Malware payload", "value": "74bd8bbe2a61889d85a180f095da23635f4d87120a43da762c710f727506174f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774335, "uuid": "29a30969-5dd1-41a6-9ca8-ab493cd72f76", "comment": "Malware payload", "value": "338a3dc65a74de989edaf8dc3b904cfb0bc91267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774335, "uuid": "45486ad4-9dcb-4a8d-8edf-6a9741c3cd91", "comment": "Malware payload", "value": "e22c3cebafaa1a8ed009be5f603402f2f36c0274d0a0b35a2bc01ad69a1030e7f755f371f159d2e2729745ac1279cf4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774335, "uuid": "5636ec07-6590-4f9b-bfb3-c08b49254799", "value": "T198D5338BA582E9F6E03B99700D246EBE49EBB9D6747A941C3CEEA44D1F73116100F374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774335, "uuid": "6f3bcbce-3d30-47e9-ad63-32e37fc2ab46", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774335, "uuid": "f97b1756-8fd2-4a1b-908f-dd8238af9f92", "value": "49152:y2YwvLbBL8IQbDbq6hhFiucmUHq2uK3njQJJmgBkVrAhUQCe4f4/fzdedvQRY0E:jfvXBLk42UHuK3jWXWKOe4fWdmQlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700774335, "uuid": "e9e72515-9a6d-4fef-9104-4f55f2ecd0fb", "value": 2881599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700774335, "uuid": "942ac1cc-334d-4a3a-9471-15bc19c04fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774335, "uuid": "34651bb2-ca7e-4b65-bf94-0dfda9972708", "value": "SecuriteInfo.com.Win32.Malware-gen.13701.32757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24aa3a2a-8a1c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700756397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756397, "uuid": "1ae40244-0150-41a9-b6d7-46297ffc04d6", "comment": "Malware payload (Formbook)", "value": "28159b2b441949edb1434978031f397e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756397, "uuid": "9a6b9d5c-0db8-4f27-b2fa-82ceb6cab4c1", "comment": "Malware payload (Formbook)", "value": "78496f72528a3e25ab543f4cf13440b96ed65e08608f059af2c8958319261657", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756397, "uuid": "363aa17d-09f9-4cd2-8840-3e549004b6e0", "comment": "Malware payload (Formbook)", "value": "3caa2e5b0b35c2f1fb33f8529cac759c0c0a5ead", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756397, "uuid": "904c96cd-334b-4b4f-8913-d9a25d497d2d", "comment": "Malware payload (Formbook)", "value": "c0e7ce8565181c183684a64309174b6be3adfb1df853b3a3e37d7d67367f5cd7a5e87bf11f46d3c499fa6cc628967fdc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756397, "uuid": "710ac536-8a1b-49dc-a63d-9719f3ab7d99", "value": "T1CCE433F3657F28108ADBA449586C3690025854C7E98699B00E2CF7F6A14CFF762F94BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756397, "uuid": "ebc46f44-2985-4548-a65d-82d3d6d85f9f", "value": "12288:38HMB1RfnsXsSL7DHXEUgRZCryfaAlxQRIjAzPdP3PypHek1CtOzbRk5caBdgBq:3w01K8aHXEkriJl6IjodvPzk1xzbGp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700756397, "uuid": "f1c8c8e6-3b9d-48d6-88b2-3ecf07c3df4e", "value": 672690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700756397, "uuid": "06811b0e-93cf-4500-9166-f174fd07ad27", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756397, "uuid": "1260329c-02fd-4aaf-a20e-759bad985bdd", "value": "Families details request.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c343cd2c-89ac-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700708559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708559, "uuid": "89b3e409-508f-4038-9146-7ded14a6dbb3", "comment": "Malware payload", "value": "2f36aef72f7ee7c39ccc2b3389b34d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708559, "uuid": "0fe26b2b-5267-4b43-860d-8f7d6423c9b8", "comment": "Malware payload", "value": "799f36b6ec3ececf02592ac9fc0a2ac29a6cf0b0b3a11aaeb0df4b5245c9809b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708559, "uuid": "148034a9-9657-4f86-9026-c0a175d47c65", "comment": "Malware payload", "value": "d9119c4c9c176f01bc61d06715553cab69ca04b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708559, "uuid": "80ef5c71-e336-4e3a-b9bf-eef0c9819acf", "comment": "Malware payload", "value": "9576f45b70204397b48b68ad8d29be28893537e662ecbbc92571f0951686e0879a08a91a50fcf0cbdbb2c28c52f1d7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708559, "uuid": "01e4a49c-6b3f-458e-b56e-340c753bfbb8", "value": "T188446A036DD0EC21D45647714F2C86EC7B6EBCA2CE15977B3614AE2A29302B2D66733D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708559, "uuid": "d7437b30-392a-48fe-a962-ed1f36c93763", "value": "aae67b5fef530aece88f7388e72aec2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708559, "uuid": "af444c26-7ff2-446f-992d-df652ce7fce4", "value": "3072:3AvCWyoq2mOXW1H+hiGCu0NC1k5zQzFDVHp5f5t6xXPEIAT:b2mMYH+MG50lzQr3gXPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700708559, "uuid": "f2d89bb7-dc5e-4359-9243-fbbfde663f80", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700708559, "uuid": "d3cb2273-6f23-4f9c-95ec-526a6dceeabe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708559, "uuid": "9257bd04-2148-41d9-acff-91cf0736cb7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b623416-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740275, "uuid": "58e6637c-b70e-4b5b-9662-5e575fd23faa", "comment": "Malware payload", "value": "0133fe023b7b4d6aa6ab22c30e1dc060", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740275, "uuid": "e4c1442a-00df-4313-a0d4-978cc499f9e3", "comment": "Malware payload", "value": "79e0fcb3dba988510f42059372ddd0cc77723aba3ed40d7220ca44467e790b6e", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740275, "uuid": "5b0bcf5e-f689-4782-b4f0-37402aabd726", "comment": "Malware payload", "value": "e9c372333e30faae0d102846e0d89f889d20ae85", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740275, "uuid": "ddebbcb8-a412-45d8-8bd7-f0ff0b088d9e", "comment": "Malware payload", "value": "d8c3b36d17e33880b6c29e6fb54504dc2706353f889f5925de021192a7149c561d9464e98eaf56fa4614e16b0c0c1bea", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740275, "uuid": "5e371268-253c-4b0f-913b-6875bf2a7073", "value": "T187E02B4E98CAAB63E01036F4702629B5E727E56450D66267929FA4284EE36F04E1864E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740275, "uuid": "21063e0f-412d-4e63-8503-09433be4fbad", "value": "6:5je/3AkXJY7hUSBL2BYr3K5I0zbJXMPfXCtVn++t2TyiAkXJnks7t+lu:5je/weW76y5r65I0zbJicViToepH7tau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740275, "uuid": "9743651b-5040-4859-97f1-dc666dc4eaf3", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740275, "uuid": "5b1fe220-cc98-42e5-a7f7-7415113ab43a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740275, "uuid": "476e369e-4668-4531-b044-8a2d53c1ff3c", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b646fd-8a0d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700750191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750191, "uuid": "ef4ae84d-ab75-4bc1-ac04-899b3901d485", "comment": "Malware payload", "value": "4ed704febaafefe33af1d3b4b994ec46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750191, "uuid": "9211ca61-e57b-4a3c-9c34-330f6aa3cf56", "comment": "Malware payload", "value": "7a73364757e45002142e0cd2ae8a5541caf371027239afadae565e852f0bb026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750191, "uuid": "09bfbf6b-8691-4955-a06a-0928bd543832", "comment": "Malware payload", "value": "488b034dbdda0197f0fa95ebfbb3eb9ff9652ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750191, "uuid": "3a72c7f8-f537-445d-a361-d55004e3b714", "comment": "Malware payload", "value": "f73717d28e9a94e5da0a003701d854b94841a1970c58a69f9ca3c2987413aec2c53e702977c4c49314c2005a6b4a4fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750191, "uuid": "4e5f46e6-5f60-4c5e-9402-32256233cb7c", "value": "T1D805F11353F1BD21F6264733BE2EC6E4661EB9714F046BAB330A6E5F19B11A1C662313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750191, "uuid": "6683aed4-1efc-4ca9-9881-4d2b6c3dc81b", "value": "827e672033ce1c079bf12fe02cb369ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750191, "uuid": "c5b23508-0b6d-400a-9c56-c9aef6bb344e", "value": "12288:MNGs/DUwn7d56lXCxOI5BzH4aBvBCwLuSdP2mkI/8fRKg5cDrDI0:WJnx2XsBjX4wLv3khQgaDrDI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750191, "uuid": "e1e96960-9730-4025-8574-c518416a0f2a", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750191, "uuid": "960e01bb-f9f4-4a6e-9170-5624bdda2a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750191, "uuid": "649ea89d-1d0e-4158-acdf-882d8a2aaeab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7c0314-89dd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700729295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729295, "uuid": "b584c0dc-9673-4dd8-baa9-37bfc765b2d0", "comment": "Malware payload (AgentTesla)", "value": "becfeb749bd3a5d12804c17095b622e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729295, "uuid": "1bdd4328-3afd-48aa-8575-f54ea5720e2a", "comment": "Malware payload (AgentTesla)", "value": "7a9416fe8c10ff25bf3576bca892784bd57d29a530fe83f7698edc0900a52d3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729295, "uuid": "6c839d09-a8b4-4602-af38-98582c712086", "comment": "Malware payload (AgentTesla)", "value": "d44554af76297c2108153c0df2d58f2dab3ade8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729295, "uuid": "576726ae-3db8-454c-ba03-1bcc3c903a30", "comment": "Malware payload (AgentTesla)", "value": "6d05a486796014c7e57d82b038bbaa35794bc23f9e53bbfb8448780920e372f56f26e3e2813ebab103376d946f3d01bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729295, "uuid": "604e351f-813b-4acc-b871-793f1f58e14e", "value": "T1DCD42378856ECE8CB1EEFE6F509708F31EAACD5C25185A363B58B15B3A32D1198C5F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729295, "uuid": "c5ba084f-e8e9-478f-b509-d0889a9cba55", "value": "12288:ScYHkQH3chGPrpDVi8ve+3MQHK+9rwMulgAUy7KcSoN07Smv5/:pYH7CiBV3e+cQqgxulgzy2cSoNQSmvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729295, "uuid": "f1f92a99-3e47-4ee5-b731-ecf4dc7b60de", "value": 597623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729295, "uuid": "eebd128e-d648-4b53-8030-eb2302e58aea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729295, "uuid": "a8feb979-9910-41b2-9ce3-22d0562b3bcc", "value": "RFQ-10318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b214c8-8a1c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700756405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756405, "uuid": "0d810b4a-1eed-47d1-90aa-037df22cff4e", "comment": "Malware payload (Formbook)", "value": "baa24c607d895cc05b0cd324a16a89cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756405, "uuid": "174ae537-e95f-40a3-94f7-1fd3c1fa5456", "comment": "Malware payload (Formbook)", "value": "7cf52f2f8e215fddb4ccf366bcba1dbd374745a86e45613522461a3a71ade4fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756405, "uuid": "a339c2c4-0c6e-4435-b320-77d7c1b5e983", "comment": "Malware payload (Formbook)", "value": "defba61f4d27f21a9e9b86bcac5d992cb5458b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756405, "uuid": "0805fb7b-6a71-4b8d-9c4b-a1e5a224afd0", "comment": "Malware payload (Formbook)", "value": "2cb33b3d68e3839bd1c1a48ac4b4652cc6c507863acb7821a3e09199ba4e4f162b1d2ecb6f238f135131d87cb6f968b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756405, "uuid": "998ac7e9-dd69-4056-b0c2-ae4357cb1a8a", "value": "T12F15AE1CA6650B93F63557F9D5282E0803F02D3C30AEE7D8BDD675EBAAE0FA10522517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756405, "uuid": "6fddc30e-cbe0-4612-81f5-5593ffaaa366", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756405, "uuid": "838e0cbf-3aad-4c68-8236-dacbcfc8d38d", "value": "24576:ZdtD/F2k78ySf9UoGRtg5NnEUtPI0epjo:Zfgk78Tf9UoGtg5NEUtPI0e9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700756405, "uuid": "8b64d427-dd62-4fc3-89de-32927e2d736f", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700756405, "uuid": "84dc37fd-6e62-49a9-abab-a568fe1f12e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756405, "uuid": "4da9aff5-0731-480f-af3f-eddfc3918db9", "value": "Families details request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5ec336-89b6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700712819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712819, "uuid": "63fc7fa2-842c-486e-944d-f73617cd1eea", "comment": "Malware payload (Mirai)", "value": "151f3140977754a9befc0fab17a0cdcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712819, "uuid": "9f9e1b7b-be33-468c-911c-ac9c820d6d88", "comment": "Malware payload (Mirai)", "value": "7d127378f0b4a5a2c3304d74493987da57d1ca7e289c63f4f7fb7c4808d8c3a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712819, "uuid": "a43f4759-2439-4ab9-955f-ba7cc74b8126", "comment": "Malware payload (Mirai)", "value": "f013eef283e3bd33d57d0464db9bfd6559887e8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712819, "uuid": "16d3dc8e-8f0e-407b-ac31-e04628e3d69d", "comment": "Malware payload (Mirai)", "value": "0fc14c55efb13761fcc3e28e6eabef991d53c2aa8b9c0803c6d5818561fbf1b486569cd3d4c6e8e8d56e438ca3c77e4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712819, "uuid": "86512980-f759-434b-bd8f-53d4d16d3471", "value": "T128D2E1B4A4422E32CA220572E4756ED647871AFE11BE343500641F25FAC3D85FEB9BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712819, "uuid": "4eff9760-b12c-459d-b533-ae8a3b4c365c", "value": "768:2MQ4x0RL12NtI3LTagjxSrAthcnCJr0r4oZiqs3UozF:/x0RR+gTaUxIuhcnC98IzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700712819, "uuid": "d4cc3cd7-0275-43a5-828a-9d99fbf76a56", "value": 28600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700712819, "uuid": "8d0542be-10b6-4d04-bf36-3a75cc99e8c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712819, "uuid": "95c3ef3f-02b6-41f1-acc0-d45e67420401", "value": "151f3140977754a9befc0fab17a0cdcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0eb032-89b6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700712921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712921, "uuid": "3836b853-643b-409d-81ad-7cdfc79b8950", "comment": "Malware payload (AgentTesla)", "value": "170c497de89a698235d5c203f65da668", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712921, "uuid": "f0d95f5c-c9b7-43a5-a8ca-ed3c92474c21", "comment": "Malware payload (AgentTesla)", "value": "7d7b62e77cbef24e0b75ea88d79b68a84e2fccdd74dac22de7c18476ce8313ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712921, "uuid": "43dd6dc0-57dd-44a1-b8f0-5c989f25d0d3", "comment": "Malware payload (AgentTesla)", "value": "8221743aa2125e139c97b2e6e326180b382b8c94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712921, "uuid": "4ba41c42-e846-420c-b5e9-fe02dfef7c1f", "comment": "Malware payload (AgentTesla)", "value": "72ab0e354ae2d437256239c92f5e649f8683d46715d176a62f6888589c4212cf0373e7deb4e3a1d1c165303bd31811d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712921, "uuid": "d94da707-45a4-4f8c-b760-6ec66d4231fb", "value": "T194E41218B2FA5B16F2FA83F50931755853B72A25F822E3490CCFA4CB5762F405A51F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712921, "uuid": "af3938c4-f22b-48d9-a300-da7e87951a34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712921, "uuid": "3280ed16-3d68-42b8-921d-b074d5c79bde", "value": "12288:97/gmLXGkJlmeKOgveYgLPuvs7ZTnI7yJhpa0rPNZbx+SrLBTBe+YXEQ:yS2k7xceXT7ZjrP1+UNM+YXEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700712921, "uuid": "5d1a0b2b-7098-42ee-84ba-97695ab5e377", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700712921, "uuid": "51d2d474-579b-4437-8c13-537b866e0b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712921, "uuid": "45d89654-60da-4bd1-897b-567325a64418", "value": "SecuriteInfo.com.FileRepMalware.14449.94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e767cb-89d2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700724915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724915, "uuid": "0d9cc625-228c-4e9d-b9c7-b533cb9958dd", "comment": "Malware payload (AgentTesla)", "value": "09822f26db3a35729b8b7c77e7961921", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724915, "uuid": "2e36f4ee-6389-4838-9692-c64dee074200", "comment": "Malware payload (AgentTesla)", "value": "7fcf515fc374fde7a68255e8bee877a91963cbd54e86eaa222a0efb550cebb6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724915, "uuid": "839a8422-486e-46a5-b5c7-1a3a28f6633f", "comment": "Malware payload (AgentTesla)", "value": "a2e7b21e95688554ccc681914295a5c9092bfbfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724915, "uuid": "602d6e9f-bcbf-4fdf-9e99-db1b25abf8dc", "comment": "Malware payload (AgentTesla)", "value": "3b2f6af58e740405bb0bab7a1d05df65609fd6db8ac67a6e7b84ce375bfc45f267db4964d1436410defa82787dbbd9fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724915, "uuid": "9295726e-0266-413a-afd3-514d49f1ea60", "value": "T1AE842323B0D0E4ABC8834E75F6B7636AD2B98E3069E29B4B67117FE54534106CE2D742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724915, "uuid": "2f6af964-7dc6-4968-9d43-d9ff002bdd04", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724915, "uuid": "94edff2b-c94f-47e0-9c33-bf11e7c3812f", "value": "6144:CBlL/x1Ca6cAVBo82AhR6OS+K+Xt0Aud5JrjksQFoNI9oX1z2gkPc2O6:obsbtV6Uz6EXeJfksqQIS6xc2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724915, "uuid": "423433e2-1597-46c4-9997-23f203458bfc", "value": 373533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724915, "uuid": "93ddb5c2-79da-43f0-9d8a-72f2c3a6e75f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724915, "uuid": "d95a8fa6-166b-48f4-9b61-76a71b57b85e", "value": "Quote Request 23070 PER 1000 Pieces \u2026scanneed 00101.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8ef152-8a17-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700754261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754261, "uuid": "7fe04529-cf0f-4d00-b5d2-5c276628c0cf", "comment": "Malware payload (Formbook)", "value": "d391a19a12e63fa9dfd32d7f62a783aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754261, "uuid": "84275504-fcfc-46fc-9a54-ffbd3a9e9f66", "comment": "Malware payload (Formbook)", "value": "81e1d22799207f59dc43e2999852b3ee61e09f71d3e8781e0a5a485d8ff1f900", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754261, "uuid": "0cb7452c-5819-40b6-9c36-4926214c98a6", "comment": "Malware payload (Formbook)", "value": "7795e75dacd82005288e8d12c9093f09d3abfe37", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754261, "uuid": "2403d894-d52a-464d-b6d4-292f017fc6f2", "comment": "Malware payload (Formbook)", "value": "bbbebbad9c752d6e3726a25b38ea68dea9bdfdb189e3639b355216a4432a7ae62e29f85ac9999c6a63b39cfd63a0a3ea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754261, "uuid": "82b123c6-08e7-4e34-8e2e-7c8cbb2e8443", "value": "T19445230169A44731CD6673F38EE1269DA3B2D85E5666D39A3CCD20CC2FB27014B61FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754261, "uuid": "0febe5c3-5b63-404b-8ce4-f910aecd4cc0", "value": "12288:t8oU24xPyMrknWwli74hhYglFSXQDZ3B5tQrS5ninWzIGWJ:OfxnkWw41gHSXMZntQrKedG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700754261, "uuid": "7ebfa490-0118-4984-9e05-09be8c58eda8", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700754261, "uuid": "a46d7819-963d-4582-94a8-36d037fa4288", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754261, "uuid": "6cddfd86-4a41-43d8-b60c-8937bfba6107", "value": "nRICO - OrderDO.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117413a6-89ee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700736608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736608, "uuid": "1edc7917-28bf-43d7-ab5c-a16f4cbb4988", "comment": "Malware payload", "value": "5b7fc29af98dea35a61fcfa3ae0ddf0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736608, "uuid": "b4789a46-fa75-4cbf-b8e9-54f994c7476d", "comment": "Malware payload", "value": "853879820f3f2b0f20bf7ac3e13d09b07828638928d78f51c33f3d6bb24116b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736608, "uuid": "383ba6fd-5c03-4c0b-bd67-ffe5b9f7bd8b", "comment": "Malware payload", "value": "195741746e83219137711a4fa3784fb8525d480b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736608, "uuid": "6bfd11f4-e72f-4c36-9733-66016a362d0c", "comment": "Malware payload", "value": "e1e67e0163c633f0b495e19b77619eaf4efbcdac820318084c135969f859cb3bd9f10a91f5c27993d9d515ddb3126209", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736608, "uuid": "2d2d23ec-33fe-4f4d-84c8-f0fe0482c6be", "value": "T170430852BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736608, "uuid": "57545795-836e-4ce3-a203-5774e12abc66", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7u1suV27cEhMDHs:Q6ia7d51b27fhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700736608, "uuid": "d7f22f06-a3ae-4387-afc3-d8500cb9bf3e", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700736608, "uuid": "4b1ad88b-cf54-40a5-a0a6-b2bd768b79b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736608, "uuid": "20cedece-5ef6-4d9d-8482-2c184914462c", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729a7b9d-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700729040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729040, "uuid": "f7dd6a6e-df84-461a-be69-7485193d6f2f", "comment": "Malware payload (Formbook)", "value": "948e9d652b6929e020c067be9a7926fa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729040, "uuid": "3907cabb-bce8-48bd-b30a-c94eb63d7e83", "comment": "Malware payload (Formbook)", "value": "86e1ee58a14702e50080095f8fdeea1cfda8a6ed700d1bca9560ed1c2802e2dd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729040, "uuid": "7e40b858-4caa-4239-9245-04d817ffea63", "comment": "Malware payload (Formbook)", "value": "969f39e549ba1cc56c601827305748f772938824", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729040, "uuid": "ace96125-e3c1-4fef-ae9f-a5762d5fef16", "comment": "Malware payload (Formbook)", "value": "f07c059d8a614106846bfe085f907e97ba08163082fa2175e890e3465d98dca56ac4befd378799fcb7647adcb9ca77c6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729040, "uuid": "8afcdb9c-dd6d-4d4d-aeb6-95695b8ed89f", "value": "T15DF433CEB560A588F481B7447C3E18DFE0F11A2255081FA5BD1BF251CA79AC1CDFAA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729040, "uuid": "d74577e2-b885-4bd7-961f-cd144e1d7ccc", "value": "12288:RscNM7O7m0zk0WWRWzPn1jIX9VuaNMIlSCl1OYAGg6Gk+Iz1eHCjoHDema:RscNwN0zHiP+X9VuaNLlvzVgUBj6iN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729040, "uuid": "3e7007f6-8449-4087-b29b-7a5195b1c471", "value": 752966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729040, "uuid": "f5dbc730-0d8d-4ce6-95b0-ae141e33c2e0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729040, "uuid": "a1994d89-d907-4bfa-bd37-a17e87cc3892", "value": "SHIPPING DOCUMENTS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5938edeb-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724273, "uuid": "17a8ac7b-12a6-4b18-a997-fc57dd9e8ac1", "comment": "Malware payload", "value": "1c82f960d18aac73b2b604417f040a07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724273, "uuid": "10713d20-0bfb-4008-b8b3-3e0017c5c2fe", "comment": "Malware payload", "value": "87dc39ac4be051faa3b71b9898b3cd39eaf8c78f5d59610ade25f63c306887ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724273, "uuid": "e882b30a-f274-4f35-aa0d-9113b759cbc9", "comment": "Malware payload", "value": "eb817c0c4202c0a34b30513e9430200d462cdc85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724273, "uuid": "3ac2c3f3-298c-43eb-8449-b43f7f61e694", "comment": "Malware payload", "value": "bcade550a1256fd81ea0b32a8d30a96ea023f2dd2e8164d5ed5a6dc3fc44ba0c2aa54cffdfdbef5d3ceea5580f9e2131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724273, "uuid": "83602950-137f-447f-9ef5-1195c70f1a04", "value": "T1B784238134D15CB7C8830272293AD7AEF6B1C815A176B6D73BA0EE369D30EE7D249143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724273, "uuid": "42ddc51e-673e-4dda-b7cd-1dcd0982bd2b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724273, "uuid": "2de15d6d-9f0d-47dd-8126-c4b9d23de279", "value": "6144:QBlL/TlynEHP4vix8uKKV5eE4IJ6hiueFk+y7w7hSsWjh0tv66aBg66ZXr3R0:iJly84duKK+IiFok+y7w7hSrsnaWd73a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724273, "uuid": "b1adae06-5812-42a3-89a8-2f9ce26b289f", "value": 370991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724273, "uuid": "123c6a9f-12de-42e2-8296-c77251f44bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724273, "uuid": "c80fbef5-5f8f-4c03-a299-b13473608d03", "value": "pAYMENTcOPY.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cf5b94-8a01-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700744772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744772, "uuid": "4e30d709-ca5c-490e-935a-737b893c3dd7", "comment": "Malware payload", "value": "d629c9c574869fe38647fb838efdf4a8", "object_relation": "md5", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744772, "uuid": "c7d97431-ce69-4aee-ad2b-c3bbaec63aa6", "comment": "Malware payload", "value": "881aa4a7e41df5264bbfc6e4dab64666051de4b22dd7a5c2bcfac93f9f8fbf3c", "object_relation": "sha256", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744772, "uuid": "5c0188f8-a8ad-4816-b4db-9e6e9aebc707", "comment": "Malware payload", "value": "28f95ab915164471a8474d035c9535dd9d7478d6", "object_relation": "sha1", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744772, "uuid": "4748a247-a779-4e6d-afe0-d89371cd8d6f", "comment": "Malware payload", "value": "a2055d769ded7cf2a9b2f9d63e29b4f7f94895f589d5f2cc3a441dd263f8c5aa81df8ab01121c5ee6eb22ae17f462004", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700744772, "uuid": "c0f123f5-bc7e-4049-9eac-f98b9d18eab5", "value": "T1119423374FBBD06E3B054656D94EB59D62F75EC30A0F0A49A3FB508A45A86C0D3AE09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700744772, "uuid": "aef54b26-7c84-46b2-b61a-a251bd7cf310", "value": "12288:upEgYFhZYsOyPw3twCx4ScYJeATE41CCbch7Mcf:upp+Pl0ey71bP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700744772, "uuid": "f8dbdade-46e3-466a-915d-25499e8cb07e", "value": 417232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700744772, "uuid": "0a2f71b1-f411-4b79-98c7-21b51b7c74b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700744772, "uuid": "70585f83-9a99-4dc3-95a7-a0a49df907e3", "value": "Chat_GPT-5 for PC Installation v1.1.3.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef19aba-89e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700733302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733302, "uuid": "7a14afa7-ecfc-4eb9-aec0-86ffc3817ada", "comment": "Malware payload", "value": "e516c8cddca31ccffdfd2f31582f0542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733302, "uuid": "e2b8f6ce-e126-42f1-ac4d-c0de65596aa2", "comment": "Malware payload", "value": "8900b70182eceee4057755ba7eed7194c24af4a423e9fcbe63cc2f9aa12913a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733302, "uuid": "be0f914b-be4a-49ab-a779-5402c05f10e2", "comment": "Malware payload", "value": "70e133427837a92bc0d6a3c7500337857a1183e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733302, "uuid": "efcb861f-841f-437e-a6c8-5c7446f0f84d", "comment": "Malware payload", "value": "d45f020272331c206dd5b29b41198bd303d053c7252eb7239573dc07cb4606dd494bc985767cde8952d81ae2cf97972c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733302, "uuid": "9d7504c9-a92f-4cbb-a75b-5b7c4d4ba031", "value": "T13E15D01466B95FA7EB3A83F95420520407F56E2D507FF35A5CC7B0EB2BA4F900684B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733302, "uuid": "ec40e53c-f4c7-4170-a5a7-9d261c3fce1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733302, "uuid": "744cd685-5a66-43e6-9503-b18f8adb0e64", "value": "24576:PiCtD/F2k78MTZjI/OuM+JEJBa5eZJTF9gH+dX:Kmgk78MTZjQtuBa5eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700733302, "uuid": "d70f27fa-fd85-401c-81d1-c5281c56a62a", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700733302, "uuid": "6e4f119a-9d6a-464e-ae61-c86ec62c824e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733302, "uuid": "e13c0727-0d03-4f64-92b1-3d3b6288173b", "value": "QUOTATIO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f532138-89b9-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700714083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714083, "uuid": "10521bb0-b239-41aa-84f4-6498d3a571e9", "comment": "Malware payload (RemcosRAT)", "value": "bf99c341cad2c0853fda1744023530b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714083, "uuid": "f3fd44d4-7cca-4c1a-8d5b-ccf56ad02adc", "comment": "Malware payload (RemcosRAT)", "value": "8af2c945b04889ffc1c53ab93223bd6ef3a0d6cae3ddb8afb4ddd36599864dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714083, "uuid": "2a272b0f-a005-4ce4-aab1-49cabb85c2af", "comment": "Malware payload (RemcosRAT)", "value": "34389402830bbc6fa4bee91a1ba402b48267280a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714083, "uuid": "45d84d11-eb53-4479-b1a4-b8f0bb4fcb41", "comment": "Malware payload (RemcosRAT)", "value": "568ea632342aa051822801e613525d29a359434a8f12274f95f3afd116e78e02381401e1418adc182d27c286424ae36d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714083, "uuid": "30b88c39-54a3-4dfe-bad5-94fa7aa1d450", "value": "T149B49E01BAD2C072D57514300D36F776EABCBD202826497BB3DA1D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714083, "uuid": "678d7ace-e9e6-4f86-9ec6-1a9a86fd2397", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714083, "uuid": "38238296-5357-47bb-baf8-821b7d0d298c", "value": "6144:+/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec787ov:+/uPq3AfK496Gw0lwGXN3pvs/ZuR8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700714083, "uuid": "8f628d12-490f-454c-ac63-6ea8f93893d3", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700714083, "uuid": "81523eaa-7bc1-4fb8-baa1-4a129721d849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714083, "uuid": "e93d9caa-a153-4492-8b2d-9eb1d5d1cf51", "value": "xeef54NztA9k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69efc8f-89d5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700726121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726121, "uuid": "a8c824e9-f947-4bb0-98bd-33a5f1797fcb", "comment": "Malware payload (RedLineStealer)", "value": "40c2a7d6baf2b837fa891f988971deef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726121, "uuid": "8a782498-af5e-452c-b64b-54ed05437fff", "comment": "Malware payload (RedLineStealer)", "value": "8ba6d00a29c4a11c7fcbf696066abb1e891aef6ab8bbc1f7ddd128da24a9a8f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726121, "uuid": "215757b3-d603-488c-9e6b-afae4905e1ec", "comment": "Malware payload (RedLineStealer)", "value": "fdd8aa270e3a888641a17f72e918c6d5859e63c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700726121, "uuid": "699614cb-a8b9-46b6-abf2-ee103032d562", "comment": "Malware payload (RedLineStealer)", "value": "d589afb012cc9713c1fd98502b0c780b84ac02aa094fa19e5af633f693f58f4a2a4b8793aeaf368a2015c3b8348e0d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726121, "uuid": "bf5a0d22-be1f-4991-99ff-31636bf07340", "value": "T1D9049EB43EBEA170C85BFA319F10A161102724575E6B785E22A737651AF34D0FA1CDB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726121, "uuid": "982ace50-9f37-40dc-a10d-7d0c4ab9ebf4", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726121, "uuid": "1f8c2fed-95b0-4bd3-ac1a-5752fb428b98", "value": "3072:WPBlahblH+Brnc65Ekc2IIPM134sv5fn6aMRYHNhnJJPlRUq:aL6H+h5PpIIioE6CN5nlRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700726121, "uuid": "0a91c1e2-1e3d-4687-bae0-9045f0fd24ce", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700726121, "uuid": "e2be8985-ebb1-4474-9230-39621d6eb971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700726121, "uuid": "3090ec96-dd6c-469b-a326-32ba96e393de", "value": "40C2A7D6BAF2B837FA891F988971DEEF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191dad0d-89ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700722877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722877, "uuid": "0948a76b-2d6f-4894-a1e2-cff1c0eb78e4", "comment": "Malware payload", "value": "4464b94fb15a769ec60dca00f5cbe4c1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722877, "uuid": "3e2eceb1-d9cd-40a5-9512-5729abf00656", "comment": "Malware payload", "value": "8d9050074a495def6132461608249dad47f5b014c35abc0c6773742d0211b251", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722877, "uuid": "57091177-4dfd-4119-9068-12f3826b371b", "comment": "Malware payload", "value": "89bcf13b1dfbef99ee11705534c29364c4670be7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722877, "uuid": "95a14bb6-7131-4375-9d3c-30ff4fdb0de1", "comment": "Malware payload", "value": "6f760e3e4299660f804b8806ceedf667e540b2c94767ccccf326e81e002446e63b4639188f011468c1a321fb9462453e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722877, "uuid": "bcbcc770-ab3a-4579-a1c4-331de03f6bfb", "value": "T18B55332F2EB868FBF86C17BD7118E46AD66DCA6031B9488FA547546E0C5F1310BF6B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722877, "uuid": "aec2704e-e459-4af0-8ad7-606aa5285f68", "value": "24576:cyAEM7aLSsGJUJwFojwfwWWeXlGvpmSzmwjfIMPYo72EmElFel7C:BFMqsJDokfwkVCphjpZx81C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700722877, "uuid": "1473cca6-1cef-4922-8de0-6fd986b68fad", "value": 1307110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700722877, "uuid": "b8ca8889-68a4-4ea4-9e10-a8392747bbbd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722877, "uuid": "48467077-091e-4a8e-8f03-4f590ba248dc", "value": "orders.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7793319c-89e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700733343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733343, "uuid": "b6e2706e-e252-4a8f-9082-418a69e2ac9a", "comment": "Malware payload", "value": "10a630adb7c2623100b2b37c4d9e8051", "object_relation": "md5", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733343, "uuid": "7f265fe2-b7b9-4b9f-9f6b-f243744c0077", "comment": "Malware payload", "value": "8e5885f3e48b4cdb2690ce3316758daa8830db8d77fd2fd74dbf68eb8ad61321", "object_relation": "sha256", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733343, "uuid": "4094823d-ddb8-43fd-af76-e2cba551b916", "comment": "Malware payload", "value": "4ee2ac1f77b73ba3f914bf8cd026ce0a420f2f0d", "object_relation": "sha1", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733343, "uuid": "c000d78f-681c-4495-95fc-12bd6b91eb06", "comment": "Malware payload", "value": "cd2161e948355c631cdb8ed3e201f57f41634115d750f1c2c2561c8c3f2cb15a85befbb077bdc94df51a2e263435af1a", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733343, "uuid": "acc7aec1-1614-4902-99cd-7c87cea9feee", "value": "T10E94237D7DA1739FDD5537496062D38FEB94E02DB8832B4ED2DC9A184E5E04B1838D09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733343, "uuid": "0b3b6d09-f248-459c-baa4-843e29239c6c", "value": "6144:5N56Xohwc/76gvolRjVqibIxgeP1G3SlcDNcC209qIQe3ojx9Sy0/BMF1Rxczw:Bq4dolfqibUhaMiccUIP48SWzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700733343, "uuid": "32baef8a-0388-4b06-8075-1e05e8a31a05", "value": 417228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700733343, "uuid": "6e69fb92-9372-4b42-90d4-f87a9386b7f5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733343, "uuid": "fef7b2de-9911-44e7-b3a6-54568bf61759", "value": "GoogleAI Pro for PC Installation v1.0 (2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc917e9-89bd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700715744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715744, "uuid": "5b322dc0-e4f9-4bbf-a1d6-24c637fbd2ca", "comment": "Malware payload", "value": "6e7960d10c9668e3f3f9e13e4084932a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715744, "uuid": "d35a4fec-57b5-4a1d-b5d1-9fe32d22a92c", "comment": "Malware payload", "value": "8ff6d00832a7620607a36f23dcd9670794604ff5fb490b88bcecf646cedd43ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715744, "uuid": "909a2189-c4c1-487a-b368-ed5e4eeb5934", "comment": "Malware payload", "value": "1248c40ee495db51bb3726c6018ad7d137b08973", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715744, "uuid": "5a036760-af6b-4490-91ea-732848852397", "comment": "Malware payload", "value": "7872bd15a6b080a549a2e62192e5c514de537394e6ababda5bcec642ee02b7816ccb6cf3ed09e7eeb76eab7809676742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715744, "uuid": "a5a97bf6-ab0a-4c2a-bbc5-81a3859db969", "value": "T1AFD5226263F84946F4F27B706D7522518E7ABCA6BD74D94C620A088E1E36A0DCF71733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715744, "uuid": "5a303314-b600-41c0-bc53-2dabbce6180d", "value": "d835b9d287a6a0ab022189fd9a6457f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715744, "uuid": "b6fcd6f4-db02-45a2-80d2-fd26c608d9cb", "value": "49152:nNA9h1vD1kqvSypvmoiIIgvHzlZ270iXft/l9Xw6zi/1IefAVq4xFM:NAH1L1/ZcO/p4PB3Xw6zi9IcMqeFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700715744, "uuid": "07b478d5-22c2-42f0-8d6b-53cb3dc2474b", "value": 2773504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700715744, "uuid": "60cf02f4-bfa7-4e9a-a321-4b25fef5acee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715744, "uuid": "fb50f006-e0ef-4b71-b35e-cf9874226e82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3efaab-89db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728576, "uuid": "def77031-3453-47f7-82bb-65bcf879e926", "comment": "Malware payload", "value": "1e193e1ec31624c64114446b48606e4b", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728576, "uuid": "fc32c25c-d5d1-4931-9b84-11b26fd4d5ae", "comment": "Malware payload", "value": "9028e4d15b0eb51997a30e99c0f5a1bd9842d8db56036ac194d3ce33f6e72677", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728576, "uuid": "82c3a4a9-5c16-4a8b-a25f-04f32ead9cc9", "comment": "Malware payload", "value": "d00be5e4689592dd362ad76834322154a4d5505f", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728576, "uuid": "5b8034f8-739a-4a13-b626-a9e19a07d0af", "comment": "Malware payload", "value": "e2e89950d72445852182b61156223d9b2c5a1dfabca413f8377db7448625dae04ba4d4c222da93bc3101b09a9862507a", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728576, "uuid": "036c3a86-cd3a-4802-a8e9-d8d264e2bbed", "value": "T1BDC4235BF300092D0EDA9FD076F19465C69968BFAB42EE4038B3458D46B7B437AA31CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728576, "uuid": "b399faab-1d69-44f6-99a7-48839884efcf", "value": "12288:+c5W2kM2VfqRLzvCajGiFbQLZ3JEgXpxWRe5k9N9ylDIgYkyXwV:+cI9Lqz3jGYIZ5Eg5xhW1ylDsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728576, "uuid": "cb4f3cba-8381-4eda-b1ef-8a1ee7700515", "value": 587681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728576, "uuid": "0e36b8fc-e9c8-4bcf-abfd-3846c3c59ac0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728576, "uuid": "d6082a0b-63ac-4bc8-9a9d-9d28bedd0048", "value": "Bank Information.exe.gz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc028d78-89b8-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700713809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713809, "uuid": "17858cb2-f49a-434e-a21a-f19b5c324b5a", "comment": "Malware payload (LummaStealer)", "value": "4cd7c1dd627d729bbd421cedc5c710a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713809, "uuid": "e9d699b7-3b48-4d60-9448-d4ff7541e0a7", "comment": "Malware payload (LummaStealer)", "value": "9062ef0482856caa22fe235648bdd7eb8233d6b3d7482dfe7bf32c8473eaf6a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713809, "uuid": "0e4199b3-0fa2-4782-973a-737b3b27ddef", "comment": "Malware payload (LummaStealer)", "value": "c1437890c30a8f3e88aded253a9a83a2da7c13f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713809, "uuid": "5c052d45-7518-4a74-ab3b-291960fd4190", "comment": "Malware payload (LummaStealer)", "value": "c3378aec22f35991aedd60c0ce602f76ee001d1c68169e83f4c399ee5c86713786bbb976b4727b8a9f726079640bba8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700713809, "uuid": "7f05de75-3fa4-43e0-bb94-0818e861e79c", "value": "T11F06CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700713809, "uuid": "bc5413a8-0128-40fb-bab1-f8fb178dee44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700713809, "uuid": "940d0c27-a615-4506-8cec-1ed2fd5d4667", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYw:8AqA4bNMAeLVdWRC9bO2IyOnhJYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700713809, "uuid": "96c2c497-9e6c-4105-9232-a389abecf662", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700713809, "uuid": "a85bb2c4-07c0-4a12-ae8e-2c8b82c17801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700713809, "uuid": "b26cb9af-ee8d-454c-aeec-54b4e7363f16", "value": "4cd7c1dd627d729bbd421cedc5c710a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555e4e2b-89a3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700704509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700704509, "uuid": "b41899c2-1076-44ed-92d9-492b37dd6262", "comment": "Malware payload (LummaStealer)", "value": "b3fbe8e5905d8acc91308435aa04e6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700704509, "uuid": "5107a888-89a9-49c9-b0c5-2f7c67454307", "comment": "Malware payload (LummaStealer)", "value": "90cd3c985ef79952b2fb86298035aeebdca818b35041120ddf0c67d48e0fe383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700704509, "uuid": "6b33569d-47f8-4a34-bf83-96bfe491fbd1", "comment": "Malware payload (LummaStealer)", "value": "9e7de9a1f2005bffbd9a6949fb098752001600ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700704509, "uuid": "e928b59b-b13d-404f-a66e-9e0e61b402de", "comment": "Malware payload (LummaStealer)", "value": "8af16761d1d07505acc5b53908fdf5081ec089db2c0fbd9e626806c16e53209aacbe17d0cf46f26c07ca5b97811abe74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700704509, "uuid": "931a13f1-7daa-42a2-b092-addf8b4edc4c", "value": "T17306CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700704509, "uuid": "edb2a269-b2bb-4208-9dcc-29c5446f180e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700704509, "uuid": "282ffb8e-660c-4759-871f-b64da68c3979", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYO:8AqA4bNMAeLVdWRC9bO2IyOnhJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700704509, "uuid": "8ff2ebcf-5160-457d-9330-7d3ea86fe4da", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700704509, "uuid": "c00d53b5-ca11-4c02-9bbd-41e7809c9f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700704509, "uuid": "2a18be48-ad4e-421d-afef-01448bfb95fb", "value": "b3fbe8e5905d8acc91308435aa04e6f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54dcf05-8a18-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700755002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755002, "uuid": "d5985850-329c-4ec0-810c-3d53c11118c8", "comment": "Malware payload", "value": "a5e36aaefd2b38d954bf5fb3bc0f0d71", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755002, "uuid": "2eca6a72-0b86-4c4a-a7a2-4ce67e07705d", "comment": "Malware payload", "value": "90f813c7ddbee8e6a7a5b058880f7ecd6be8f650934026b453c78340eee4e85d", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755002, "uuid": "4aff5bf6-fd7b-441e-86ab-5898992551da", "comment": "Malware payload", "value": "42fecfc375159329c86842770432bb4fb89155f5", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755002, "uuid": "abd68525-ec23-47e2-b39e-c76f7dce1441", "comment": "Malware payload", "value": "5443a721049c42ed5dbead0d852364f643314082ce190fe2a747a034247e3e2185aa5a7e3c75be493965828a972d0dbb", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755002, "uuid": "03b596ce-2ade-4f63-b26a-b751f4ad1800", "value": "T1C672D0A3E442A33EAC9D1C800ED81EC95C8EA8555F4B6E04CC91B54DFA0F8DF65AF563", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755002, "uuid": "50800738-c58a-41f2-b8d3-34946731e53e", "value": "384:kJmmBNJxJu80ldGMIKF5dA/qe0HyfcunJdifVfrHc4gY04bRPYk+q:k/9JD0nGMIKpRuEW6fV84gYDl3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700755002, "uuid": "c257023b-f28c-4013-ac8a-75a33a3329b0", "value": 17213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700755002, "uuid": "531ca559-5884-4619-b9c4-c67276478dbb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755002, "uuid": "1aeae207-3063-4366-ae13-e6862dfb8241", "value": "ncitar9775368797987989.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321111de-8a02-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700745252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745252, "uuid": "26368567-54f3-45c1-99cb-780d70f59646", "comment": "Malware payload", "value": "bfd96f4062f98e8c4e043c10040485b0", "object_relation": "md5", "Tag": [ { "name": "CyberLink", "colour": "#01F67F", "exportable": true, "hide_tag": false }, { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745252, "uuid": "d72c0e27-0386-4fe6-8bac-6a9108739248", "comment": "Malware payload", "value": "915c2495e03ff7408f11a2a197f23344004c533ff87db4b807cc937f80c217a1", "object_relation": "sha256", "Tag": [ { "name": "CyberLink", "colour": "#01F67F", "exportable": true, "hide_tag": false }, { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745252, "uuid": "17f633b2-9844-4175-b232-d6ccfa80973b", "comment": "Malware payload", "value": "f6acf86e4daf172ad9bd804c363a959e98a987c3", "object_relation": "sha1", "Tag": [ { "name": "CyberLink", "colour": "#01F67F", "exportable": true, "hide_tag": false }, { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700745252, "uuid": "e64c436b-38b9-4dfb-9c02-67cdca842797", "comment": "Malware payload", "value": "c5230a6b1e1e861b7ed3ae0379f8cad0ea3aafe5e49cde34457b00a8745216d259c0fad0cc24dd80ff28b22968add914", "object_relation": "sha3-384", "Tag": [ { "name": "CyberLink", "colour": "#01F67F", "exportable": true, "hide_tag": false }, { "name": "DIAMOND SLEET", "colour": "#FD2DE4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LambLoad", "colour": "#969977", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745252, "uuid": "ae4c5cd9-55b4-4a94-8005-cead03190b66", "value": "T19FB48D46A58180B1DD5E413420B3B3764F3A761271EDD6B39BA3E8B7CDB3151AA3C34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745252, "uuid": "eaea4a46-ef9c-405a-87a0-e553263a2e39", "value": "751bc39574c9af19b269ed6ab24bdeb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745252, "uuid": "191ce598-1fc3-41fa-91f3-813ae8902c05", "value": "12288:Be/gWT+NxOwAPCnbGmCKo8Rww/pskXRLWqjA:InQx+Pub0U/pskXRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700745252, "uuid": "d5e84755-b990-4703-9fc2-b5c004a5526d", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700745252, "uuid": "d34b83f8-f358-4cb3-a1cc-ed47ff7c2eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700745252, "uuid": "dd7f1798-ecf2-40f7-812f-47e00a370030", "value": "bfd96f4062f98e8c4e043c10040485b0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b660e2-89f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740454, "uuid": "db2cce4d-2a2e-41aa-9b08-c48a4bd332d0", "comment": "Malware payload", "value": "8e2e24a1afee5b83dbdb8e89c1ca8b42", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740454, "uuid": "73f6ca18-0176-4c50-93f0-b5da07b5b765", "comment": "Malware payload", "value": "917602de9f090920833163da75a8c9f6caa9b0fd7a2715bf95eb8c5a7067d114", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740454, "uuid": "47b3aa3b-6912-4db2-acb6-beed2b095382", "comment": "Malware payload", "value": "7e2a2833de281a57f184012a740ab0793160f021", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740454, "uuid": "f52cc0d7-095f-42d7-85de-462493963b09", "comment": "Malware payload", "value": "f5ce1ee8d501d8c7c1b830bf48800a95c88b2f4338522c9158ca393ae28c3f72e4c9ff9a0b9a439f5ae08b8096ac1ec4", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip 2", "colour": "#27F343", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740454, "uuid": "c5fd5dc8-d2d4-4ade-bc78-0be5cfeb1148", "value": "T1445533977651BC20FBCD30BCE839B88546CFDB89205BB4E09C5CAB582014EB5695FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740454, "uuid": "62be4834-ea84-4359-8595-24abd316755a", "value": "24576:Igk9UQ8xwmiO5KHm02Mi8OLjXO/3+YNVJMC9qnyD2j4yMoOf4EcAnGPiu:Il9UbmkKG02sO/E+YxMCRDzP4xAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740454, "uuid": "557c0eda-c722-4ea2-9838-3f60a058afeb", "value": 1306925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740454, "uuid": "384efdb6-42c6-4c19-abc5-6e8c86b418c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740454, "uuid": "4759d20b-059b-43a4-b163-385abd38bc97", "value": "service.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05edd63-89d0-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700724016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724016, "uuid": "a287a9f5-6f47-4c19-8247-0be315e192cf", "comment": "Malware payload (DCRat)", "value": "715873c14b2a5f7655acd55db4237dd5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724016, "uuid": "7dee18ea-d6a6-4e6c-9075-86b78baa1db6", "comment": "Malware payload (DCRat)", "value": "9423f5e024018b8fcc51b5e8ac1aa39fa8bac5204b10495708693902cf381139", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724016, "uuid": "39868334-0974-4ad9-881e-385232391acb", "comment": "Malware payload (DCRat)", "value": "0b3ed6b9e33d3c986740d33854ead96e37ccff0f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724016, "uuid": "e3c20824-f47e-4daa-b333-d6a64439caef", "comment": "Malware payload (DCRat)", "value": "d680b6b818a3c6502429c7fec2f7d5d6279093028c96e9e75f7578fd94e13f39c2ed5a1a5f535b74ef62a0cf45d81879", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724016, "uuid": "d7754669-3532-4813-9ea8-79e741fbb276", "value": "T190E5235D6F8E8E5AE3851A37D0C16352D732ED94B747F346218389E44C23392EEC269E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724016, "uuid": "abaa5bb8-c2af-4fc6-9816-55190eebdff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724016, "uuid": "ea59345a-e15b-4a5b-ae85-c1d0a0c2c3ae", "value": "98304:8GDo0/rwKBEEWMdjky4oKPAjduGngKoDYugPqCVmpyiiPJmF6:8Ko2rwKBEEWiF4mdgKo0XoMiMmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724016, "uuid": "e5c1d929-7a12-4fff-a58a-b029d3bfe08d", "value": 3223200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724016, "uuid": "0aa5d673-c154-4839-ab5f-d85e638980e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724016, "uuid": "8038ab73-e126-433d-a412-3575231bd6da", "value": "715873C14B2A5F7655ACD55DB4237DD5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44ae4af-89fe-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743807, "uuid": "870a5992-4de5-499d-aab0-b1811b788db2", "comment": "Malware payload (Mirai)", "value": "04cb1f31f8307d9ec8a8b71c20b3c417", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743807, "uuid": "8c09071a-039f-44e4-a493-949805bd3099", "comment": "Malware payload (Mirai)", "value": "96cc11015afff052bdf59cb75abaa561bec01d95c6b0100844ad65abb91d7aeb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743807, "uuid": "f6cb53c6-a7f3-479e-81dd-bd027a08f9f4", "comment": "Malware payload (Mirai)", "value": "6706d5db03ce5e1774083dacca11a8678c44159b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743807, "uuid": "862287c5-a46b-4514-ab61-57a36e53a208", "comment": "Malware payload (Mirai)", "value": "a33d30436793cbe1ffd3a69357aac35139aff3833fb6807d7a875d60fbcbaaa28cc70ef1eae9512d1a42bf5adc8c02dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743807, "uuid": "8a9df6ec-b207-49e5-a25c-eb56ab2eed5b", "value": "T1CEC2E130A6AD2CB5C7500671E6B85AC9BE534FBDF9FE3C80125057BA3841D092DE99C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743807, "uuid": "84b3b0b6-2161-4550-9e3c-104656fb1cc8", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEcCBddN/hymdGUop5K:A7soTAZ3alkXLvFh8nNEfddN/s3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743807, "uuid": "d29a301f-a9e9-4b12-8be9-f42261bd1b43", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743807, "uuid": "bee3ecec-3dae-4b4e-9117-3e8c81c941b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743807, "uuid": "66d92097-6769-4dc4-ad41-facee2f89752", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588ec511-8a1a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700755625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755625, "uuid": "d00cb22b-43c2-4c46-8279-cb735c5e5c2f", "comment": "Malware payload", "value": "3f1ee11454f4ca142dce6dc6f05fbd3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755625, "uuid": "1e3c00cd-1f66-455a-bec5-b2af64e299d3", "comment": "Malware payload", "value": "975c69e841169712fe977aeed7f0479c783675e550fab46e7d5ad303eea5d0a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755625, "uuid": "755fb83a-e12b-49ef-b3d0-1d82bd02ba8f", "comment": "Malware payload", "value": "25fef6f5f67fb577e94321fd41472c2aed483319", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755625, "uuid": "9cad4469-5698-47a4-8487-cef1f7c6c787", "comment": "Malware payload", "value": "6557aff437e1a765534824a6809de238439e82d1e569c1033a506735fd8fbe0adbc93d4eb945534592c822ebc0118a23", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755625, "uuid": "0d0e9a9f-7a1b-4844-bb0d-b4ee284eab4a", "value": "T146A701037BD440F5C16B823089176B1BD7B6BC645A31538B125F6B2EAF737919B2E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755625, "uuid": "0e363ba4-9e4d-49eb-9c66-cec3b987aa37", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755625, "uuid": "b03061d8-e967-4852-a931-e96eb6a68bae", "value": "786432:NEbQM1lPiZDY+EAYXnpqT4iqQUV6jS+OA+bsa2Lcl:GcMLii+E7nIy7L++sauc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700755625, "uuid": "457e8d58-e659-4bef-9a81-38278885a7cc", "value": 47186944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700755625, "uuid": "cd3d4689-8ff4-47ab-b231-717a42b26eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755625, "uuid": "6bd4831c-a020-436e-8119-4828dfebe62b", "value": "XLY.Frameworks.Secret.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabe1c4a-89b5-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700712518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712518, "uuid": "db1643f2-b684-444d-931c-b10b27f884f1", "comment": "Malware payload (Mirai)", "value": "2a75a02927a59777cb550633936fbc4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712518, "uuid": "c34ecbf2-32b4-4afa-9346-391721605a82", "comment": "Malware payload (Mirai)", "value": "975fde69ba69b8100b2e6a0768056dca7acf78109502639132a212f509d19181", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712518, "uuid": "0b2b9a3f-a44c-4824-a087-2a6ede122865", "comment": "Malware payload (Mirai)", "value": "9926f3bc09de45dd57a72717e976089bbc309117", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700712518, "uuid": "a7130860-4b00-4afa-80ab-5183567d69fe", "comment": "Malware payload (Mirai)", "value": "50982751758ecdf0fd751910689953bb0146e8326dea6def175f1a2cfbb91ac0f830688c95a68a03957860a3015b2a49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712518, "uuid": "4319c582-e07b-4a67-9d9a-e6d0bdf6a29a", "value": "T1C3E2D0274306A97FDC728D79AA5568C331924FF462CFF4A211119F6C6B831422AF968B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712518, "uuid": "93f2cc08-9bf2-44d3-8147-a951dc67a12d", "value": "768:nH65ZalVWo4Wqln6BSobxTmwV2haOpT9q3UELzD:HSQL4RnuNT+fSLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700712518, "uuid": "5ba4903d-37ed-4d70-a454-56475a3d7be8", "value": 33056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700712518, "uuid": "2549ea35-e888-4774-8e5b-372a71502f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700712518, "uuid": "2f4f7d1d-50a6-4c13-b798-43a73c0466ad", "value": "2a75a02927a59777cb550633936fbc4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c918754-8a0a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700748652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748652, "uuid": "a7845176-f683-45ec-a8c2-74d5c08963d7", "comment": "Malware payload (AgentTesla)", "value": "b91d03f9f50327c914eb62cac826eb8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748652, "uuid": "5d6e1948-a6bf-4cce-9c16-71ee7780a5d3", "comment": "Malware payload (AgentTesla)", "value": "9803d3d5e0ed1f483c97a3651abf22b3942d7f68507efe4d44d049eb36a9cd07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748652, "uuid": "03728ec7-1f7d-44a5-83ef-965dfecd66a4", "comment": "Malware payload (AgentTesla)", "value": "90b816f3dd8c6bdfa5fed7ed42440486b5cf6e16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748652, "uuid": "db11b003-d8ca-48ef-a711-03a1e50e3511", "comment": "Malware payload (AgentTesla)", "value": "e06c68bdecc54a5c0f6eecdb7bf0e5dbae828a5b206a404c87f77475bde0bb7886a6b8c457b13c0a40915cc81eece785", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748652, "uuid": "526f35e3-ae5c-4d83-8601-66d9c45015b5", "value": "T196253364FF359D2617A8B5BAFC570F0E34F28EC7640493F6AAD15AC3055EB234802999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748652, "uuid": "e416df86-6aab-451e-a42c-2ca93c3b3bc7", "value": "24576:9oIY19JHSVEVTUeYxBPN7eoJFIKWHavpsUviZ:QlRTyxBqKTFvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700748652, "uuid": "4fdc2d1d-d944-4d18-8115-3d39cfc56786", "value": 1033879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700748652, "uuid": "464318ea-6a4e-4c29-a400-f2baa6fee6b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748652, "uuid": "cb1cadd6-5cd3-4b9e-8de4-3ce26ef244d9", "value": "QUOTE--GEI REF 217XXXXX023.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f74135-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724455, "uuid": "38ee2a4a-a238-46a9-ba55-0d8676c0fd49", "comment": "Malware payload", "value": "730273a933470cd70ba07aab36656c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724455, "uuid": "a73c8ea4-5c2d-4ccf-a3cd-ba24d52f96d9", "comment": "Malware payload", "value": "9967dbf940ce71c3aff8f0b62c7ef9324dd30e6ae4bbb2db4b16c0a184e383f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724455, "uuid": "e8507bf3-377c-423d-8cee-050497ea58c7", "comment": "Malware payload", "value": "e31a0c5903886183d9c7094bd35d416368c3b1c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724455, "uuid": "6284b7b5-deaf-4c9a-8d38-de5a8e9e7dec", "comment": "Malware payload", "value": "d78df0d3e2ebcbb251e50ea13aed4f63f9c5802af3d2715f8aa34f3749d4a1f9e4c7593d1c055222a9ba0e82d1daf5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724455, "uuid": "984d8f6b-4dd8-4997-939e-d7b225129c56", "value": "T17275F1473C84DC96D0432AF3556E86A07609798EC465C3BD3B03BB1BB2E634A27157AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724455, "uuid": "f66a1621-97ed-43d2-ba87-15219c636e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724455, "uuid": "94ee10b9-026d-4e56-b672-27dda84b85cf", "value": "24576:ZynW3OXNioVslTOFKvhrZGxOXbhgDJsjQ2O9d8:13OXNioqgg4OXlsJsjTiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724455, "uuid": "3365919c-9419-4002-affa-31771475f86e", "value": 1564160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724455, "uuid": "41ac3164-54fc-4eaa-a6f1-4491a2d6c514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724455, "uuid": "606e22fa-9f7d-4e86-baf3-e1dc674d8309", "value": "QUOTATION#00358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3489264-8a46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700774648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774648, "uuid": "69a9120c-977d-4453-9f97-78b80ca8d721", "comment": "Malware payload", "value": "d601091b00ce2f7b6beb2917b7a6c944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774648, "uuid": "8baacea2-f968-4b3c-8d74-d6471ee3a247", "comment": "Malware payload", "value": "9ba7264bbce0b074fa7d2ca4569bfd548a0ab3f19f730c4dfeeac443d9c7017b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774648, "uuid": "d6e6c38a-0a74-4ae3-88af-bc296b23be13", "comment": "Malware payload", "value": "3365f2efb2d0a0dd8fbe34453b6c4b8cb2f6d74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774648, "uuid": "af5b89c7-24bd-4073-b446-06a179ec2642", "comment": "Malware payload", "value": "2ee306d9c263b7e491c0f1743f489e9bd9726320f0d562d8a7c9e591caa9e083755b93b1926dbe3173a17bdeb31f32ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774648, "uuid": "c0ffdc81-59ba-450f-a13b-7f1f8b1a9430", "value": "T14B45125BB152707CCA6FC934D9E673A178B1F41004345FBD0B6886312F21EA4EB6EDA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774648, "uuid": "14d7facc-8fdc-485d-8a8a-ae6eab51392e", "value": "6a5767913cf60144e52c85d78727993a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774648, "uuid": "4003cf8b-17a4-4d8d-8063-c30e46f0bb7f", "value": "24576:1RyLJEcFuU4QC4eOjCw+V5Ox5Ke8D8JvM4TVZQkBNmsuNGlH54W:SlXcUGOjCwSSU/DAU6VZ5NmsuNGlZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700774648, "uuid": "9428fab2-b78d-4d6b-a1c5-76449e0adfdd", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700774648, "uuid": "b7232d44-65ea-43f9-acaa-3612c00d0b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774648, "uuid": "74ffeac2-8be0-4cb2-afb7-57c9918f0265", "value": "libcef_decrypted.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5c0303-89fc-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700742611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742611, "uuid": "8462a238-883a-4d66-a731-e4eb1365cdb8", "comment": "Malware payload (DCRat)", "value": "d4170a8fb3f3dae62e8168df32590cf6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742611, "uuid": "9afbb8b1-b9aa-4483-b10a-9a510755827b", "comment": "Malware payload (DCRat)", "value": "9c8162115273ea9afdba3d35d7451f45913ba9764ad626a4cbebc8e9eb734396", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742611, "uuid": "a95cfe8d-b55d-4faa-b54e-9879d30e2014", "comment": "Malware payload (DCRat)", "value": "abf2e98b8b8595bd1e1ba8b066341ec4adbe1494", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742611, "uuid": "c0a4988d-871b-44d6-bf69-1b1494785fd8", "comment": "Malware payload (DCRat)", "value": "305366b9d8c1ac3b8ccdefc9d08afbab3f48d02673c5047024ef41c6931b4de1060efb545a106c042b02fd58c45b4fec", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742611, "uuid": "ff476e4b-18ae-476f-b1b7-c4f4201916fe", "value": "T11516C03461830537D03B1B749DDB66AC57FDB991323E6B8B729445DACFA3384A98032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742611, "uuid": "ccb4cf7d-064f-486b-9a32-beec2d05b882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742611, "uuid": "1bb776da-5fc8-4717-a223-7bdb437f9e59", "value": "49152:WwBcyzq59TiWrdWf8vhMThIO5pv83lpPdeRIHMbNxzlLVQIQfTl+qKC8baux:WSG9eWr0EIIWv8AqsbNz5ZQrhK1bau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700742611, "uuid": "84aefdd6-f720-4601-9985-d26fd4bbfa37", "value": 4325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700742611, "uuid": "2278aa7e-ad00-42d4-8a0b-1274040197d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742611, "uuid": "27f90f51-b2fe-492f-ab01-5dd5e3512479", "value": "D4170A8FB3F3DAE62E8168DF32590CF6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3499a9c3-8a11-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700751699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751699, "uuid": "c48ca647-d553-4da0-9fc9-6f8b77f894a7", "comment": "Malware payload", "value": "29c995fcb050988f3be6330af705d12a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751699, "uuid": "79807b70-cca4-42bb-b226-09209efe3466", "comment": "Malware payload", "value": "9e0b1ae8c7fd5f2d01939a7cb898e05c5db4073c5d19e9dc25b6678b4c903c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751699, "uuid": "f4bf61e2-a055-4b9b-aaff-931f1e3e33d0", "comment": "Malware payload", "value": "f9dba235b45f81e62206363a3cc52d996a0dc53d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751699, "uuid": "ab546de2-d63b-4570-a998-756dd72a844d", "comment": "Malware payload", "value": "2558629b7f2bca5a77f81d5048bfca4cbc0f15461ca76a656925bdf21009fa44e150c6ed9a63b9d85015f005ccc1fbcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751699, "uuid": "629a6084-b032-4767-b82a-f36e7deb90a0", "value": "T173161712AA968225D47E0475CDAA52ED53307C285F104FDB63C87A3939F32E17E327AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751699, "uuid": "0e815ec2-8332-4522-9ac8-229bef1fa161", "value": "6805b9d9f17bc82a9e79068d20b7f163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751699, "uuid": "99d180fb-7f81-4c26-8156-f4e48da5423d", "value": "49152:57tar2G5DcOZgeihWiPBZGugXX37tv/UaSeGDEDHDsk4aXIMg2hyg/mWc2LbG/k8:na6yDcetih/PBZGrRHxIsorr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700751699, "uuid": "d617dc64-c83d-4af6-a32b-1f045baf6c24", "value": 4201984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700751699, "uuid": "afaca0bf-f263-42bd-8606-8258ff49a19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751699, "uuid": "3bd65df3-dbff-4d94-a6f3-9cdf34c66ca2", "value": "PayPal_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b6ccad-8a34-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700766817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766817, "uuid": "606a4b2e-5a84-4e2a-9097-e738024bee72", "comment": "Malware payload", "value": "6e79997d9111751211864b4e468e390f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766817, "uuid": "ad44ce26-0b95-46b5-8f02-fcf3737d4849", "comment": "Malware payload", "value": "a04bc4d06ea0530391a2c7d1b381a9b6d23af6965e345ae99290755c80c1d751", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766817, "uuid": "d6c27d19-db4a-45a3-824a-e6ca1c3a87dc", "comment": "Malware payload", "value": "f1cc1d2cb7ca96c79f96a514c9f2549abadb262d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766817, "uuid": "c3aa5eab-f833-44d2-94f7-1049ccb49429", "comment": "Malware payload", "value": "6b8e21208f27b7212b4f98e991dca8092490acd7f158e740a4c79db0c3b6153a2359fa302c1f326d6dc61c590729706c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766817, "uuid": "37c20dc9-17c8-483b-9a27-6323879f498c", "value": "T1FFD5338BA582E9F6E03B99700D246EBE49EBB9D6747A941C3CEEA44D1F73116100F374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766817, "uuid": "143cda5c-e58e-4981-8ca9-edde80df64c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766817, "uuid": "ddfbca08-d41c-4587-a438-df46c3e6f998", "value": "49152:O2YwvLbBL8IQbDbq6hhFiucmUHq2uK3njQJJmgBkVrAhUQCe4f4/fzdedvQRY0E:XfvXBLk42UHuK3jWXWKOe4fWdmQlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766817, "uuid": "b7664572-80da-4c64-aad3-401b29aebfad", "value": 2881599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766817, "uuid": "09adce0d-b72e-42fc-822d-0ec7c700f12a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766817, "uuid": "b592988a-08a6-4fce-b78a-2596635386e4", "value": "6e79997d9111751211864b4e468e390f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139a5e37-8a3d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700770542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770542, "uuid": "274ab0af-b388-4f89-9ff5-7e239e896526", "comment": "Malware payload", "value": "9d6f9f16e32e244688980625f58835e0", "object_relation": "md5", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770542, "uuid": "60617dab-ad7f-45e9-b499-486574eff660", "comment": "Malware payload", "value": "a1211549b4e1a7befd953d03b4d929b3dc9f25ec6c1bc9c05ae92a0ec08fb77c", "object_relation": "sha256", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770542, "uuid": "05cebf23-a5ab-438b-9243-8157348eecff", "comment": "Malware payload", "value": "2d4daf971fb381973710de68abec4a03b20a29a0", "object_relation": "sha1", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770542, "uuid": "9ec350d9-f1e4-443f-86ea-c7d0d02956c7", "comment": "Malware payload", "value": "ae52d44dc93958e70ba067eafb378167f1a8dfdb5a1b5668a77f7aee4a54f2f79fe01515f1db873a1c53997c0d166b5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770542, "uuid": "fb69dcbe-abba-4866-94d9-488947a3747d", "value": "T1D7921B142BAE5175F1BF5E725DD0728986F6E3030912CA6E2CC125CBCF63281DA93AB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770542, "uuid": "4fe11e2d-3e98-4b47-b554-86764f3390e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770542, "uuid": "23075bfc-d67d-428a-ab01-de0e7ede26f9", "value": "384:uRFFxOhCAHAB/ONZ2vbm+dn7tEoLOTeaUPVw3Ys/tzOrfwA:oyhTxjobIXTn5zOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700770542, "uuid": "248787eb-e716-47f7-a2d4-fc8b9f45540e", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700770542, "uuid": "bcf368c7-f2d5-426d-90cc-51e358a3d793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770542, "uuid": "00fe14e9-5f7c-4cde-ac8e-26308abfe40a", "value": "Medusa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fb14ac-89e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700730982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700730982, "uuid": "35bb45c4-6c8f-44f8-aab7-5e29326c2be8", "comment": "Malware payload", "value": "ac3cb4ce313b71dd87f846c8a30ec416", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700730982, "uuid": "5a347d04-40e2-4e2e-9f51-c53e37f18db8", "comment": "Malware payload", "value": "a2488f540b1973043c88a93ce717cd25f23ca3c8f3e2e27d18eca7839b96cf0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700730982, "uuid": "d9ae2b55-997c-48d6-a654-ea06d0dbb206", "comment": "Malware payload", "value": "3b34441b5baa236fb51c8ea862d038333866d3b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700730982, "uuid": "60a708e4-cb12-4728-9b44-da70c29c81fc", "comment": "Malware payload", "value": "cbaa5202c3b550e3c046f39a86bf8957c3ce3381a329a72a97fc6df0f9547b87a61cec94ff0d3b66f847cb0211e1f4e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700730982, "uuid": "b8154f7f-8b4b-42d1-a8d3-c79f2a2d9be4", "value": "T1015423513CDBB9B2FFDA8C737517726AEF95FE81D65053F80424489C081E12E9AD22E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700730982, "uuid": "d608cad0-32aa-482b-84ff-8f6e10251b7f", "value": "6144:NdMU0kIzTJLXw2xw50JesjMWiwj3mVzLK5niijEcCNi+sK:jLKzThXI50JesVikwitI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700730982, "uuid": "765954fe-de67-4797-b50b-230cdb6ea3a3", "value": 281836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700730982, "uuid": "a86c568e-8528-4572-a8f4-e7e1d328dae2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700730982, "uuid": "869d622d-6213-41f2-a26d-ed74200826d0", "value": "\u6253\u4e0d\u5f00\u70b9\u51fb\u6b64\u5904\u5e2e\u52a9.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6736ace-89bd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700715839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715839, "uuid": "6443471d-4b6f-48dc-8b28-bbd04ee78049", "comment": "Malware payload", "value": "bc676bd17bb0e764ad3e8ff686e9a6f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715839, "uuid": "40436082-52f8-40f3-a347-47879464027f", "comment": "Malware payload", "value": "a4f7d42f8d6bc0349ecbe2183bf1879c0b05c41a0131d8a0302d21f9e1baff6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715839, "uuid": "f6e51566-25ae-4cc9-a80f-7c1cdbb2f0ea", "comment": "Malware payload", "value": "1713e2e6ac14a4fc89c289cd320d32ef9ddda9d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700715839, "uuid": "62e727d0-23f4-41a2-98c4-be44f47cb251", "comment": "Malware payload", "value": "20349fb548e481d6427b9893e1a2c8b1f24400dedb0e87910c88c6d22497b11f89bff8cd1117ed56361cc5b0c72145ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715839, "uuid": "eaeb699e-1f13-41fa-a74d-0066763e237c", "value": "T14FD4BF545CEDC53BC822A23165A4FAACFE3F7445F3E6018672A4C32BD2557EE041BD8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715839, "uuid": "b40a4ae2-5876-4dce-a1ae-9fa4ad798be7", "value": "5bbbf07c75d73e93c42e89b1af89819f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715839, "uuid": "74236b98-c834-4081-84eb-ddf8ece70b78", "value": "12288:GJJ9KLBCnUC5Zg2VrcaWl/LeoiOcuDsTsbiXl2aZbsQRH7clQ:QJRnz3g2tcv5eoiOcKysbiXzZAQRH7wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700715839, "uuid": "d59255f2-306a-4c12-983c-b5186b052d33", "value": 598076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700715839, "uuid": "e6838b9d-6786-4c2c-9ed5-afcae611680f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700715839, "uuid": "a590d20b-1f20-49fd-9d4c-715d05554591", "value": "bc676bd17bb0e764ad3e8ff686e9a6f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3874c42f-8a11-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700751706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751706, "uuid": "70bce2eb-91ce-41fd-ba50-eddbb43134cc", "comment": "Malware payload", "value": "d74105614f69b0f4a13be4ec4bb4cb2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751706, "uuid": "7e602799-c6cb-4a93-b206-542876efbe20", "comment": "Malware payload", "value": "a530bd312d35f0ca91b2b1087ac55caacccae602031859e80f638dba479aae7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751706, "uuid": "bde90db8-10bc-4b6d-89f0-9f2af2be4625", "comment": "Malware payload", "value": "9e1032a4a15629803bb865bbfa8471bceb51cb85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751706, "uuid": "8eca4f92-a539-4804-aa46-110715332213", "comment": "Malware payload", "value": "e348755fc06e745f4949338476561762140818d6b9ef7ed15cb6022340e046514bbe66d1145018b6e98e30ec19331181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751706, "uuid": "fd985711-af82-48cc-8335-350bad2bfa9f", "value": "T135161712AA968225D47E0475CDAA52ED53307C285F104FDB63C87A3939F32E17E327AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751706, "uuid": "ac1ced35-74a2-4a60-be16-a9e3689634b6", "value": "6805b9d9f17bc82a9e79068d20b7f163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751706, "uuid": "3bf57dfd-5492-44bf-8fbf-feae4e5f47f9", "value": "49152:D7tar2G5DcOZgeihWiPBZGugXX37tv/UaSeGDEDHksk4aXIMg2hyg/mWc2LbG/k8:Va6yDcetih/PBZGrCHxIsorr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700751706, "uuid": "015e153e-4081-4836-a867-1ca2ec1b4e3b", "value": 4201984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700751706, "uuid": "b22014c8-7cba-4d01-a4d2-31e267f381d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751706, "uuid": "0f31a4bd-4128-44c2-b1ac-05366231853f", "value": "SrvPayPal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbf6dd7-899b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700701031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701031, "uuid": "fb5ac61f-b64a-4c09-902a-44ebdd1d754a", "comment": "Malware payload", "value": "63de8cb4942ecb49b895df38a2a67311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701031, "uuid": "7f4d1338-4b82-47d8-918b-15ed1159405c", "comment": "Malware payload", "value": "a6a10e72b3dd96479e5b3a3795962d4e04408f974493cab74d7e1251b3b6e549", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701031, "uuid": "29893d3a-ca06-4049-82d2-0aecae768d8b", "comment": "Malware payload", "value": "4c33be17076b301ff8d24c49bd4f7b80f283af29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701031, "uuid": "5432e3f1-693a-4c9f-ba92-21b715a01c2b", "comment": "Malware payload", "value": "cf359835e7b8f8338cba77f77aec932968939a3c0751156aa836279eeea6153c9bc78db8060d95396753cd9b0dde616d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701031, "uuid": "8d51d7b3-d8c8-4795-b53b-9d9c61d90347", "value": "T12E332986B9819623C5E016B7FB5E428C3B2703F8E1DEB203DD159B30379B9690EBB451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701031, "uuid": "6812268f-eed5-4f79-a7fc-4c9f575d398e", "value": "1536:ZxBF9vjoJlyaUn5KdY5H9qoP/gI3FeNE21KaF9CIcv+g:ZDF9vjoJlyaUn5KdY5H9qM/gIeuans+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700701031, "uuid": "360726e4-eedf-4761-aa5e-e55237ffc291", "value": 54608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700701031, "uuid": "ac02190e-ba58-4622-83d6-0b8719083195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701031, "uuid": "5f6a3d14-67cb-4aa2-9c59-8a872752b11c", "value": "63de8cb4942ecb49b895df38a2a67311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8107a4bb-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700724340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724340, "uuid": "d3e06a52-0372-4539-b17e-6e34604a18f7", "comment": "Malware payload", "value": "f195ed6e0ca7d5ca75c236f04abbf41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724340, "uuid": "a37df5cf-64d1-4a3b-b6ef-6de4ab1adafd", "comment": "Malware payload", "value": "a7a33a377911477afe031d59a486e5ed432da1bd9fabfb9450a5951c7b2edd07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724340, "uuid": "9906f4e5-a22c-467f-8f9b-a87c2e071997", "comment": "Malware payload", "value": "14dad0f7a81514772eff79460f934a8211420fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724340, "uuid": "173b1b9b-10fe-42d2-8030-4de77986d90c", "comment": "Malware payload", "value": "7ceb2054f41155f6ee157fff50fe3a14976fcbfa3b96f2807919d73fa7b054d984687fb8139a85bc67bee70cae831885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724340, "uuid": "70f62146-6f5c-44d8-b9c2-a19d4bf9b60a", "value": "T1E4735B4DE7CDAF62C2FD0BBF84E67A4107B98AB39307E70F68C5262509163DB5801A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724340, "uuid": "2dad2899-5bca-4479-bf0b-58fd042eb53c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724340, "uuid": "d4bfa984-ae94-4c94-9df4-2b70a151937f", "value": "1536:RW/dt2cDK1ACH9fS31FcTwPFP6Sn7AIc4cECrf04hroX/E9p:0d7e1vx7B/pfxpovwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724340, "uuid": "59a68a68-bd3e-44ce-9420-6cb5ef6ea213", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724340, "uuid": "88cd8915-43b2-4228-a8a6-302f67687f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724340, "uuid": "bab5bf9d-7e95-43e2-93fc-60cf965dd8f6", "value": "Vztnz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af247e3-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728866, "uuid": "7261f95b-f897-434d-a14f-aa197a538e01", "comment": "Malware payload", "value": "c54892cff82da7d897b4f5c86d02114f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728866, "uuid": "881cfac6-3a89-46a1-9714-a1b556a88058", "comment": "Malware payload", "value": "a819d89fa4fe54a9d678c852c41620ab99b95ec11e3695cb2756efa4fec755e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728866, "uuid": "5ee142d4-7868-421f-ac38-d7de6c5bf96b", "comment": "Malware payload", "value": "9b5d1665e7973cbedf3d265a94bfdd59a16146e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728866, "uuid": "546f2fea-3156-4e1e-ab74-ef54e634c271", "comment": "Malware payload", "value": "9797e8e93b1bf49029fb1e7560087c4171d6eef23b8da8f3bc4ca1d5618f4dfdeb8425e8d3ab4a85586b7dfb2f5a5472", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728866, "uuid": "16770f15-d83c-47fe-b196-116b765296ef", "value": "T1CA459E04B2A68B84F17CC7F440525092A7B47C9FF26DCB8B8DC739DA3971F911919A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728866, "uuid": "e52bb784-8671-4d45-acd0-4a48c0862c73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728866, "uuid": "20030caa-3ff7-4417-a2d9-f152bd0e0736", "value": "24576:U74zMThgVtyPPcaJ5ytzgxqZsGtg1q83+iEX:U744T2nysaJ7xIBtnGrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728866, "uuid": "19fb9a2b-affa-424a-86b9-671ba5e43946", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728866, "uuid": "3e153755-2ef2-470f-b648-e571bfc6c8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728866, "uuid": "46d0d2f5-f0ed-4fc2-9f85-0fe635eb1abc", "value": "RFQ_SP_03084_1_23_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e537794-8a1c-11ee-8907-42010a9c0042", "comment": "Malware payload (AZORult)", "timestamp": 1700756413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756413, "uuid": "75d506ca-cde4-493b-9b35-de6b46549054", "comment": "Malware payload (AZORult)", "value": "f2d6550bc426b58c63d87172cee52424", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756413, "uuid": "ec86e402-3607-41ce-b0d5-1d7e95825423", "comment": "Malware payload (AZORult)", "value": "aa17ccd48e6acc9b421bf8ad2441e7cd5cca6c856746c92441fac6cb95709aaf", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756413, "uuid": "b31af678-e064-4515-96e9-3b1ac8af11ce", "comment": "Malware payload (AZORult)", "value": "88f7c69eb8ba6e0d02fa94949bdf5641274ffa6d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756413, "uuid": "abb27538-ee4f-4c12-ad42-b10de6ae402a", "comment": "Malware payload (AZORult)", "value": "2743124446feef07d891016efda77bc18b3a6948d53dad617aca0c521088197acb839c2530ffb9d283f4147f1d3243bc", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756413, "uuid": "8457dfa4-def5-4a3c-b65c-359bc3535458", "value": "T111C4230A3B78DA0BC9445BB2E43846F60D465D24C8398ACF67E47EDA35721D10F1AF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756413, "uuid": "46eacb8a-ee66-433f-85a4-660a78d2ef28", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756413, "uuid": "a6f1db62-5b0b-4a57-a079-26dd402f3d66", "value": "12288:PDzHGJ9vnCOoCeogCE8LO6WjHkScxy7iVvyc:r6fvFoChE8LOVHj7Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700756413, "uuid": "aae38319-4e5e-45e2-b088-d1f928ae7602", "value": 550376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700756413, "uuid": "e7d1ac8f-cf45-4cc0-b6a2-1467dea7e8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756413, "uuid": "24291e97-9fc5-4728-b618-c55f273a316f", "value": "AWB-BL DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1091d5e7-89ee-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700736606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736606, "uuid": "3c4842a6-a4c6-4409-9db2-0f64566319d0", "comment": "Malware payload (Mirai)", "value": "56d04992bd4530bb9edce60df6d3bf00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736606, "uuid": "e8044e51-8df5-4936-8c1f-74d27ef0c838", "comment": "Malware payload (Mirai)", "value": "aa1cd954f9b0d8613c0867569711610192325cd6232562e50986fb4214ae1134", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736606, "uuid": "80145192-23b5-4fae-9edf-3d5646008bea", "comment": "Malware payload (Mirai)", "value": "90f5092e2edfa1175c2e9612a4cb384b7bc4132d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736606, "uuid": "c68902b6-14c1-42c3-a7a3-3d62297c36d9", "comment": "Malware payload (Mirai)", "value": "f3fa0a337465b90ee6c601f277818d84347d9b6b0c24a7af7df9969d2caa2a5b60839b5f6b1e90923c960075621b6ecb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736606, "uuid": "232b4e25-6f45-4110-a3f5-cb6e64ebffed", "value": "T13EE35C46EA808E03C0D61776BAAF424A33239754D3DB73069D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736606, "uuid": "979c9411-4ba0-410a-b528-27d5b257eba8", "value": "3072:axVkUpo32KLa1Ug2uIOflkD//jts/EE38xGM/911of:kV/pI/La1Ug2u5kDRAEE38sM/91Cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700736606, "uuid": "d06bcf68-2db7-447d-8191-1c3ef42362c6", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700736606, "uuid": "77bd5042-f81c-4755-bd49-80b66afa4587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736606, "uuid": "30e4ce03-142f-45b2-a4ce-eabfb3dfe2cb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecbf23c-8a22-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700759259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759259, "uuid": "a0fb9896-b3f8-4d3f-839c-883c5625238b", "comment": "Malware payload", "value": "926440fe87b5eef84902e96bf9e45123", "object_relation": "md5", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759259, "uuid": "33f6c907-e272-46d5-9d5f-eeb5b4f35642", "comment": "Malware payload", "value": "aa3b7735ed119b3a6e6692c7150a275228446650b37422818ccff9bf055e64fc", "object_relation": "sha256", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759259, "uuid": "57de742b-8d12-4d00-ae60-76333df7bebc", "comment": "Malware payload", "value": "6b8508054365f1be9429a1dfa47a5d516afb819b", "object_relation": "sha1", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759259, "uuid": "aedfe826-26c1-4a07-a686-09a79a1680b5", "comment": "Malware payload", "value": "c92b5d18f34967de020f75dd839a61d22b7b5c85d64ec7dbb9699b74ff90d6c3ee4475dd41d6d2a7e8f8796887449a8f", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7799", "colour": "#5361D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700759259, "uuid": "5b9c0149-2954-4ebe-8221-d246008a5629", "value": "T1889423649E8AD4B63394DC16F06440D640FEF3B4959FAD9073C227079A2CB2B75A6AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700759259, "uuid": "2dc0d6b7-5653-472b-9a35-1745a60f1015", "value": "12288:AT3kghYRQWxcPuGylPkn+7jwHiTTgbx4BqEC0:24cPRWkn+IHiI4BqEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700759259, "uuid": "64b08a21-6ad4-4a0f-9db6-0a97edab6caa", "value": 417279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700759259, "uuid": "82b4b1ab-730b-4016-a3b6-4e5fd5111094", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700759259, "uuid": "f68a6822-9224-4b3c-b97a-54ca6c404aac", "value": "Google AI Digital Marketing Installation V1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978133fc-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740269, "uuid": "8b5e2802-aefa-4acd-b5d7-10d8d5be099b", "comment": "Malware payload", "value": "546ad3a6631b95a52348f2da9069add3", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740269, "uuid": "46e2447d-9708-4eac-8447-7579ae0e73f2", "comment": "Malware payload", "value": "aa641dbc9ba61f0b29a8bbb5deda6e48d53a9af403f6fcff3d65ddc3b8d84156", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740269, "uuid": "98f061b9-06d6-4f40-b36d-7b1e964aede4", "comment": "Malware payload", "value": "d0ec967ec59dd066ea73676caadc92a4b6e02f27", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740269, "uuid": "2e49e7d8-d06c-4720-a85b-8de04d712eb6", "comment": "Malware payload", "value": "35b6cc834d422bbe94f51605c5eadd70c55b4042416b55ec85b39555889554fb015e60cabb40f58aa658696099b74ac5", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740269, "uuid": "bff63742-a330-457d-b04b-ff2f795829de", "value": "T12EE07D0377488536D42B29BE73F3CF12D732B648190C301FE95C102015879C04B213B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740269, "uuid": "57a97230-7dcc-4c87-83e9-d964e011cf6f", "value": "6:5jVllnMKvrnPlx5s895rzXBEYUZgIloOtDnAp4ZNXJ+t9llLMKMUl7t+lM1:5jVllLvFs83zXaYUyYoOXZNXwllHMe7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740269, "uuid": "26976cce-6f52-40c0-8bf9-34c6bec03ae1", "value": 348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740269, "uuid": "3597c8e6-9bec-492c-b772-59cca303b73d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740269, "uuid": "f4fedf78-1a01-4e21-b0f5-0e079864a8d4", "value": "Order_Information.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deea7357-8993-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700697868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697868, "uuid": "bf9834f6-5d96-4c65-92b7-81cdcebd8100", "comment": "Malware payload", "value": "e4dfbc1e5ff075389c8913bf078867d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697868, "uuid": "f634d95a-0f4e-49f5-a4b7-f4f86aa67d5e", "comment": "Malware payload", "value": "ac76a85c18af6c78382777f3e13b9c39da5e3ff02f11dc3c8e1aea4b359d8346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697868, "uuid": "dd5fd040-03e2-4396-b0a7-0e0e8d6e78c2", "comment": "Malware payload", "value": "bb89d1c5e8470b42345ae3cf7f258d7041ecd8eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700697868, "uuid": "a3468fad-9e41-42f2-a3b7-ae0164719edf", "comment": "Malware payload", "value": "be6dd8ed70bf3f216bc14d2b0b56ee76b1079210d7ff90019c73bffd7af27ce742810241f799b3beeb618937431a2b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697868, "uuid": "10a5b4a8-7790-4e14-91bf-cfc54c2ea3c7", "value": "T15FC48F32B2E18437D163263C9D5B92BC9C3AFE116D28B8462BE53D4C5F39781742B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697868, "uuid": "77c4f16a-eaf0-4645-a395-7ef2cd693cdd", "value": "c44dd2a7f45b7a98f929733287f8eaef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697868, "uuid": "457277dc-b21a-4a23-9635-6a5f1afe9c4d", "value": "12288:B2/vKWQ4kK5ihh7a0VcgaUPhigvWQ2uHXibtga:wHO4k+iHLOUJ/vWQ/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700697868, "uuid": "a0ff53d4-5fc2-4f44-84fb-dbb2820ff09d", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700697868, "uuid": "eb5b9c9b-ef31-4932-b613-4633cfe0963d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700697868, "uuid": "fadd0f3a-35c9-4bf2-a663-28cd4af7858e", "value": "\ud06c\ub9ac\uc2a4\ub9c8\uc2a4_\ud2b8\ub9ac(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41350145-8a17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700754297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754297, "uuid": "f835565e-64ab-4e0f-9945-1dcb280ba4e5", "comment": "Malware payload", "value": "d80cb276836c34bc2d44922fe4cbf6e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754297, "uuid": "24ec7242-54d7-4b40-80ac-9781e5d199e4", "comment": "Malware payload", "value": "ad7cecbbae93e5f9899d2600ce0a0516b185c7b31f778916be4c534beba1cc8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754297, "uuid": "0b9a1815-4877-461f-b6d7-9841b311096c", "comment": "Malware payload", "value": "603079fce5708d77198a9440b7fa02874432677a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700754297, "uuid": "a5ec62bc-8dcf-40c2-aa2a-287a3482837a", "comment": "Malware payload", "value": "27a8169f8223c4bd7519b9ca509a0910e930bbe6fb30bb16cea4798ef788ca37fdcce1dfaaf78957e181d2cc9e3b6237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754297, "uuid": "049baae0-2853-42d9-81db-a8c21373c1e9", "value": "T11A05120AB2991B99ECBF53FA1530510453FB7DA3AA72E2095D9330DF4672B514AA0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754297, "uuid": "f8df4de8-1049-403b-9cb0-b2eb92d1b08e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754297, "uuid": "fcb0716e-47b6-4ace-9cff-62fa9c7e2eac", "value": "24576:4FtD/61g2k7v6RGXdJr+E4VfiZUSu2/UQR:A6rk7DJH4Vfir1sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700754297, "uuid": "07599dc7-f73b-43a1-be24-9f45c5fd7dd3", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700754297, "uuid": "94747577-e414-4677-bf12-47d0e2d1b812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700754297, "uuid": "1e662906-1ddf-48b3-bee4-076f25b87797", "value": "z57f30i4QHbDOhsnME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64eab9ed-8a0d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700750062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750062, "uuid": "8be7ace1-a447-4fc9-9f29-ec74b983200d", "comment": "Malware payload (Formbook)", "value": "9c3adaa8348718ee8e229b5064bb34de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750062, "uuid": "463b4bd6-6a66-41a5-8c51-d1f6a60f7a76", "comment": "Malware payload (Formbook)", "value": "af40728c6916a1018b6ac0a6639eb8d357f1253d5ca073b8aebc18dffdb9fac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750062, "uuid": "e8128fcc-378d-4334-bdee-57e7f0367022", "comment": "Malware payload (Formbook)", "value": "2ec9b8eca34d3577f65c1f1b2bfde89e404dbe30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750062, "uuid": "f16978a2-2bca-40a9-9dd7-12f62ac2fd3b", "comment": "Malware payload (Formbook)", "value": "feff290bb1e3bf1ace9864918abd924338c7633886a9b02dbca4c2f63a113f352524886104b9a3aba6c9df9e3f5525c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750062, "uuid": "eff547cc-be1d-45b7-a47d-f4055034bee0", "value": "T1C6F4010477BD8F66CABB5BF65020420147F2A96F3576E3898CC260EB1671F112E92F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750062, "uuid": "03c1619c-3a2c-4c94-a9ec-725323a5e322", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750062, "uuid": "5dd25f1d-f90a-455a-befb-dc3f61d33601", "value": "12288:T1CFIELXGkJl8G+3ucp0WTXfJv47Eu5zrj3DIQyehwDoSZPGs5DM5Crhg+gkRVHP:T1CFIQ2k7HbWTvJgf5/thMoPMDoCrRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750062, "uuid": "8016152e-8dd2-450b-bf52-1c77a302f537", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750062, "uuid": "ff2c2df9-6f2a-4150-83a7-c89b15e5b64f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750062, "uuid": "b85a2205-a2cb-4951-9173-ed53eb57d856", "value": "2023-11-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3148ee4-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740315, "uuid": "12f0593f-6554-454c-a7d3-ff7fa77393c6", "comment": "Malware payload", "value": "90962de04e13d0f8e7b96a094ec6b77a", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740315, "uuid": "969230aa-7413-418e-9fea-77dbfbf99a62", "comment": "Malware payload", "value": "b13b262720b806604e486ff0022ac3ebdd2f67484e5c9c53326c8ffde3d7f9a7", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740315, "uuid": "26f1563e-8658-4a58-bebb-beba2048ded4", "comment": "Malware payload", "value": "4907eebd8f643e128a3c597ebe7dd0d302d9ff04", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740315, "uuid": "845ba1aa-4afb-4115-8b16-d1df5529e9d9", "comment": "Malware payload", "value": "0076b928acac5b6261b83a5174304e6defc556a0f0d32942bc7f8e82e46072f07a45a0144733eda6678d26c8028fa245", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740315, "uuid": "ee717159-ba01-4635-a690-7273c3c278df", "value": "T138D023084E48C154D04104174058BC889D0DB04454E5C88C6244DA874C550D5DD45AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740315, "uuid": "885aa840-5b34-4f27-ae44-0fa91debc6fb", "value": "6:HRYFJb5n49sZOC7x0NyQvyc1yc54vVG/4xHn:HRYFJuCN0vvhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740315, "uuid": "5c10017a-481b-42d9-8f91-e64db9c7dd4b", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740315, "uuid": "653d012d-c602-4235-87da-bae39d5d8d0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740315, "uuid": "ab6fa5c2-17ee-4404-87af-0c1561c4b0f6", "value": "Invoice url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11e5d48-8a00-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1700744607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744607, "uuid": "bf21bcab-b799-4765-a518-3110fb9627b7", "comment": "Malware payload (NanoCore)", "value": "f9cf07f5d64fdc8b5f4d7de79159ef7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744607, "uuid": "c1aa9990-0355-45e0-8638-15490b5fcafb", "comment": "Malware payload (NanoCore)", "value": "b32404c30f409946db010ddd023b2efecb55b7f93c469d1af66bde2e346325e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744607, "uuid": "34f2e300-663e-4ac6-b892-d1dc9f2566b3", "comment": "Malware payload (NanoCore)", "value": "79fc5ee46c38b11ec8f3087cf31949878a9f535c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700744607, "uuid": "dd01a58b-4d3e-4199-939a-ef3156a45351", "comment": "Malware payload (NanoCore)", "value": "c63229c97b4aa35cad5df05efc6992a0a2b80b513c2321fa7019c066f6bd2490d2cf60d4f3be0135ba07e1483d57a1ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700744607, "uuid": "89cdac52-452c-45f8-b94e-54cffcd71db9", "value": "T1AED3786DD34B01A98F624376AB271E4942FCBA7EF38152B1306C837533EAC3955252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700744607, "uuid": "181d88b1-3eeb-4b71-a656-bc2d12e52705", "value": "768:mwAbZSibMX9gRWjwhbBAK79l65+qz8UHLzPENhloTf:mwAlRVBAw9lRqz8OPENhloTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700744607, "uuid": "c60bf486-e630-4c9b-9255-d2a312c8301d", "value": 132756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700744607, "uuid": "f6b93409-9bd5-479f-9461-0c6722e69345", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700744607, "uuid": "4cfc04ff-54ab-49c2-a7ed-32c41130c521", "value": "\u03a6\u039f\u03a1\u039c\u0391 \u0391\u0399\u03a4\u0397\u03a3\u0397\u03a3 \u039c\u0395\u03a4\u0391\u0392\u0399\u0392\u0391\u03a3\u0397\u03a3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65f6a60-89ef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700737341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700737341, "uuid": "e15d2d01-862e-4ac4-94c9-da1f0e37f8c7", "comment": "Malware payload", "value": "4688a1ef978eca35cc44870357dc2160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700737341, "uuid": "8fc1ca38-7832-4dcc-a8ec-bf8f274f4dbf", "comment": "Malware payload", "value": "b3aecef8a41079cd752346286c9121a6d103126d1e634c625b8a4a6fdff15090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700737341, "uuid": "82a6ebf3-29c9-49a0-b86f-eb35832710e8", "comment": "Malware payload", "value": "15d0bb281202b9cdd9982b6e7bf5d5b6dacc3503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700737341, "uuid": "2b13d2e4-0f49-43e9-948e-749b16585a5e", "comment": "Malware payload", "value": "31a9f99a0f855e15489d07a69461b5cd5bb6b3493c0cdfa1828070c1c62dc2eeda354ce0e5a587a5b987f1145489b39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700737341, "uuid": "fd7f4cfa-bec3-4a85-ac06-d04db1ad2bbd", "value": "T16F546C1353F16C61E6274673AE2EC6F4A71EB9708F547B9B33596E2F09701A2C262313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700737341, "uuid": "129c199b-c3d1-4a45-a562-da8a03724c27", "value": "45a628a3f2a65058697af6d92bbbc920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700737341, "uuid": "3b5bbc26-0a19-4254-b6f2-ad4bea4b8c68", "value": "3072:urgMIvmJgFB0OxpLpsjUOZ5FndrFyFt/4cH6RjnYyZ0Ddx5Cvt1ZqR:KEOgzxBqDr3FyFR4jzvZSy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700737341, "uuid": "fc2095bb-e94b-4889-855a-47115b3f7a86", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700737341, "uuid": "3da95bae-3562-4648-9529-1841fefc742d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700737341, "uuid": "8cd1f0ae-11e0-416b-82d3-8de6f177ebf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b131a100-8a33-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700766511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766511, "uuid": "642dfa61-c2a2-4925-a708-e990290bf316", "comment": "Malware payload (Mirai)", "value": "a5786d1ca40715070e012ba13857709b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766511, "uuid": "3968ebd3-ac58-4bc8-a505-79bbe053e474", "comment": "Malware payload (Mirai)", "value": "b450a06dfc7aa712aa19effc6eccebefa3b6e8dfcd631ff29cbd2fd15e3990b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766511, "uuid": "22eb6815-e088-4a08-8fcf-df2659631631", "comment": "Malware payload (Mirai)", "value": "8f3230b18f0056e67078262bcd2d0de9f6c949c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766511, "uuid": "176e507e-cf43-4772-a8b2-3e965d032731", "comment": "Malware payload (Mirai)", "value": "60b8de294ac00410a50164f477e260b24868eb53d5baebbb3980306f0b0cbf41dcdae29ff5353a85dbbc6e83341c0eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766511, "uuid": "c9fe3365-abcc-4e67-880f-1be012f91401", "value": "T1E4A2D029E345AEF4DFEF9D905381C2C276F947C6268AC8E240EEAF012506042BB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766511, "uuid": "c910416c-76c9-4903-befe-c4ad8b7f7d00", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5BM4uVcqgw05VxJv:9RxsSVsMD6xiJJE5zRWNM4uVcqgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766511, "uuid": "8ac1e19e-f356-4fce-8ee5-44398c4f6f3a", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766511, "uuid": "d1fa90da-24b4-472c-9341-eda19aaf9024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766511, "uuid": "9a512b1b-3014-4312-b421-69595e0016a3", "value": "a5786d1ca40715070e012ba13857709b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce1c404-8a47-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700775228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700775228, "uuid": "7b097dbc-be23-4373-94c5-c8013b1d7837", "comment": "Malware payload (Mirai)", "value": "aea736ebd884f0ac8630b27e2f7cd73d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700775228, "uuid": "6a66cb18-134d-470d-b7af-42d78a774c90", "comment": "Malware payload (Mirai)", "value": "b55e2ca081cad6667f8b8934c338b7c00422e1b7f6188385f501514e2dcf57f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700775228, "uuid": "fe241fc4-f1b4-4768-a944-219db19b19af", "comment": "Malware payload (Mirai)", "value": "7ce7be4780d8334a386bbb4adee4ecd1fa306c23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700775228, "uuid": "e23812e8-4691-4501-b36e-ac801db991e0", "comment": "Malware payload (Mirai)", "value": "63471f63ac16bece7cb22d620b0c31e5bd937c48d61948228604457c547ae34b824d1bdcb6d0c5c0c2fe6eb7035e7ed0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700775228, "uuid": "abec8b31-e8ac-449c-91be-133a19929293", "value": "T1CD431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700775228, "uuid": "11cdded7-1c7b-4cc0-8843-e08906a100c1", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwO:RqtmZPuutfbltZFBSJsBcfDSTFI+BEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700775228, "uuid": "eefa52fb-b45e-4f0b-b5cd-79cf4fa3b337", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700775228, "uuid": "2c9a8e30-205e-4514-8ac5-a35bfa6de6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700775228, "uuid": "0a95e0b6-5453-489b-949a-49add1611e3a", "value": "aea736ebd884f0ac8630b27e2f7cd73d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba50022-89a6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700705674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705674, "uuid": "0952fe6b-9d10-416b-8b66-fe08f4e58c37", "comment": "Malware payload", "value": "2ffbb98b649470642aa18631c40836f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705674, "uuid": "b41f0917-c729-4e27-a3a5-02c03677a282", "comment": "Malware payload", "value": "b67abceaad8827d5b7758e2351c16fbe50e80d71e371bcac2a1bbd95857a7bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705674, "uuid": "9ec3ccaa-1dc5-4b67-b649-228a9c150361", "comment": "Malware payload", "value": "1a7f2014b99cd99e2a9c14c179d13a232038e5f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700705674, "uuid": "e27177af-44ff-430b-a049-72b67341267e", "comment": "Malware payload", "value": "b5496ebae2b781f5967610f9f8224120aaea0e4214f6fa3361c525a4bb2eb8bba11ef158af5160c28c7b733399253c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705674, "uuid": "15c70986-8976-45f5-8c4f-11c73bc934c7", "value": "T12E459E05B2A68B84F17CC7F840525092A7F47D9EF25DCB8B8DC739DA3970F911509A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705674, "uuid": "21a3a90b-47dc-4d67-af76-1282dc3eeab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705674, "uuid": "36a38f0d-918d-4c4d-9b86-c547fbef22b0", "value": "12288:PSSgzMJr5QwQHJ4DGJMpe5t5Yx8YxpNY8xqi/+KL2ohYgiTe5UxvhpiUuyagV:aSgzMTQ1HJ4CtLYxbbL3hYgzEhpwgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700705674, "uuid": "6786a637-1260-4a9f-a02e-531a18b4ba3e", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700705674, "uuid": "7a49e748-0956-4f9d-a065-2279b8e45283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700705674, "uuid": "77078790-1033-4e45-bfe0-8bb15c36b35a", "value": "SecuriteInfo.com.Win32.PWSX-gen.4548.7877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facb3c7f-8a4a-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700776513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700776513, "uuid": "24873ddd-a52d-47ae-a190-d1887a1d81ea", "comment": "Malware payload (DCRat)", "value": "d7b1a729706256c6bb7f9f4c1d7a5e92", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700776513, "uuid": "83a96ec5-1a0e-4412-bcaf-b4c9d465e0ec", "comment": "Malware payload (DCRat)", "value": "b95da950b192a24ecf7fdd74fb8e2020a5f89e48b6193f5042321b7050447b10", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700776513, "uuid": "36a83b79-f4f4-4ce3-b30d-9078f6fc5f99", "comment": "Malware payload (DCRat)", "value": "dfbcc8230ec7d9be9c8801006300fdd9c52a1562", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700776513, "uuid": "041dcde5-35c1-4f44-b12b-1fb62f4c21cb", "comment": "Malware payload (DCRat)", "value": "5f2625bfdae7786cadb1b6b5245cccf00208591a29baddc93de15bd8d45db0324cb653865e405a2200bc8806b8a8173e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700776513, "uuid": "11d41d38-5699-46c7-95ab-64500e91cee5", "value": "T11316F10665624A73D2D53F3284DB045E53B5EB727612EF0B3A2E50D5EE86630DF223B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700776513, "uuid": "6b407a43-6d31-4754-b454-d87d0a125549", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700776513, "uuid": "fe27ac18-17b4-41ca-9db9-fd759e91cbf1", "value": "98304:y0stsjKHjNrzegRsX9NGIXbcMgzGt24EPd2eBMEQWCT3OJox8Tn1Ta:vstsWjopNNGL/St24i2eBdzvOx8Tn1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700776513, "uuid": "2eb1f722-ba51-4638-986e-64ec0f0eb91d", "value": 4134626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700776513, "uuid": "c4d3ff71-a487-4083-9109-3bd6a712aed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700776513, "uuid": "b4c54c59-a729-49e5-a54b-c113819d08ae", "value": "B95DA950B192A24ECF7FDD74FB8E2020A5F89E48B6193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce51ae6f-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740361, "uuid": "9b56dfbb-c467-407a-8706-d0e2da19fc88", "comment": "Malware payload", "value": "db6a9568a6e4e5cfcefa228bf0b4977c", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740361, "uuid": "ba2db386-73e4-48a9-9d46-d16dda9d3477", "comment": "Malware payload", "value": "ba6265a88a2aee5ae56c60ecc65770f6e6bc70b194dabeb0bd91bd3c44a918e6", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740361, "uuid": "7098eb06-b6ca-4737-9aad-c431cada1dd6", "comment": "Malware payload", "value": "83a7ff86a592da599300a2cb5036bbb1f99c22aa", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740361, "uuid": "1479a7b2-bf62-4cb8-8d21-53a0aa569b1e", "comment": "Malware payload", "value": "154fc1bb31bf6a568e063552e488d5d2abaa9c52c9c05a08eb3de2e577796874af3ef159bf483a70beab1af34b5f2fb3", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740361, "uuid": "46d3ad0a-f53f-44d1-a56f-721878b93f05", "value": "T1113523C60AA85F54F8E5E53242FC808C27DF2FDD4334B871DC2264EDAD949F5B85AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740361, "uuid": "4aa47db5-5650-43b2-8cd9-001e87d25354", "value": "24576:BBudSBeZ1xLXTWsCW3J3xnBGGbyVdCZ6WTipBcQ:GisCW3lRB9cdCxTi7cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740361, "uuid": "8bee064b-387b-4d25-9888-d2eaf26e947e", "value": 1067633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740361, "uuid": "03ceb1f0-850a-44c7-9cc2-f3435b14c6c1", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740361, "uuid": "0b9fd757-c4ce-4fb5-9344-223cf1ee0128", "value": "jouk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e49d01-89e3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700732005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732005, "uuid": "0fcd12fb-f0dc-4d7c-9c6d-f8a7e00a8130", "comment": "Malware payload", "value": "845318ba52a2cf496445c6ede6f3a803", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732005, "uuid": "8c2eb193-689e-417f-b8e2-9f804b5b2a28", "comment": "Malware payload", "value": "bcc00e3ee34a5e0f102fe25a8462a7007bc34c8abd06c522cd82109bdb0ee51a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732005, "uuid": "bcf6f1a4-25d5-49b8-88bd-bdb4233a4e3a", "comment": "Malware payload", "value": "65bfdb17787f9230a3446a4ebc6a59db52b4a1ec", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732005, "uuid": "bc8e99d9-2ffa-4c9e-b58e-899c0bc095d1", "comment": "Malware payload", "value": "d41b7c3c49d72853867e44e38e5a5b237bd6c0762fa8d3cf0694e1396be7215f5785eaf9fd0f5db10efd65e03e28f09f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732005, "uuid": "20c86193-241c-4721-a697-1a40883e5309", "value": "T195A1D037F027F1648241E2E2EE7A990F85FDBC66B498D8D4F37828D12A3094E84755DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732005, "uuid": "b0a2325c-c4c7-4b4a-a04d-503fa40e2d0f", "value": "96:PfIrsTrBHhJhuhQnqbLwtBnS1tBYLyES+yz9zAIR89Kgbvgs:osrJFictmtwqXz4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732005, "uuid": "378c600b-810d-4a2e-9b02-18ecbd0f7ed6", "value": 4875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732005, "uuid": "ac5bbd10-35c8-4e42-b1e3-476780366379", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732005, "uuid": "e50330b1-d47d-426a-b9cc-21cccd1381ac", "value": "\u70b9\u51fb\u67e5\u770b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ae28db-8a19-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700755214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755214, "uuid": "9c566af6-3dae-45b8-831d-51546e822ab9", "comment": "Malware payload (DCRat)", "value": "002243e5253cfd033a50b49302f7ec7c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755214, "uuid": "212ad614-c50f-43a9-8581-abffb7120d20", "comment": "Malware payload (DCRat)", "value": "bd92b5309471d738558909eda794cef44dfbc8a363b8be00048f1576536b8bf4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755214, "uuid": "ea92a2ce-de8a-4ebd-b69d-700f45fcf3a8", "comment": "Malware payload (DCRat)", "value": "64173408aeb7df72dd87563a5709ff07282f2614", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755214, "uuid": "990aedfb-2ae1-4918-b89a-f9a0ff37ee96", "comment": "Malware payload (DCRat)", "value": "5b345a4f734c2af2cefc01d353c8809baaced3c5cf44f79fc621477da872d5533c8a6e035fc19852d50a585a78470fb3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755214, "uuid": "e8e6b937-1ee1-47d0-ae49-1373b1186530", "value": "T14CA5AE017E448E11F0191633C3FF859897B4D8512AA6E72BBDB9376E95223937C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755214, "uuid": "a1a87854-72a2-4fd0-a740-2b31a0b97d39", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755214, "uuid": "c45d76c2-359d-4c43-9d19-7d617a529057", "value": "49152:vbA3w82gW0z7ZQK3BWYXz6oXym6AOmArj3kOKrW70vi4:vbTNg7KK3BWYXuhJrj3kO70vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700755214, "uuid": "5696129a-c5c8-4c73-ae87-08b0f2e49c76", "value": 2074282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700755214, "uuid": "1e9eb5be-bd25-47a8-8e07-8bc4837cc6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755214, "uuid": "185c618a-c933-4138-8863-ac1703fe3eca", "value": "002243e5253cfd033a50b49302f7ec7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40e08fb-89e7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700733874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733874, "uuid": "4d6db54d-f19d-4f12-b16a-d9fecf93f13e", "comment": "Malware payload", "value": "e66bdeb4a49741d14447cb94209780a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733874, "uuid": "06113d1a-f26b-4fa9-8d8a-7002682f03b1", "comment": "Malware payload", "value": "bf20e10da6c6c4a65f9e992ea5dc4618d09dda0b3fe9de72fbe6e62dc791b307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733874, "uuid": "6a9890d5-933d-4cce-8711-a000454b183d", "comment": "Malware payload", "value": "6d498c8fb76de003bcd362e331579224d114b201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733874, "uuid": "bb3c9983-bdec-4fe9-b700-d2dbb077f79f", "comment": "Malware payload", "value": "d4339a431feb60bce5a9cae31dfad7d406d15712d4e2471aa1cb9dd56cf44698dcde25b481d18a091db572598240c875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733874, "uuid": "b8b665a6-76f1-49f7-beb5-e356e59c48b7", "value": "T19E763340FCF28CB4D01A2775699E7650E2B4E7E01542DA2723EF2029FF6B19BC1B95A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733874, "uuid": "069d15ed-d615-48d9-92e0-42def2c9b48b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733874, "uuid": "9805bb3a-23c0-4a84-bee1-bfec255a56db", "value": "196608:91OeSoov4hcpvIVH4D2ndCzOuF09xQxKeEo8A4hYPq8p:3OjcgIxa2nUVEsEo8Thn8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700733874, "uuid": "2d001863-242a-45cc-80e9-915091e00705", "value": 7540367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700733874, "uuid": "965ee864-018d-4eab-9c6d-db4429620fe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733874, "uuid": "86ead55f-4ceb-4419-a8f7-8bd9791b51d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e8561e-89ee-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700736609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736609, "uuid": "d98711bc-db12-4610-b6be-eb7f1a1b151b", "comment": "Malware payload (Mirai)", "value": "e47efd58de7773e4595fc313e1ddc264", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736609, "uuid": "2383f8d4-963e-4e3a-bfb0-82379cdf8157", "comment": "Malware payload (Mirai)", "value": "c12179cfd3dade481b8fd321747b5dc1c55ddc2bab7171c674e69b50f7c50df4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736609, "uuid": "e8e8e601-132c-4acf-bccb-5d9ce34adeef", "comment": "Malware payload (Mirai)", "value": "6c27832e6813fbc41f4eff98c8e3cca259fe3cdd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736609, "uuid": "e9f95a8e-e25c-4331-934f-3ab5ec0de920", "comment": "Malware payload (Mirai)", "value": "68822ee73633dd90e700d0cd147b68d1b8aee1ad54be534274ac57ae3a5c7feddb273cd586c9a076983a769405e9fcfd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736609, "uuid": "9ae3b58e-3921-40cb-9449-dd7039351684", "value": "T1FF633992BC819612CAC413B6FE5F519E371213D9E2EA7207AD15AF2037CBD1B0E77252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736609, "uuid": "a782cd4b-f1ab-4ffc-b889-1766fd05e0e9", "value": "1536:zSDWsMHjmC8XrdbrtP0HZ7YbwqqaxgFDvyt0X4N70RXtvz:zSPKjm5X5mYEZ02vk0wIPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700736609, "uuid": "c860e549-d530-41cd-abc9-2ca009091c53", "value": 71988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700736609, "uuid": "7646fa49-d56b-4679-8ca8-9c89f9653463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736609, "uuid": "79d9b615-7147-41c5-b867-5fc3aede918b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8930376d-8a45-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700774175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774175, "uuid": "b36aefd2-d792-406d-a0eb-daee93026c21", "comment": "Malware payload", "value": "e75e7f84999b17a9ed7f7db200b05752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774175, "uuid": "5afdd9ad-e3b6-401f-b3d5-e6dd86213e37", "comment": "Malware payload", "value": "c2298a91f6416fa73bbb9a291ed18a3a1a3ab32550bf9b1d221583adf450577a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774175, "uuid": "b84168ec-4e7e-4393-a003-7959713cff88", "comment": "Malware payload", "value": "e89ce6dc229ceb388e58463b2ed8a71f0c38f3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774175, "uuid": "b23434a1-87c5-440f-a469-8c15824840cd", "comment": "Malware payload", "value": "4d349e5fdc84c232273ae73b4967307907cd3c4f64ef3fc5b292549a1f45823af8776b8ad415f04cf4c80b03bb5ff45f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774175, "uuid": "e5fdbab1-d3f9-4000-b05b-884adf4ae5db", "value": "T1F7F733271801562BD33FED3AE433227427FB705053C56086BEDA594DEA9D5E2CEC932A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774175, "uuid": "31c93ef9-28c6-4e9f-a97f-df6ffabc855f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774175, "uuid": "bbd01e99-7355-4157-84d0-b00561fe345f", "value": "1572864:VjddGvuUv6GeNJBZhpagL2Xo1Y9Q76QLGaCj0Lb7:NGvuCINHjgiSo1YGL/Lb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700774175, "uuid": "f031d0aa-da08-4376-9e5d-9119287570be", "value": 72281875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700774175, "uuid": "87abbe5d-8a29-4f0e-aaf1-5de499a25427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774175, "uuid": "344d1d1e-dbdb-41cb-b245-d3b8de58b455", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1c4853-8a1a-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700755742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755742, "uuid": "eca808cd-eb19-4be9-b8f3-ea2882763fe7", "comment": "Malware payload (RiseProStealer)", "value": "1bf450126d6c5eb9ee42cdb678fe315d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755742, "uuid": "96d5db54-20a8-406d-aead-5a8571b21037", "comment": "Malware payload (RiseProStealer)", "value": "c27687bb193c865d4fe1671685bb714e2bb623b4acf08d4c08cac9d5c2dff83f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755742, "uuid": "b1074e0d-a6f1-4b03-8db4-7adfec96305d", "comment": "Malware payload (RiseProStealer)", "value": "09ac4c1f15f1fd1d84c68261f54900e4b03c39b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755742, "uuid": "57651ef2-b17e-41d3-be86-0eaa3da0e49e", "comment": "Malware payload (RiseProStealer)", "value": "20469a621e008e011f1e31764a5a7c3ef34378c2d20321d5ab62234aab07f7babafbb996f70e6038719a3920aa3db4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755742, "uuid": "bfdd0739-d36d-49b2-bd5f-05cc089ceb11", "value": "T153659D21FA08C0B7D09211B0916D6A7B95997A322BAF4CD3F7C05E6D01B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755742, "uuid": "d6f9b56c-f249-4d3f-83d4-0d3731fcf1bb", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755742, "uuid": "f8ea732d-26ca-439a-84e3-1ed054434825", "value": "24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700755742, "uuid": "f3f4513b-343e-4555-8398-4054d34f2bb6", "value": 1542150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700755742, "uuid": "6f158b69-6bec-40fd-9010-ebd61fcb6412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755742, "uuid": "8f7ec1e7-a175-4533-aa23-f1b707f7de23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc7c794-89d9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700727794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727794, "uuid": "a92a411f-21d8-4457-90f5-9040c6bcbf69", "comment": "Malware payload (Mirai)", "value": "1473eb07bb443d7b233922dbd9c59b34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727794, "uuid": "8a4912a8-1acf-4b97-a889-6f063d3a8d77", "comment": "Malware payload (Mirai)", "value": "c2790d9f510d91ac2facedb90b7f3ed44ae95b07526c426b2de5faa73c7e6e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727794, "uuid": "d1cf516f-e05e-44a7-b155-e3c2feb1f7cf", "comment": "Malware payload (Mirai)", "value": "c2397ee07b7fd900c6409d86695fbd60cb346a0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727794, "uuid": "3dbc16ae-5707-4d4b-bee9-ba7d95aa824b", "comment": "Malware payload (Mirai)", "value": "1d11dcec4a94dd20a06bfbd799823f1a2033aa7f4865a62e12efc94a5f4b98bdc625b08cac9d6d385b65660822c3afbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727794, "uuid": "25d18f71-a1eb-4e5d-b8ee-61420fecd18f", "value": "T124430260D05BDC909E8ADE3A0E6E151F71F749DC8BB3317B513C5A423BB3A409989B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727794, "uuid": "abd9c530-0738-43bd-8d8a-603f254c0699", "value": "768:eHB8XbMUaq+sschnl5dSfVIeLrL7cv/NWq3UIX7QHtm+cBCXSARKZK7RQP/XBDn3:eSrv+aYVID/3XU8XHARZ7aPJaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700727794, "uuid": "650523e9-46fa-42c5-a79a-b721790f48de", "value": 55784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700727794, "uuid": "f3d84db7-6e7b-425a-9843-574995e37f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727794, "uuid": "bc493260-11e5-4560-b923-6c5ffd7a1d5b", "value": "SecuriteInfo.com.Linux.Siggen.9999.28168.31965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89317057-89d3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700725212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725212, "uuid": "5267f76d-4dd0-4cf1-892f-43eb050aba5a", "comment": "Malware payload (LummaStealer)", "value": "c72ec845a3f058622573e421e4697b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725212, "uuid": "03c2ddfb-858b-45bc-9439-078aa6a51cc0", "comment": "Malware payload (LummaStealer)", "value": "c3eb30cb0aac2b4eda6b43e8d2bceb6b8b726bcb472402eacea359a0bf86db1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725212, "uuid": "8dabb74d-046d-4b90-b5ba-e3d67f7365ee", "comment": "Malware payload (LummaStealer)", "value": "cab41367e6237e93f117fe9f9fe6758243243ba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700725212, "uuid": "561c12a6-86f0-4a35-94e6-d3cce281f7e8", "comment": "Malware payload (LummaStealer)", "value": "b956c5f3488c1ff0d169274b7f619839ea918ecc34ab15cc168e1f76d95f4dba9ac1e32606b7f3b98c304837a8f30d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725212, "uuid": "f0de7ef3-5289-46f8-b36d-60150eb7fee9", "value": "T19B06CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725212, "uuid": "edbbe48e-5fac-4822-95b8-4bdd203467d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725212, "uuid": "4d8e0f9a-8916-4482-91eb-092e51251395", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYR:8AqA4bNMAeLVdWRC9bO2IyOnhJYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700725212, "uuid": "84820eec-a950-420f-a5a2-24ef8f9620de", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700725212, "uuid": "2e2c6072-a4a6-4654-853e-2a0a8e16f30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700725212, "uuid": "f97d2a6a-6a9e-4a62-93e3-fd32a124dc5e", "value": "c72ec845a3f058622573e421e4697b2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620c1185-89f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700738032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738032, "uuid": "0b4c4ce3-f49e-4193-ba9d-15bbd4817938", "comment": "Malware payload", "value": "e6feb2feedcd40debe9652807abe05a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738032, "uuid": "0b85175a-99ed-41b4-ad14-7e090894ac9d", "comment": "Malware payload", "value": "c4e7f8b515bb1affff353fc47f448d67656e8adad59e5124231d314266c12d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738032, "uuid": "8cb08fdc-dc5b-42e4-a77c-2b2a83e1662a", "comment": "Malware payload", "value": "960c00c0247a8002fb2c750915239d058d28c6a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700738032, "uuid": "1e43debf-052d-4873-bf9c-b11d168e28c0", "comment": "Malware payload", "value": "0c0d6d1846a77a1a53756544d16b9aaa307aab5a59ce5cf143a986dd705e100b8d4f3fd34cbe81fd1c88044dec21468a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738032, "uuid": "7261c0bf-6e6a-41ed-849c-d4994550ade7", "value": "T1804633C979831ECEF08E6538812AAF2FF1B0DB374250A97C55AC79E9ECA3D644171253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738032, "uuid": "2aeab8dd-dbf2-44a2-b55b-2e7301b088ed", "value": "edac19bae7a55f5a30336032d0b4ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738032, "uuid": "664c6505-2631-4da6-b277-b2cd3f7c8ddf", "value": "98304:usqGmmq+Dh8rbJF4N1IMlj8S5gNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJ/:ubW8YvIMxx5gNvpbXZ778hsIvY6j1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700738032, "uuid": "fd41fdff-539d-4083-90d4-a9efe9520ba5", "value": 5498368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700738032, "uuid": "b2570901-de7b-4189-a481-2b7e9e8a825c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700738032, "uuid": "b639e8a6-bdb6-418b-b424-945a25bf43d9", "value": "SecuriteInfo.com.FileRepMalware.30157.21540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de616703-8a0d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700750266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750266, "uuid": "d11ed2ef-97f1-466f-b620-1b797eeb7c48", "comment": "Malware payload", "value": "5351e89dbd7f44f50a29cbd176030b19", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750266, "uuid": "fbe04a6c-a1f5-4cd2-aa0b-68eeb00d48bc", "comment": "Malware payload", "value": "c5a73896dc628c23a0b6210f50019445e2b8bfc9770f4c81e1fed097f02dfade", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750266, "uuid": "57c93c68-5e2a-410f-98ce-e1330dc0d47e", "comment": "Malware payload", "value": "da01670573c7ea8e43663f802fcf0e177cf0882c", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750266, "uuid": "6e4d2db6-c638-4e75-890d-3f2724d33009", "comment": "Malware payload", "value": "82a15a3486588ac2bc6fff2515039bc0c396d5a0e0c7f959c8ab2a59eed9d76a813536f0d376952552ac621a25fca51e", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750266, "uuid": "15acc2f2-4fb3-40dd-be5b-6099f66bd7a5", "value": "T1DDB35B17A3A500BBF57A8678C8530E46E7B2B4150B609FAF03A0875A1F673D19D3FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750266, "uuid": "73f8b585-0b41-47b8-998f-d400b92cd881", "value": "0ff8b58515b3fa045e6bff9a9e0cca16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750266, "uuid": "89a2ebed-53d8-4e7a-89d7-e19d2d81f837", "value": "3072:F1uNKVtUx7SN7klktpvvuMJD/F8ZBRZf:CNKVaYdklktpHuw8ZBXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750266, "uuid": "5ef569ed-9303-4ccc-8359-f96a543a07a4", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750266, "uuid": "a366bc3f-69ac-4600-9ff7-9ff10b50c9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750266, "uuid": "73e520fe-a07b-4c95-8911-cc48f41b8f33", "value": "18.18.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fd7743-89db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728584, "uuid": "94691c9f-f17c-4fdb-a099-9c8419f5fc50", "comment": "Malware payload", "value": "092998cd1992462b4c31e85c8b66964f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728584, "uuid": "59921c59-17a8-49bf-9886-cd8ed2d98d64", "comment": "Malware payload", "value": "c5c77e51dc1af0c4af0a3b0d3fed6fcdd7903017aee805bf5d64764b1472ca5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728584, "uuid": "cf5e1c53-38fe-427d-9679-2a1e1af9813f", "comment": "Malware payload", "value": "0f6539d1e6ee1527c809366af50db63d67d29585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728584, "uuid": "aa2e412f-119e-46ff-869b-696f9a44d95f", "comment": "Malware payload", "value": "ceb649609431de0e6a324e3638a2a1d818fecd856d90e38dca58889078ab89ee7ea92bb317bacfee1187e90b663502b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728584, "uuid": "4a3e69d6-58cc-4a79-a5df-9c028f64bb33", "value": "T1B8D423123358BFA0D8B95BF5A061005587F6782B4AA2FF491CC260ED4DF5B025B72F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728584, "uuid": "d2967d97-0bc9-473e-8ed0-eb8d43aa7e01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728584, "uuid": "ef91fbc7-ed1e-4f15-836d-dd22043a1165", "value": "12288:H8obGgM2lfqRpWC9B+9QVvv1ZR1MUVNI+549k9NrylYrOw:cCzPW+gn1ZRGUVWC4yTylYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728584, "uuid": "e72305e5-e6c1-4ad7-91ee-9d7e4e39ba80", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728584, "uuid": "4f5b16f1-b941-4efe-b592-99bfed68e631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728584, "uuid": "fa6b7769-c1ae-4a49-b02a-9c35b297e614", "value": "Bank Information.exe.gz.001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da80fcc7-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700729214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729214, "uuid": "c8733e0d-b34e-42cd-a068-cbd05e02a210", "comment": "Malware payload", "value": "c55aef6730fdfd6fbd365a2bc7590863", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729214, "uuid": "913efc3e-9a14-46e1-877f-151eeb941d3e", "comment": "Malware payload", "value": "c6243e188e0435f9f101993ef3d1a1f2ea23cb035ce84cdb018f74c51e2cbdb6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729214, "uuid": "05ad1daf-9512-4b72-92e8-5ee0a6c02413", "comment": "Malware payload", "value": "0bd46bd549852a2bf54ae4392bfa51ab0ed22210", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729214, "uuid": "a32f6ed9-7baa-4992-a557-1413e1d92eb2", "comment": "Malware payload", "value": "218f70505cb4da0fba3974462e8d107140125cd0c4ec631abc703559a0331d903affe4db3fbe00cfaa91941ce91dfd87", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729214, "uuid": "672da271-9203-4805-9dd8-4908491ee01d", "value": "T1584533651012FFDB0C792FB45C39841683DA118DE9AE9FCA78C50E9DEA8F6D233D1512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729214, "uuid": "73bffe8d-6bc0-47f3-9c9f-05c169a5779a", "value": "24576:CaRlvYnzim7OYVGejrPyFg9va/dzjSbiheYDuAce42GD7za04:CEFYnuLBejrygI1zjIYyAcL2o7t4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729214, "uuid": "1686f323-4a03-46a3-9edf-a2cd7186b4be", "value": 1232188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729214, "uuid": "1f8e08eb-234f-4eb5-9e66-a6b747e686f2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729214, "uuid": "d2ea0189-a50c-4edd-9a62-0953bc8a0fcd", "value": "SWF314811802010002.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2f6a98-89b7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700713116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713116, "uuid": "385048c5-d066-42b0-bc8f-3dd158b28394", "comment": "Malware payload (Mirai)", "value": "98516400e20d10be5d0f6e2462e33df3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713116, "uuid": "2f27ca71-c0d1-40f8-8a33-f499cbc08f37", "comment": "Malware payload (Mirai)", "value": "c632fdad10d050e7c07d6b880fde2a546ab4d6fe7f32047ee0ed4727d52e8fad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713116, "uuid": "a6ef57e3-489c-423a-8bbc-dcd52dcc5d73", "comment": "Malware payload (Mirai)", "value": "c43d4606b5fc04e560814b6b4c2ec4ac45625641", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700713116, "uuid": "66fa3dc4-0498-4106-b2e6-729b93c45360", "comment": "Malware payload (Mirai)", "value": "d8a7313458cfa8aea6ed45a1d08e8418aa618932a68a57885b0823c7e2b1bf6730bd209669ba2961de896f67457f71e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700713116, "uuid": "9814034d-344b-43a8-b65a-8a77316f77e4", "value": "T11133F2519CAA4C62CB70903A4F6949637F288F97C762B171437D43AC97E35CB623EC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700713116, "uuid": "81c54b8f-0cc9-49c1-ab60-abec92ee46e5", "value": "768:v5Ownk8NoJPOHztwCnqE/IiAHFUZMUpYvrM1VXm9q3UEL/XwJY9aiFpQxR:cck6HpZQiAHFuMUpYvsL/Xwi0g6xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700713116, "uuid": "4334767b-b7c0-41e5-a153-86c7c136f7b6", "value": 52668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700713116, "uuid": "ec20feae-d181-40f4-b08c-ffb4feed4adf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700713116, "uuid": "6df6f3c9-95cd-49c0-a629-87dea90a13c3", "value": "98516400e20d10be5d0f6e2462e33df3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dcdb13-8a5b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700783398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700783398, "uuid": "b2e591cf-7860-42c9-9bee-22bd80affa3c", "comment": "Malware payload", "value": "e37ea6abc23c1c71d528ef272f79f66f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700783398, "uuid": "8008070a-0983-425b-bb21-5f0dc7caa616", "comment": "Malware payload", "value": "c6e6d9dd75af4dd8ec008e9dc75688b0325d31c822eef311783feaffff7c0dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700783398, "uuid": "ee2e9c7c-15f7-49b9-a052-a57a8fcc0027", "comment": "Malware payload", "value": "8e153efe15214296e26dd561bc1c7d25063b6b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700783398, "uuid": "ab50db0e-b59a-4c0f-b839-7582a234fdc3", "comment": "Malware payload", "value": "c971f744bb1841f51c0fe3ca0398d705328aca169b0954d2987631b512bf4d910d86ad7ea7385b978debd40ed5ac1be0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700783398, "uuid": "1edf8ecb-3762-414b-9735-61e67f686d4d", "value": "T19AB50246A164C576C12239748C5A9325A93E7EB03C48750A9FF57FBA9F383C3291D2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700783398, "uuid": "0ccfd4f2-3413-4ad2-8d8a-a3605b2569fa", "value": "498be8ff56c2ccc53c28a4fff100692e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700783398, "uuid": "163763c3-8f90-495e-9966-414af121f688", "value": "49152:zmUjlGU/DDjqvOS6iy3iWOY+YLqaLOlTarbs69V/:zH3cy3im3L6cs69x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700783398, "uuid": "d27d47b3-285b-4e6e-a5bb-b561b20de900", "value": 2461184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700783398, "uuid": "633df62d-1f0c-4b66-aca2-bb1efa64cf28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700783398, "uuid": "d2242df9-4741-40e4-97a2-ef84a4cadaa9", "value": "Copie de plata bancara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c0d475-8a08-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700748096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748096, "uuid": "f9f75f37-49d2-41d7-a86d-fd36b4fe3533", "comment": "Malware payload", "value": "0ce695c9a21cde877fd4daf4765049d2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748096, "uuid": "df3506a2-eb4e-4b53-88cd-84cba675f1ac", "comment": "Malware payload", "value": "c7c7a5485b070baf4dd85b7ae0945a0fe191ccd06a1541eadd47a26501cbb9a4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748096, "uuid": "ce8fbe14-fcec-485a-b489-7ab108133999", "comment": "Malware payload", "value": "27b23f7112c7240bddc53a3c3c5b9100f7ca7e4e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748096, "uuid": "6d1a07b5-712f-41ba-8e7a-fe55cfe6d7b9", "comment": "Malware payload", "value": "771c8067a5c3acd1f55c9a22d1515c72e3a5b8c746db1697dead23c7c4f75b8b22aa93c930ada12bdca33c8d17a23600", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748096, "uuid": "ae9c3a22-d8a4-4709-bae8-acb4acf47b32", "value": "T18D273325A687C936D59D027BF9A8FE1D05787E73433041D3B2E97D6E84F08C1A6B9B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748096, "uuid": "f6a923a5-718f-4869-8f32-17b066d123ba", "value": "393216:WqOksrYwrVeqZVEYqhN3wDCvqVTOrLqIjc5SgwKfRyMx2RbRjZgwp8t:SrYgM0VEY6gDndOLKStKfRyQ4JZgI8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700748096, "uuid": "ce36dafb-d1c1-4a4c-beb4-f1d8a7ddf9eb", "value": 21282816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700748096, "uuid": "5eb58875-7970-4d8d-b774-8de635301d87", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748096, "uuid": "72b2b563-e0ef-424d-b912-d683c5f915a0", "value": "RAS_OL321231.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8065a7fa-89fd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700743236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743236, "uuid": "a77f8e88-9d54-4d34-bac3-357b3dce39bd", "comment": "Malware payload", "value": "a2cd85fb965640cafc0972845650c8b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743236, "uuid": "de605508-72fa-4da7-a3c6-b13c8f6a92fd", "comment": "Malware payload", "value": "c83c8ec888f8404ab18d2a3706bafc74a36fb3e05dd64b9c58efd610d67f82cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743236, "uuid": "1b1c9054-fbb7-47a9-b364-dc7a23f9a78e", "comment": "Malware payload", "value": "a286ba694e96b9017385c2e4de09f44139e27ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743236, "uuid": "a8549f9e-5592-44e8-9ab1-2b300f7e205d", "comment": "Malware payload", "value": "320520c3ea785fdbcbb74fa359014a20340fd89bb9da178818768240e27570d6463922a2876c45e5a2205e1c0c299835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743236, "uuid": "89b3b751-810f-4188-b7e1-facabfd5131a", "value": "T1D015E01876B96FA7DB3A83F65411560407F96E6D203FF35A5CC7B0EB2AA0F500A90793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743236, "uuid": "4619ae9e-da20-4d17-a6fa-4a55605e1888", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743236, "uuid": "50ca9678-7eba-4fbb-9c5f-f8bc203fdffa", "value": "24576:pytD/F2k78mi5lgilGe7yBU1M+BE/xa4rRk:pWgk78mMlGVIexaaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743236, "uuid": "acf498bd-f79b-4b12-9d98-4808c88ed7e7", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743236, "uuid": "f726cc08-9510-41d0-a233-a8cf7111eeca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743236, "uuid": "131277b5-bef5-4856-93ae-708a953421a4", "value": "NEW PO (YST2310-1010).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19be0575-8a3f-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700771411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771411, "uuid": "2f683389-52a3-45c3-8269-8e301aa923b0", "comment": "Malware payload (njrat)", "value": "c5c1c699b0f3ae7f590c635293af07a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771411, "uuid": "3503af83-c013-47ec-85de-7aab2e183f24", "comment": "Malware payload (njrat)", "value": "c952da89ed2d37ec54d0ee9240b08a2815133f85903393fde096b78896cfa44c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771411, "uuid": "5cd8f807-30c5-400d-9d59-1f0210a360dc", "comment": "Malware payload (njrat)", "value": "1b34e23a0ff16710d2da9b9a6d74fe17a41a41e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771411, "uuid": "d553c533-2a96-4e99-b925-0b13c2a319e9", "comment": "Malware payload (njrat)", "value": "842e81c49fe61d73f5a8c0861014423bfc2d8692412a49fa0a5fb295557ecdd339f601955c09e89cd8c55ec59c51f5c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771411, "uuid": "4e92e4ad-2780-4a46-955c-1e5d5681c22b", "value": "T18D032A4D7FE181A8C4FD057B05B2D41207BAE04B6E23D90E8EF564AA37636C58B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771411, "uuid": "dadb2b46-038f-429c-b298-3a95d3a1b05f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771411, "uuid": "79005ff5-9904-4e8a-9525-c4db6126e73d", "value": "384:GS+6WIiejtCVLO309Qmykrt4QdqMjf+vWEWYrAF+rMRTyN/0L+EcoinblneHQM3A:MHdGdkrOGb+eE7rM+rMRa8NuTZ3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700771411, "uuid": "e05adf23-8fd9-4747-ab46-efcbc1e027fc", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700771411, "uuid": "4b4c6ad4-a9aa-4438-9d64-11bf7ebc8f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771411, "uuid": "0ef6936d-e298-4439-91af-930d2ce08fd5", "value": "C5C1C699B0F3AE7F590C635293AF07A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23333239-89ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700722894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722894, "uuid": "119a5be6-321f-45c8-95bb-cf982ae79dc5", "comment": "Malware payload", "value": "563dbcc15e73810cb19407ceb80903fa", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722894, "uuid": "0499d6c6-993b-45b7-8729-917aae0c538e", "comment": "Malware payload", "value": "c9812f2fb7eec6c757158bc42dced5247f006a67bd54a7d8f1496dceb187f61d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722894, "uuid": "88a66361-3c78-49f6-84fc-5f80ea4df439", "comment": "Malware payload", "value": "2016f5d95fd2e8cc6aeabf6cf1a9d93b7ae3786f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722894, "uuid": "a35afbfd-a9a6-4032-b446-8830107cc2a6", "comment": "Malware payload", "value": "055aeb7a156b771a53fb718737856578f4b00b6bc829db40fe0d888e601c19bf08adfc70ffe9d173a3db2a2e230138df", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722894, "uuid": "f804aa51-9ba8-4415-b7cf-097ea11b2ce5", "value": "T10076E100B6A0C136E4F709B58EBA826A9A3DBD71171490CBA3C41E9E5F716E1BF31717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722894, "uuid": "27f28d2d-0ea2-419d-beb0-9abecaf1a1e3", "value": "24576:uBudSBeZ1gvNg85PHo4tHYmmG8Aj7RuweG4eJRLysrFl0FWELgJYy3SbvGz:9WvO85PI4tHYmx8Y7A1syj8JYy3Sbez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700722894, "uuid": "7b7825c0-95f2-463b-949b-5f65465f08dd", "value": 7340544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700722894, "uuid": "4ea1dc9c-8710-4a6d-8201-9bd03921ae36", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722894, "uuid": "f98c0b22-88fa-47d5-b8a4-f2277fefc7dc", "value": "payment.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6102f5af-89f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740607, "uuid": "2cab07c2-665c-4db6-809f-7129a2ee095e", "comment": "Malware payload", "value": "0497cbd81ef6ad70cf6b6db2e5a37286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740607, "uuid": "008460ef-a008-4460-8add-30897d75796e", "comment": "Malware payload", "value": "c9ed1cac4d4b557f95dc048dc6eb874ab2f2fb9aa85554bc1ba55e2519234c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740607, "uuid": "3d74ce9b-8841-40d5-9c99-e3ad4838334c", "comment": "Malware payload", "value": "130ea44769a51e95dbc4dfc1e0dc941028cbb42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740607, "uuid": "499c29b5-6d50-417c-8b2e-bbd657d6e7e2", "comment": "Malware payload", "value": "8b06a20380159ec69e1a4e320b646e40f1add8b3d0e2650422a68604f9f4fd42a8a482fde7772a453a99e8cd5c5f5a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740607, "uuid": "78c547d7-089a-4b91-a344-68c35494cc51", "value": "T144161712AA968225D47E0475CDAA52ED53307C285F104EDB73C87A3939F32E17E327AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740607, "uuid": "ac19d316-cd22-4ccd-9317-0610ca598089", "value": "6805b9d9f17bc82a9e79068d20b7f163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740607, "uuid": "d922b4cd-908a-4c8c-9e0a-ebc955775541", "value": "49152:Xctar2G5D6OZgeihsiPBZGugXX37tv/iaSeGDEDnGs5haXIMg2hyg/mWc2LbG/kJ:ia6yD6etih5PBZGrG+qIsorru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740607, "uuid": "44645f47-40fb-4ba7-85e3-dc733e6d5c8b", "value": 4196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740607, "uuid": "b259a81d-1d93-4a11-abd1-a2e54da2d4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740607, "uuid": "1753ecfa-289c-48b6-b2a8-b59f458ce448", "value": "paypal_srv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24194e4e-89ad-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700708722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708722, "uuid": "0bafd4f1-d451-4d26-8053-34a678bb1810", "comment": "Malware payload", "value": "31346aa67c08cba66ad472a900cd869f", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708722, "uuid": "a1b8eab1-367d-473a-97d7-7cc7627c0b52", "comment": "Malware payload", "value": "ca78da048be50d57af074b9348150606c11564a087f8b15eb273a4c853a6557c", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708722, "uuid": "c86c8270-292c-4d96-bd28-4dc51f3d8045", "comment": "Malware payload", "value": "19683f4f2329ec6951a118bd9792c64822b0ea6a", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700708722, "uuid": "552459bb-1ee9-46b7-91fe-cb3582747be8", "comment": "Malware payload", "value": "56642a3c5e527a0d47546bfe7bd13bb48de9a19302429580f5ce2909094fcb2afe88c69e477243bd06be464b8dd9c403", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708722, "uuid": "36189411-7a95-42a8-9000-4b9c601e013e", "value": "T15261B0932151B8E9414283BB3D4966FAC07FC264964AB044F78C4F9DF9DDE633A8D2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708722, "uuid": "d36ff7a4-5404-4e27-8fe5-f0a32e7a07e6", "value": "96:P5Gtim3/luSChvDgQfRJL0HAmAiBrVMNZ:Pwh3qvqHAmAiBrV8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700708722, "uuid": "79415d27-1892-4c51-9921-aaecc88dde0b", "value": 3219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700708722, "uuid": "30d40ead-8567-4963-9007-5f47c295f724", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700708722, "uuid": "a675eb95-b48c-4ede-88d9-786c715ef1e7", "value": "pRTxEBSE.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2416b363-89af-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700709581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709581, "uuid": "bf33ae4b-8b7a-4db9-b4d8-3d25a14e8f9a", "comment": "Malware payload (Mirai)", "value": "01722fdc89688e97c8154e2dc84129ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709581, "uuid": "756a8e3d-e19a-4e69-b84f-7df3dfa112ea", "comment": "Malware payload (Mirai)", "value": "d18392e5d6ec49302f833705f3a92e64efaaed160c219c55d4dd7fb0d0dc46ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709581, "uuid": "cf79af0b-0e1a-49ff-bd93-1fcb260beff5", "comment": "Malware payload (Mirai)", "value": "afd4bc1594c179d6f19c4128b7985f76b98a7b3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709581, "uuid": "08e17bdf-433f-4b4c-a2bc-b26edc62d93a", "comment": "Malware payload (Mirai)", "value": "468a711084d934751ea3483c2b0904d82fdc9e5a75c83eaafa4ccb8de98ec8ae96c0ff5322026abe681464005c1955e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709581, "uuid": "1b5d0990-d71e-4be1-a61a-62af7ec23259", "value": "T1DC23F1FB82206536DD553834F469852AA3690EFC44BF3334122F17A477AB19BBB6C422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709581, "uuid": "ab59dd66-c7d6-446e-8efe-99ee300ee64a", "value": "1536:yaHXoPx5RfzkYYswXYOfwCTUJLKaJjwql0jMUVAHB4sP9u:RXsvkYYJ9K9eInhxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700709581, "uuid": "18ab5530-0d6d-4afb-a617-906881bd273c", "value": 49628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700709581, "uuid": "b68bfef0-230f-4482-94a8-59896abe6de6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709581, "uuid": "54258e17-9dde-493f-b3ba-80d872fb3fca", "value": "01722fdc89688e97c8154e2dc84129ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c408d7a7-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700729176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729176, "uuid": "1506a39d-7060-44d4-a30a-cea8e30980c9", "comment": "Malware payload", "value": "a4fd816f1716a930cd5392c3cd45c516", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729176, "uuid": "750ceb96-ef5d-4850-8550-5c0abcc29257", "comment": "Malware payload", "value": "d4c2bc4420ac0f61345ba4da5fc7f7e210bec9bfea27d80fdba8aff7027954a0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729176, "uuid": "889f553c-86d0-47a8-b48f-f3518725bae2", "comment": "Malware payload", "value": "8b34d4d7d9bafb9a4f8ed35dabc1d4a1cecb4d60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729176, "uuid": "fa1fcd1a-b37c-43fe-be27-3b7b0f367ffc", "comment": "Malware payload", "value": "a243114496e79fbae018db37f94f536629a319ed1b324ec1a0884c66b144f540b031b4a27acbd8d092707755171289d9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729176, "uuid": "0aa9b077-78f4-42ca-a02f-6b1a79b5871d", "value": "T195353300B7129F35EB146F34AE998786690EBC24090ED59B8B25A1FC5D2CCE257FDD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729176, "uuid": "da57bfac-6946-4393-8257-ea48e96bab60", "value": "24576:VsZ2a/pV7hjD++XAS7IoA5nAQjoGnUAY5qwHvnnd2ZBmL:PcpV7hm+mooUGnlYswHPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729176, "uuid": "a275fcb9-a835-4d12-842f-b6cff9a42103", "value": 1148951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729176, "uuid": "bf2e79b6-6425-413c-b9d4-6f57a3665696", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729176, "uuid": "d80fa7e5-7ce7-414c-88c4-44f04ff55938", "value": "PO#P18620782 201901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbacc0ef-8a34-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700766958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766958, "uuid": "a68e69b0-be1c-4670-85b9-d9c1d81f3a76", "comment": "Malware payload", "value": "48ac1b6215ad46f1ffacdabd54bdfc8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766958, "uuid": "431a13fe-9048-485d-b242-301ca5ed0462", "comment": "Malware payload", "value": "d6a521156a1057bdd6841bc1879ac6634117e6661040b47a29b76c021f34a112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766958, "uuid": "380b46d4-ae5f-4259-b693-e78c792a98d3", "comment": "Malware payload", "value": "08b8a45858d01972eb6ea0e4380161dc193521c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766958, "uuid": "ea47924f-c161-462d-ac02-81b392424ca1", "comment": "Malware payload", "value": "b93261aaa938c7f59382ef0c99629f2096b0921265c2b32ad6e85d16f0f59b8205c4ada30df6709096968c7b36452505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766958, "uuid": "dc1872aa-615e-4796-beda-bfc5a45569a5", "value": "T1BAD5338BA582E9F6E03B99700D246EBE49EBB9D6747A941C3CEEA44D1F73116100F374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766958, "uuid": "9234b952-b2f9-4dc4-9037-73b61e3d65ea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766958, "uuid": "df4a8021-0bfb-4c91-9aae-7ff41dbd9b0d", "value": "49152:y2YwvLbBL8IQbDbq6hhFiucmUHq2uK3njQJJmgBkVrAhUQCe4f4/fzdedvQRY0E:jfvXBLk42UHuK3jWXWKOe4fWdmQlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766958, "uuid": "35197150-0f69-4e31-8ef6-e726c7c04801", "value": 2881599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766958, "uuid": "88057935-f6b8-46bd-9e99-245d60153be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766958, "uuid": "258c4521-beef-4e43-bc5d-4f19ebe639ca", "value": "SecuriteInfo.com.Other.Malware-gen.4127.21190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b1596f-8a1c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700756503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756503, "uuid": "15639aab-fbd5-4f4d-b6ee-979840cf7af4", "comment": "Malware payload", "value": "f3a1bfbedabe3a2e3c7b40be9994a370", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756503, "uuid": "c3708b84-f43b-4e70-b043-1de0e7d1642d", "comment": "Malware payload", "value": "d71cdb29658782ee869c64ba6b3ebde1c9a88e82f36429fa50fd4f11b018c355", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756503, "uuid": "43276dc2-b504-4628-a7c7-175fa8c48de4", "comment": "Malware payload", "value": "59107ef24a2315746260b11a8fa3aa875f010424", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700756503, "uuid": "6ea388db-14c1-428f-a229-923a35201ca2", "comment": "Malware payload", "value": "904c6c8f12e9a4460767c6effedeef8665aa349853fa550a5e22ac399d9b61c6d451b39763fc83c8d4cac59e8066e4c0", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756503, "uuid": "81694d13-f90d-4186-9db7-2a6c9cbad57e", "value": "T1C4E533A2847E74002F0B9FFBC0D4DC6E9650D5D38FE7F5C276A49E82A0C5FE1498652A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756503, "uuid": "51216bc5-45a5-4ab6-bcfd-7428e95ca0b9", "value": "49152:spa42/tcVJDA7Iv81FGiE8h4ONxjr1ZMgza28PoMmNsbKTH0Ctigh:7CJEU0+iHjNlSIMLbKbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700756503, "uuid": "f5ec246f-191b-47a9-942e-65c84f4592a8", "value": 3055742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700756503, "uuid": "0d3fdec7-0a72-41af-9dd4-3062e93907b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700756503, "uuid": "4986c03e-9dc3-4555-abe0-1fa7e9a20e44", "value": "Information.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5457fee-8a57-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700782087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700782087, "uuid": "a1125fc1-55c3-4158-bc8e-75368d25452b", "comment": "Malware payload (AgentTesla)", "value": "4265979171ef5d57d593985e6a10b011", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700782087, "uuid": "23da5c8d-aa3b-4d88-861a-345411f3ceb9", "comment": "Malware payload (AgentTesla)", "value": "d81e8511ca6925abf689f2f0e7c7ec5b1f14338a66b3329fa38e5a6d7b594392", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700782087, "uuid": "76d92f65-68dc-4f3a-b369-a0012e6f10f5", "comment": "Malware payload (AgentTesla)", "value": "61d08e9ee178aa914894c8a3d6a0e02310cff9be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700782087, "uuid": "7048e0eb-db88-4b7b-b708-a34c38a77024", "comment": "Malware payload (AgentTesla)", "value": "99ef153e09d5d918fec99cfbc45c1bddcbbf810cdd980b7d4cb2bf0449f3a0cf9f1ab19f639e85d29f023cdd65aa5015", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700782087, "uuid": "cb7cb876-b0cb-43ed-b7b2-d1e8d28f77eb", "value": "T10FB5F11B168CFF6DB0297EAF655B180E3152C0D5A6E4E188D8CADF41ACED49C8B771B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700782087, "uuid": "f015596b-2979-4275-a147-3f78171be610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700782087, "uuid": "3991b6dc-ee92-4ad5-bd96-c4c3c3099aa8", "value": "49152:bkx+PU4vtlRtov0OcWfSloZcgTCmVKSBa5:IIPU4vLRtG0OrfSecmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700782087, "uuid": "2222c001-baab-4bf5-911a-6980bc3bad11", "value": 2448384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700782087, "uuid": "8df0cf16-66b1-452e-a474-12207dec89e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700782087, "uuid": "cb991c1f-efaa-4e5b-a484-c4b5ec20b063", "value": "Shipment document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0787a1-89b0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700710242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700710242, "uuid": "3b3052fd-4d03-4cd6-bf8a-4de6bab3a7a6", "comment": "Malware payload", "value": "e5130f4109e8a5be23898e0507ffb6c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700710242, "uuid": "307ee6bb-94f2-4def-952d-bbc0f268bc3a", "comment": "Malware payload", "value": "da3bbdecb70e262a263af96f0b3569bd4b66f4ddf21b24ad1f56040a9896fa2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700710242, "uuid": "1019cf17-b784-49bd-9f6d-b358f734a317", "comment": "Malware payload", "value": "0be2d9d5337e6d1ce46afc3c1beffc5f2b5296f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700710242, "uuid": "1c7becb7-5910-4ff4-9fd6-232d38f4398c", "comment": "Malware payload", "value": "fa09c10424ce44c7cb85043e7666195ddb2af36ee74cc575e99abc3d3ce8ec475505d9645c1f52a0c553b70739c3499d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700710242, "uuid": "386ca2ab-e1e7-4966-828e-9e33f4936036", "value": "T1E805196E62A841E4D0BAD57C8A5AD949E2727D060360EBCF16A4035B3F27BF49D7F310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700710242, "uuid": "a710fbcb-4bbc-4a4a-9f27-8344317da4cd", "value": "7bd3a07deaabefd2bdbf08ff24293e6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700710242, "uuid": "607ac105-755b-49e1-ad13-5ab47eaeb97b", "value": "24576:pXjAq1RaC6ZKusdvlhV9WbFMTwTcq1UtgSEh9k/26Aqkiiv:tB1iLg/I/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700710242, "uuid": "0783da86-dcc3-486d-8b78-9b4124686e78", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700710242, "uuid": "1d09631f-d570-4eac-9a24-68ad585c1304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700710242, "uuid": "f850e5f2-3475-44c8-81b0-c3214e507797", "value": "ZFGameBrowser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2313e42d-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743939, "uuid": "1e6d4ff7-661e-4d04-91bd-06974a9aaddb", "comment": "Malware payload (Mirai)", "value": "67e6f32c5973a6877b3343b0beb53d2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743939, "uuid": "3cad8add-7526-4d04-9ada-006dda019e97", "comment": "Malware payload (Mirai)", "value": "da639b0c59678d506b2e07bd67c92dcc340c8ed2209e987714cbc505be0957c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743939, "uuid": "da13f11b-feb9-47fb-bc41-70f0efe0462b", "comment": "Malware payload (Mirai)", "value": "aa37e8daeb3b3ab8b70c3056e6b7a7c4e41d111d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743939, "uuid": "14a7a620-1754-4a69-8131-d0ba92a3a8cb", "comment": "Malware payload (Mirai)", "value": "d1112adbb9f2f62b881c5be97c59595ecd1e10d9c4a19ed5f0dba3afda5f74fd3e73afc3c56795e8a7580d6678ee2baa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743939, "uuid": "f69d9bde-cda3-40ab-b63f-6614e9886e4d", "value": "T12D535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743939, "uuid": "4ed9fda4-e17c-4b76-9107-bc8c6fbf884a", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8o:N1GjR8EVGO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743939, "uuid": "09250660-63a2-4177-8faa-236cc10f71a7", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743939, "uuid": "6ecdd5d4-8a33-4620-ac9e-93546205bdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743939, "uuid": "d160b444-21ce-4138-9df6-a763abf018b1", "value": "67e6f32c5973a6877b3343b0beb53d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513f4cb8-8a0e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700750459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750459, "uuid": "70b3e1da-4dd6-44d2-804c-b1db74793bdb", "comment": "Malware payload", "value": "f4f4a60d544ab37307714cffb3cf8d42", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750459, "uuid": "4f6e9a80-73ab-4d92-9f3d-c21dba816b64", "comment": "Malware payload", "value": "da6d9c837c7c2531f0dbb7ce92bfceba4a9979953b6d49ed0862551d4b465adc", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750459, "uuid": "2c12c04b-7284-4b02-87a9-da7ff7b6285d", "comment": "Malware payload", "value": "0ce8e3515a78a4a8ccfa1f27feb6ea6ca3306081", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750459, "uuid": "50089a4d-34d9-49cc-ae5d-e1a5ce00bfef", "comment": "Malware payload", "value": "4a929058c157da6cc7b184bce33fb714a08656c80d3461f5ee57248f4c8efa8fd993b9a32d132d2be7ab4970e04c73ca", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750459, "uuid": "1c2ebd1c-dcf6-48ce-8eff-247104d22e8d", "value": "T158B36B17A3A500BBF57A8678C8530E46E7B2B4150B609FAF03A0875A1F673D19D3FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750459, "uuid": "1c27249b-033d-4a26-b5ec-546806bd1d04", "value": "0ff8b58515b3fa045e6bff9a9e0cca16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750459, "uuid": "ba071bc1-1650-4c0e-9507-75822b99692b", "value": "3072:91uNKVtUx7SN7klktpvvuMJD/C88hR4f:6NKVaYdklktpHun88h6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750459, "uuid": "04e3fe5f-75f3-4993-8d56-edeb518de066", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750459, "uuid": "68189fce-4437-45bb-ad74-78d3e98977d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750459, "uuid": "18b22496-92af-481e-85c3-8a6a862637cf", "value": "store.node.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e8e1bf-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700729149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729149, "uuid": "05fbbef9-1842-438e-9bfb-878578fc1135", "comment": "Malware payload", "value": "456b09df4857047b37307e573fcee778", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729149, "uuid": "79b6ec9f-1b8c-4669-a22f-e1d17d4e706e", "comment": "Malware payload", "value": "dab5001799d227ed5eb0103b5250a24821e9da5e1893e2cd69cf60090314001d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729149, "uuid": "dfc3bf4e-2c90-400b-a17f-44df029749e6", "comment": "Malware payload", "value": "6a8f9c7e45037f9001a8590b1eb39a11f7b8c4fd", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700729149, "uuid": "f626533d-7fdf-47fa-ae56-b587d319c6e0", "comment": "Malware payload", "value": "2397e9c54cda9fa581eb85e6697b4f825fa8a6f04ae7ac40b59fed54c140d83465f5294bcebcf0cfea935dfaf4158fef", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729149, "uuid": "03b40c9c-8e11-4c4b-8b42-da8a2d3988c1", "value": "T162F42304CDD10DA207570A17B6BA314299BDD425FF81B8CAED7872DA2634F8C5BBE1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729149, "uuid": "1e40abcf-3ff9-4351-9eff-88fd36d28729", "value": "12288:oRxPc9LjcFnrDTAxZvUX2XXTBFKXqSeubXeBR8B2eRTD/fTq70srz:oQ/oDwZvDzgqSe6XeBuBRl/Gbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700729149, "uuid": "ae0b6410-029b-4478-a9d6-a125052dd1b2", "value": 740435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700729149, "uuid": "ddf7d44e-57ff-4e34-849d-0b57a257d090", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700729149, "uuid": "2d2ae31f-8949-48e1-a522-6d77d76cab73", "value": "proforma invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b893d2c8-89f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740324, "uuid": "da53adc0-7c74-4dad-b79a-b6b7d17ee732", "comment": "Malware payload", "value": "73461871b344c75f77323047fbafd617", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740324, "uuid": "a9ed8afc-f998-4177-a8b7-423ff4a4abcc", "comment": "Malware payload", "value": "dbd04333b7af300fbe8f6843866881403b48711d6380102109dabfdad6ad0251", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740324, "uuid": "45ae84e1-e5a7-412b-86e1-a42b11dcfb13", "comment": "Malware payload", "value": "2a7860291499b27b133fe538f792173d7fc93de2", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740324, "uuid": "54259d9e-f405-4ed3-97d0-430edd643bdc", "comment": "Malware payload", "value": "d6a7a1c0994b530e64d7f21762be50f48f06fd4c34ea508514875832cc4166859b81b3b98c0be8c90c708f0f8ccd5132", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740324, "uuid": "9cda6541-d17f-4f59-9249-28b89acc1536", "value": "T136D023084D48C365C18214275058FC88AD0DB40C15E5C4481281DDC75C920D2DD48AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740324, "uuid": "b4d97763-2039-4089-b5dd-e027127af7b2", "value": "6:HRYFJb5n49sZOA7xqGgoAEvyc1yc54vVG/4xHn:HRYFJuGxXgovvhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740324, "uuid": "d028d297-bb87-4ae7-ad56-086c524717bd", "value": 201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740324, "uuid": "6d2e08be-585d-4e9d-ad42-870f83231016", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740324, "uuid": "98490e64-d999-46f6-b496-212f4faed231", "value": "Order_Information url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d75eef-899b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700701044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701044, "uuid": "2f50125f-1607-4077-83c8-5e21aaf3d570", "comment": "Malware payload", "value": "7a71f18bc5b6c6a24afba51af9c42fca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701044, "uuid": "bae39c29-c2b1-4245-8f63-cc28032f0d99", "comment": "Malware payload", "value": "dd0ca55d04900420dcea0f0501697391de7dbb6d185ae23ae7703a823b62c651", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701044, "uuid": "a412697e-b63b-4754-afb9-dbdf23999d63", "comment": "Malware payload", "value": "582000b0fab459b7a197bc4f9a83446c3a4228af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701044, "uuid": "36c0b914-fd2d-43dc-b110-838954d645bc", "comment": "Malware payload", "value": "c710f66ebfe458dc1379fe9239a2a187ecd4cfcf28257dc8b78e634db73f906d42b1860a2b37229cfcdefe66ae31186b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701044, "uuid": "12bf8d62-2b74-43eb-819e-af5f77b1fb02", "value": "T14063D506FF600FEBD85FCD3305A8470139ED695612B87B397A34C928F65A68F16E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701044, "uuid": "fa2e1187-1180-4e15-97a0-edd2eff631a2", "value": "1536:l5tQgNiHpeAIfoblgnsyxZqupSspnE0u2:l/QgNiHJyxrLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700701044, "uuid": "4d1d6ad2-4711-4857-8954-a75d7a4344df", "value": 68328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700701044, "uuid": "05ee6718-2875-4044-a762-4192179c0b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701044, "uuid": "ea9eca8f-fb3e-48c2-89fa-2c60c4bee34e", "value": "7a71f18bc5b6c6a24afba51af9c42fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fb42be-89aa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700707522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700707522, "uuid": "9f16765f-6fe5-4787-9138-b777cae0eeaf", "comment": "Malware payload", "value": "7d218c92d87e3bb44da5b0b54b27c69b", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700707522, "uuid": "97b4984b-c909-461a-a85a-f82845e5d5ed", "comment": "Malware payload", "value": "ddde2b7bf9b8272efc367ff0a32f9195b38f81c103c64d1773994236f41aa861", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700707522, "uuid": "f5b1b654-aa53-48bb-8967-7ab5843d59a7", "comment": "Malware payload", "value": "e75870d6a082d12abc9820eb12efb33f4e55760b", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700707522, "uuid": "24d8c69c-7e3b-4a00-9e8c-d1d02571f702", "comment": "Malware payload", "value": "0e7548bfe096ccd37f705619cf136e528e412f603db0b8ed65cee873705d25c5c6048007a01437a3cf9253f2e48b1b52", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700707522, "uuid": "8d5a2ef5-bc68-46b1-8ac8-b92f13acc1a9", "value": "T1D661B0932151B8EA414283BF398A6AF6807FC224954A7044F78C4F9DF9DDE63398E6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700707522, "uuid": "8c6b11fc-cec2-4e5c-9ea3-8e700d556b1e", "value": "96:ZGtHGWeafuSnWvD+CfRJL0HzmAiBrVMNPpb:Qhepv4HzmAiBrVOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700707522, "uuid": "88df6ff5-fce1-40aa-a6ab-6f7089c32f16", "value": 3242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700707522, "uuid": "778d4608-8ad3-4870-a2af-ecb9003f7cc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700707522, "uuid": "26f2b3a5-040f-4e73-acf6-befba54942ab", "value": "NNzDMQ4j.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5020f05c-8a3d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700770643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770643, "uuid": "8b42a165-ae76-498a-8f75-e5c6a5cf1d05", "comment": "Malware payload", "value": "00d29c37a53ca59af768c9d9c9321b2a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770643, "uuid": "1299df61-c3bf-45bd-85ab-d374633beddc", "comment": "Malware payload", "value": "ded347e71ccba17c16b22e9fa9f9e273444028fd10383608802afbd26634a33b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770643, "uuid": "dcdd8455-f268-424d-ba03-5bcb617e149a", "comment": "Malware payload", "value": "880a6bbf964d5bd55e64626cfde58ae0ce1aefbf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770643, "uuid": "58a061fd-192c-406e-906a-9f174af55cae", "comment": "Malware payload", "value": "1df227d67977192f2e0389f15c966e595ccc6ddf7eb7bc3b6ab9b6dc37a7d461fdd88fdc64a30fb708c9c4faf6b5a22d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770643, "uuid": "9ceef6ed-bed7-41b6-9b6b-fb35ae3d0801", "value": "T196767D13B384653EC15A0B3A5877B658A83FBE713A128D5B77F4188D4F359803E3A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770643, "uuid": "7ed1d22f-57f6-4308-a7d8-047eb15342a6", "value": "99bfc3e418c7e413a6aa6cdcfb33d033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770643, "uuid": "17a8032d-3c69-47b2-a418-c03a3be89052", "value": "98304:UgXyb48cJTaImS2diE7i8DAc39yOTHo6:UO5JThE7PsWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700770643, "uuid": "da52265e-77bc-48d6-8329-3f256a1b2318", "value": 7736832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700770643, "uuid": "9382f182-d940-499c-b809-b66136b07847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770643, "uuid": "1ca67023-dc74-4c77-8711-6e853aa9db8a", "value": "SecuriteInfo.com.Win32.SpywareX-gen.24906.23118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1146f11b-89dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728877, "uuid": "dcdfec2e-8428-4319-9c1a-b63666849dbd", "comment": "Malware payload", "value": "a533309e670d68278902832955843a12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728877, "uuid": "e2296e22-476d-4a38-a026-7c5a9ad95f9c", "comment": "Malware payload", "value": "e15ecf041e0caea3ddc97827cc8454d7593da356d12b9d3f7462d7d119437f6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728877, "uuid": "43eb5658-8ed3-4100-983e-299b9b63fd70", "comment": "Malware payload", "value": "1faeb0b315ba0a26f787823a9c7c364c19d359d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728877, "uuid": "8e5cca74-e6da-402e-96c8-a8c17eb08786", "comment": "Malware payload", "value": "c5e8fea31025e1ac8ac4721488acc7e0fc422b9fe38aa2941e9054fd43e5ea89fb590971ef3017b4c0e2f62d59ef6293", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728877, "uuid": "e650f457-e63b-40bc-9c3b-3937559e666b", "value": "T171340F037E88EB15E1A83E3782EF6C2413B2B0C71633D60B6F49AFA614516465D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728877, "uuid": "aff5d510-72f3-4676-ba3a-d1232487293d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728877, "uuid": "e654cbe5-c5f4-4cad-a738-9da56976453c", "value": "3072:Z7IJlxVZYfngNl9Ctyw0b3M0ZTMFdakk+0UUJ55uXCu3z:Z7IJlxVZYfgNl9CtD0b3BZI50UUJ6CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728877, "uuid": "223d2686-51aa-4c70-a655-d0e3926a6409", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728877, "uuid": "f0affccd-b8ee-40f7-8f7e-b2b02babe591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728877, "uuid": "89433505-9627-45a8-859b-4a2ca00b7396", "value": "clouX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c6a2da-8a45-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700774337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774337, "uuid": "2721f0e4-0853-4974-8e16-f2553cbd09ba", "comment": "Malware payload", "value": "e1534429737b3ce7fb60a690024a3163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774337, "uuid": "d2eb854d-6c5a-4c22-957d-a7fe0607ce6f", "comment": "Malware payload", "value": "e1d6351e41826f72ff10e05e8f888114afeb9fdb4f14da96505ae647da0587ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774337, "uuid": "327491a1-d67f-43c0-a78f-6f344118d1ec", "comment": "Malware payload", "value": "982cd470e8626f53e2b1a2b203d55679933aea5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700774337, "uuid": "d22930be-dd96-4cb9-98d1-2c99f8e52245", "comment": "Malware payload", "value": "133df8199fc9b04765d2345fbf8a9a53fcaec649933564e249dd87f5666f0402ebbba4a8fa3e61229126163ef97e72cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774337, "uuid": "60fd5856-a8a7-48db-9f6f-1c8dcafa0290", "value": "T1DDD5338BA582E9F6E03B99700D246EBE49EBB9D6747A941C3CEEA44D1F73116100F374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774337, "uuid": "eeeebfb4-ee69-4438-ab85-65a2b73e87d3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774337, "uuid": "22e8fa7e-e83a-4653-99ba-f5ec682465ec", "value": "49152:72YwvLbBL8IQbDbq6hhFiucmUHq2uK3njQJJmgBkVrAhUQCe4f4/fzdedvQRY0E:SfvXBLk42UHuK3jWXWKOe4fWdmQlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700774337, "uuid": "c0abc593-9f40-4612-a697-ccb620ba0319", "value": 2881599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700774337, "uuid": "e61ae00f-8267-4179-ad1b-99c6233074ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700774337, "uuid": "95abd1f9-871e-4002-9716-ee99d9c51836", "value": "SecuriteInfo.com.Win32.Malware-gen.24677.4029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6bfc7a-8a0a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700748786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748786, "uuid": "00deaf71-9c10-4913-98e5-d5019e81bf17", "comment": "Malware payload (Formbook)", "value": "a9bb1b4980d800c44a933042e44ad817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748786, "uuid": "18d64d87-7d57-447a-9232-ef4875e34a5d", "comment": "Malware payload (Formbook)", "value": "e25813355973b74df19beb6d26d417047940d516a0e7636ddf44d24011a32b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748786, "uuid": "48d890a6-abcf-4663-b40b-aa36a8a2af2e", "comment": "Malware payload (Formbook)", "value": "17c3df6978fc5dd168bdf9a4dafb7f9b0ec4023b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748786, "uuid": "9ddd38cd-9f8f-482f-a159-68aeeedd9cf9", "comment": "Malware payload (Formbook)", "value": "6f9240cc4e0d5b1ecfca04f365ef48bee30df125806493ee5590a982da2da1261da4e4de695465ad21125a58bdae8b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748786, "uuid": "bb08b2b7-9661-4649-bbe0-3d824d77bf92", "value": "T14C635B1D2F9EAB12C7AD477F84D3B6814378D4B2A347E70B79C8522688263DB5483B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748786, "uuid": "30b884b0-759f-47a7-bdfe-01febc50a807", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748786, "uuid": "e9341a0b-1f68-4343-b100-4d1f88c60414", "value": "1536:ANjU0ptB1Ntj/dDKmJtW55NvDwhVc+w98XyF88EhhfZs:Q1B/dD1JovoNXWUjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700748786, "uuid": "93107d3d-c21f-4a00-8927-3f6bb78a582f", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700748786, "uuid": "178303cd-c1b1-4c7d-acb2-6d1099e55343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748786, "uuid": "d7be58f6-200b-4eeb-aeaa-68a8fe8bcbfb", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a52d788-89ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743924, "uuid": "7b5e8828-f142-4408-ae1b-d2355f555ee1", "comment": "Malware payload (Mirai)", "value": "b8af5260e65e41f166dd5f117dc805cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743924, "uuid": "b0a544ac-58fc-41ac-855a-60e492c47257", "comment": "Malware payload (Mirai)", "value": "e4a19bf32b909def36f60e9c435c3b9b93b6a01273707544f9d9bcf7e3a066e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743924, "uuid": "edce91f7-3ff0-4494-8347-6bb65ab975da", "comment": "Malware payload (Mirai)", "value": "9e4652db9137802cba0eced530c66cc7f35da16a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743924, "uuid": "27ecd12e-0f56-4df9-9f6b-9bebc2a14970", "comment": "Malware payload (Mirai)", "value": "91ab1fe4ed1c2eecc56aaf917e8c60810c68fef336e2ea595f376279b6fcfbc159e193957f796ffa972bb5e40617e13e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743924, "uuid": "d594457f-75f2-40d9-adca-9035f4a858a3", "value": "T124D2D08876D363F6CC89CA7EB75E103A30AA78A5A7B29323B305D4134775140E695E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743924, "uuid": "1a958135-443d-4a31-8d05-3244b97d9353", "value": "384:MJd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKJ81dHLTNd:+lxKd29WcxEns+V6IHE4RlY990081iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743924, "uuid": "72c219d0-ae2f-4cf5-a4d8-e68972a8675d", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743924, "uuid": "6cb70d81-e4d0-4758-abfa-d6d5e1e0bcee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743924, "uuid": "21c600cd-b722-431f-952f-fa37e479e2ae", "value": "b8af5260e65e41f166dd5f117dc805cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d776de6-89e6-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700733165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733165, "uuid": "f5d698fe-6267-4620-90ad-6455f52b7706", "comment": "Malware payload (RiseProStealer)", "value": "9a6b040c3a98f5bd9e67151bbd72cb05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733165, "uuid": "695b91b4-2e23-4cb6-a5c9-ce03caf52df9", "comment": "Malware payload (RiseProStealer)", "value": "e5371c51644ac5e5da7c40ffd924b45cf7b73c45a9f42aded262267e1d260483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733165, "uuid": "57c00fa9-02f7-4259-876d-c2d18aae3ad8", "comment": "Malware payload (RiseProStealer)", "value": "2b561ed99f4e8e98ceddd15426d37f6489453b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700733165, "uuid": "1f578932-068a-4349-9cf3-b7e00e3b5464", "comment": "Malware payload (RiseProStealer)", "value": "3702766053c9da53ca3473336cec7dddc2bc56ce5dd8a8b1871d6e23b3491db956a6e071b750b0d25cbf0a008314fd0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733165, "uuid": "9964a6a9-8851-42a1-bcaf-2ee17e4c7b92", "value": "T16F559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733165, "uuid": "494d96d6-0ee1-4d78-a1e4-d1e8561d58fd", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733165, "uuid": "d9d55349-c4c0-4785-8d88-3ec76caad078", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700733165, "uuid": "9083395f-ff1a-4b01-b891-7575529d1ec9", "value": 1322293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700733165, "uuid": "e9543c93-17c8-4413-9df4-f4a589789e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700733165, "uuid": "63b5d0ce-7fbd-4422-abeb-10137d7f968e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f95650-8a4e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700777973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700777973, "uuid": "b7df8cd8-49ca-456c-8e77-1321dc1d0f06", "comment": "Malware payload", "value": "e2807b7e3d4628cfe40e6ac14d2f0f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700777973, "uuid": "f43f36f1-f875-4538-a3bb-8d00e84b835c", "comment": "Malware payload", "value": "e5bc993b2d93d3677373595e2c20a707dc6bff9378d0b24516bf99097b30be0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700777973, "uuid": "33163c86-a5ed-44b5-bded-b50d90f21704", "comment": "Malware payload", "value": "365e61ccdb992b82a5b82627fa426c22c7ce5645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700777973, "uuid": "8674221d-f38b-4ea0-8634-4ccec4513680", "comment": "Malware payload", "value": "4063cab09814b61f2d56bd72f20864d97742399683f482f875ea97499ed628b58a87813b2103ea9d9716780e8ff5f109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700777973, "uuid": "b8829aea-581d-4e14-b6a5-a2ac60f4f766", "value": "T1B2D533567AE38D36D23CC8744FE5A80BD7733D4BA831925015981785EBF21A0631DFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700777973, "uuid": "e917ab9d-e36b-4390-a71d-42f20310e261", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700777973, "uuid": "0e0b907b-e9e9-47a3-abbe-e090b2ee2b07", "value": "49152:U2dKgqFC/iTqHv7bb9NfQSvzZxPQUlsMuiRPzGjNBi+tsvDcRY0E:5ARFpTIXhJ51xlax/7TtsvIlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700777973, "uuid": "e16e7aad-7460-4c84-8485-0474882d47ac", "value": 3007652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700777973, "uuid": "984d972a-67f1-4ce3-829a-1f99f87e424b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700777973, "uuid": "aa68f877-24ad-420a-a43e-15f90013ef94", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.31493.29164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6e486a-8a41-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1700772570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772570, "uuid": "f42cbc81-ed2b-44e6-a2c8-605efe73a1cc", "comment": "Malware payload (AsyncRAT)", "value": "ab2f2488a65aa908474611a4d03153ec", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772570, "uuid": "2494de52-f5ae-4a78-bd9d-672a51227b52", "comment": "Malware payload (AsyncRAT)", "value": "e636285af8ded86584e8ea13e980d1121e445dba6567247fb63191470071de88", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772570, "uuid": "cd102bc5-b74c-4671-870d-7e39816192f7", "comment": "Malware payload (AsyncRAT)", "value": "400f55886eb4c470cadcd0ac0f3c88e0bb948d30", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772570, "uuid": "5f7dd2ac-dc55-40cc-a8b2-63456351b2bd", "comment": "Malware payload (AsyncRAT)", "value": "72a61fa059faad7ce23021ef134bbd26ebed346629a9f449ad9615dedab5a8adac91c3dcaa4bf7975ffa414fe0521d04", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772570, "uuid": "d7f420b8-77c4-459d-a616-7fb9d7a4e36e", "value": "T1D4056C15245C3E8BFD7F043A4AAA772A5FC8B086F97C02D41C7B91901ED4379CAAF646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772570, "uuid": "89fc54f9-3543-4fe5-921b-145a837d2895", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772570, "uuid": "2bd99bfe-ba54-478b-98ae-72bc06b39943", "value": "3072:W/EpIXV6ehRayOtIYmqafWAin7y0ON1qh/:5EVpRitIqF7yRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700772570, "uuid": "83445160-9d1e-4dac-8e41-f7a3687a8818", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700772570, "uuid": "11f167d9-279d-4e8f-8028-583e432b8cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772570, "uuid": "c6099074-4fa1-47b6-8a54-b86dc5a72021", "value": "jhsd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716b547c-8a0a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700748795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748795, "uuid": "2aeef436-fab7-4ab6-b110-f04a28146538", "comment": "Malware payload", "value": "8fb19c3d4cb103c9c135b8cb66a3b69f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag", "colour": "#63C77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748795, "uuid": "5fc48d55-cab6-43d7-a27e-52c8ffe98d70", "comment": "Malware payload", "value": "e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag", "colour": "#63C77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748795, "uuid": "928d4e3a-c89c-49bd-8bdf-1405546534ff", "comment": "Malware payload", "value": "b16e6b15410da8ec3e35fda27d6950faeecaefff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag", "colour": "#63C77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700748795, "uuid": "7f0f3e33-d68f-438a-8c9f-17a36f14b8a0", "comment": "Malware payload", "value": "7cb9bd8b802c46a71cfc9d46b56094de54f7e61326a604db02701aad2b739d3dfebf6f1be231127d25bb1ade315a6bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag", "colour": "#63C77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748795, "uuid": "4321e4b1-6fef-4b29-a0a3-bd585195c6b9", "value": "T1B8458DB3235486EAE3DDC070AC4B56E504B6691BB33BD9CF468AF80D4725270B9B4D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748795, "uuid": "8c340389-3d73-45fa-b40d-3863648e2da6", "value": "941b14ac8c6cf8c34e5cc4fc6aee1bb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748795, "uuid": "426436b4-ae79-4b65-962e-c483e5745a4f", "value": "24576:GbypZzt2/HBrpbIQPl5JDM/8qb3Ma1zQYHRgR9Vj:Guzt0lP5wf1caSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700748795, "uuid": "133d18ca-5dfd-4de1-805e-61f4d5a3fb7d", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700748795, "uuid": "a325b2b8-c263-4828-98ed-011a9eb7ca70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700748795, "uuid": "85d1d345-fae9-46b4-9b28-ee380756db58", "value": "documentosvehiculos.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4d401c-89bb-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700714965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714965, "uuid": "c0edf35e-1edd-4c3c-bcce-ab9096fcca83", "comment": "Malware payload (RemcosRAT)", "value": "bca53145dcdf0a4d49cda6fdadaddba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714965, "uuid": "6a51370a-393a-4493-8e3c-e4018f5851c4", "comment": "Malware payload (RemcosRAT)", "value": "e804947286d19d565add00988db1b2380207b4b1d8781ced6cc2956b65fcbe13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714965, "uuid": "766ef0ab-9e90-45e6-8160-fa6195bd0b87", "comment": "Malware payload (RemcosRAT)", "value": "ce5ed024d277c310daa9ab8a1a5eda68c474f90a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700714965, "uuid": "4849ac62-7532-43de-9df8-c4b26a5b3fa2", "comment": "Malware payload (RemcosRAT)", "value": "bcde06fd810d1c6ac07d63aaa375034a90ff486e96ee78d72697e3bca6de4f043b4686452e1508d1be8129c63f8c53f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714965, "uuid": "54f2eea5-b07d-41c6-a8de-cec3cb2a3bbd", "value": "T1F6B49E01BAD2C072D57514300D36F776EABCBD202826497BB3DA1D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714965, "uuid": "9d945cc1-4390-4d3c-b319-c3da4779a2cc", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714965, "uuid": "72438b3a-7bbe-477a-9446-3fddfc3a6618", "value": "6144:+/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec787ov:+/uPq3AfK496Gw0lwGXN3pvs/Zut8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700714965, "uuid": "882e8cc3-91f5-406a-a1f3-678ffb5a939d", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700714965, "uuid": "e7b22d7c-628c-46b2-88ee-7e5abe52dfff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700714965, "uuid": "443d421f-fb1a-450a-838f-44edb0e4af5b", "value": "xYXfaeD9JudR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be986acd-8a3b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700769970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769970, "uuid": "c22dea8b-ab25-4417-9c18-c620dddd57b7", "comment": "Malware payload", "value": "4a6cbc09917c9cd3f0ffa5d702cb82f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769970, "uuid": "e788f060-4ef2-46c5-b488-28fded575708", "comment": "Malware payload", "value": "e919167dfba17e22e02304ada47074e340ea51bd2ae08378f0cdf99468c0bfa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769970, "uuid": "7ccf2563-b1b3-4eff-9af4-21ac3cb543e5", "comment": "Malware payload", "value": "bf4dbc4e763c9de0d99264537f307b602d66fedf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700769970, "uuid": "1772cc85-4fa0-4e3e-a5aa-c8d73d8893a7", "comment": "Malware payload", "value": "ec6f51dac94bbf6fa65f7b3fee3b39ba60674da17463bc56947f48d4d202993fab9d02267dd2ca674b26cbefb17531ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700769970, "uuid": "b40dfae9-6a4e-4adb-aaae-58b0963bebe4", "value": "T12B62B5252BF8C576F57ECE3189E168847B7ABA076915CD1E0884110B06733928FE3F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700769970, "uuid": "601fe2db-3904-467e-925c-ab02156f2ce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700769970, "uuid": "5828d043-af50-4fdb-ab47-42dd9c6d69db", "value": "192:vp3E6vaHl/DJ19Zu2fNYCRpUG/qPyVIVMZBefWtpW+n8WF:vp3niDv/fNYw2GSPyVIVpfcpW+n8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700769970, "uuid": "7499760c-821a-4a70-bb3c-fcc26a3f826d", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700769970, "uuid": "62a47e4a-ed31-41e2-a381-5c1b3e429fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700769970, "uuid": "bed6a63d-1ccf-43c9-8c1e-ac5bd7ce41d5", "value": "Microsoft_.NET_Framework.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423866b6-89c0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700716933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716933, "uuid": "87ce9d72-77c0-4d58-b1da-614cc13578a3", "comment": "Malware payload", "value": "fbfbadacf7a4c8bc252021dcf719e9b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716933, "uuid": "319654f5-dcea-43af-aca5-cb448778d580", "comment": "Malware payload", "value": "e9f765ba3c25951e6d6ad8d13133c569862ae77ccaf65de7683c3d40c903cf90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716933, "uuid": "4643860d-abcb-4f1e-b3cd-f9b7b8dc6d40", "comment": "Malware payload", "value": "af855ddd1a0157b9edf432bc81fbfbc44edd97a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700716933, "uuid": "5527d10f-6fc1-4b10-aa08-5bdd8d831351", "comment": "Malware payload", "value": "e0c7b9f291171496ee29c91f2f9b61a67cbe3448e0dab8a1b164e0a161b917dfb9112975bde7ab075f3a3cf2fceffdb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716933, "uuid": "dad5f6e6-e307-441d-a2c5-c8a79b99d2d3", "value": "T1673633F39C025943C961ACF4D301958D69BCBFAD6E34D82A829427FD8DFCD4A7911E09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716933, "uuid": "c8198763-d25d-4240-b165-bfd3f34775fe", "value": "fd9eeeace25d14a32630a51938da6592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716933, "uuid": "47824958-638c-4e37-9459-5fc73e487302", "value": "98304:XsOcGj2RJmXvKp14A7HrCaSMlz+t8WdWfz3dqb8XPM6pZwpydRxJCe4eeMcfr1Wn:cOcdRwXviaAzraSYR6z3Q8zm6xJCeCcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700716933, "uuid": "6e79ff0b-d035-4e19-abef-caf7fa4a8088", "value": 5348352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700716933, "uuid": "6f3d9be1-10d3-4e48-8200-75a73b47dfa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700716933, "uuid": "45a3e816-7d60-4e3d-974b-a5aefbb34fbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b035d811-89fc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700742887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742887, "uuid": "d1360115-486d-4504-a981-c96bc5dd42fd", "comment": "Malware payload", "value": "50771538605cb6f25f1f6a3b2308c74f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742887, "uuid": "1d3552f9-0240-499a-b09f-c0d2cb4b27a1", "comment": "Malware payload", "value": "e9fdf47496f9c18b384c875b0ca6866df1074b2981e0ef95a4d9d01cb824b275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742887, "uuid": "1e68ea9f-ee52-43d3-b7fc-423331732695", "comment": "Malware payload", "value": "3ecc10b46e40bbd3bc2266891b291045c9a7b7ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700742887, "uuid": "d0c54b53-20b8-4d74-ba63-f5121c475607", "comment": "Malware payload", "value": "8505a58ba8e5e71310e876e338ebe91f573a5095db6777cbe6136c4296f37f5a9e8f503dca940a550a5d0547a4cc2dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742887, "uuid": "ffd86ced-1ba3-4e8b-b36e-c1cb9dfeae25", "value": "T1E0546C1353E1AC21E1274673AE2EC6F4A71EB9708F597B9B33196E2F09711A2C173316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742887, "uuid": "dc702234-aff1-46f1-a732-db383882a963", "value": "23014caea44efcaeb50f542fe1b4a832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742887, "uuid": "51c531c1-c92e-49e7-9d8b-a36aac38473b", "value": "3072:0b0j0jWBL02yrKO34ds0g0KENt7+09wWPGUrXIxsdjvt1Zq7:8DiPye4T0gDEN997PGhsx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700742887, "uuid": "d70d050b-457e-4e8e-b49a-390391db06ea", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700742887, "uuid": "dfe46481-ce34-4787-8326-71efec56595a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700742887, "uuid": "96aff40b-f13d-4e0d-989c-b8b911a55bff", "value": "SecuriteInfo.com.Win32.PWSX-gen.20133.7621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cbc311-89d1-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1700724242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724242, "uuid": "2cd301ea-7c86-4c2f-88c8-7238a96bcdd9", "comment": "Malware payload (GuLoader)", "value": "c129259f0f6e5f84f2219fd1e15c2d42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724242, "uuid": "e374a2b6-b578-4c00-bb4b-1b0fa512928f", "comment": "Malware payload (GuLoader)", "value": "eb4c556151199591ad7d51bd5302b385284c98083711bcb9674225c495aea26a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724242, "uuid": "e7b0d599-3ad2-4275-9996-21f8b61c5509", "comment": "Malware payload (GuLoader)", "value": "df75f69475197357f81df6d7f183d6740b81c5f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700724242, "uuid": "9eebffeb-358a-45fc-b528-aad188ae11d4", "comment": "Malware payload (GuLoader)", "value": "484ba5d59b0c9e00896cbbf8b79240f5ddea4610f7332abf6118184c7435716f0f2c9a6f6835c6106332a1d4e03f3631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724242, "uuid": "adc6eaed-8420-482e-b729-4321990d109e", "value": "T1502633037634EB67C61C497349B112CD1723AEB122648E5DF7983EAC7DF6BA35402A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724242, "uuid": "30c7d535-ddf1-4a8b-9a79-c969444d3f64", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724242, "uuid": "20589f09-7b90-4471-8ab5-5199e73f5d13", "value": "49152:vH7OO75f2R6Hjz40wOUNvzsaSSq7tceaMget9WD5W5VN+JCuyz9p7kuc7ioYRpud:jfAEHbwOGz5ytu/scOoYOQ0q3bYhdxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700724242, "uuid": "38616a11-48e6-4f68-ae0e-d146bbe66ab6", "value": 4545093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700724242, "uuid": "581ba41a-1de2-4002-8d78-8fc79e4eea77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700724242, "uuid": "51916e69-4c23-4a3f-8a32-ea0c3d4b71a8", "value": "c129259f0f6e5f84f2219fd1e15c2d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe38447-8a29-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700762214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762214, "uuid": "668d92be-3789-4a79-8866-7a530ff045f7", "comment": "Malware payload", "value": "0304284cb03d1ec6c05fb2197eb740e2", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762214, "uuid": "5e94f036-895b-420a-84f1-be6d69e11bd5", "comment": "Malware payload", "value": "eb62cbcd6427a9443818b4a219020f691bb164eb977c6982a7bb3da10abec97e", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762214, "uuid": "7ca91c65-e6fd-42fc-865c-a63d7bdfa39e", "comment": "Malware payload", "value": "b4efa6f1ddb0c2406283a40d33b83b1b881e74cf", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762214, "uuid": "9f8d2ff9-6292-40f9-9073-f73a63fbebd7", "comment": "Malware payload", "value": "99f08ff57eb3f108f87045125485633c33dd058f5b181e3845fa9254578aae857edc64e46313deb6e1bf243c6028e1a9", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762214, "uuid": "d8b1dc81-4c2a-47b6-8ab1-30c3b0ada229", "value": "T11BF4014177BA8F25CABA67F66821510143F6B4AF9175E3498DC330EB1B22F411E42F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762214, "uuid": "7ef9501f-8002-41c1-9b7a-bd51a664f66f", "value": "12288:I1CFQJLXGkJlXriR3bYBotuy8QYMnvso3OUgVZ4lIVIZGmuTRMh0Kz+g2Ehq2daQ:I1CFQl2k7XQrY+38anUo3ObZSYRMf+gJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700762214, "uuid": "43ca2413-ca79-4593-bfec-14e61ad33d04", "value": 756006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700762214, "uuid": "067f1951-1910-4160-b9c0-cb9289967cc9", "value": "application/x-ms-wim", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762214, "uuid": "cadcf75e-e2bd-485d-9490-8d7439bf0a3e", "value": "Shipping Document-26SHEIKH-007.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1756e2ac-8a19-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700755086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755086, "uuid": "a8d0cb8f-96b1-4dde-8b7e-05138b5121b8", "comment": "Malware payload (Formbook)", "value": "6ce870a87a39787ab4fa77da3fec640f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755086, "uuid": "4d3b56a5-9898-4ebc-83e2-d62bad7c1750", "comment": "Malware payload (Formbook)", "value": "ebaa05165e9a04e110a016a74016effe016f9e19c83fc73f25ed6b3c49db40d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755086, "uuid": "40d12a61-0427-401c-8d5d-928250a32ab5", "comment": "Malware payload (Formbook)", "value": "56884811262008dd1d364d2b9cde2383ae9946b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700755086, "uuid": "46f3fcd5-bb48-4c9c-b149-fd18bd8a2497", "comment": "Malware payload (Formbook)", "value": "7d053a2af2cf1a7e38c01f3872752b88a258c984a70c0856afb5e4fd8ec0a162c157335082111a283c708dcfa0c3bcc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755086, "uuid": "bd4554cd-99f1-47f4-b02e-ae223833953c", "value": "T174D4230268A45B31CC6673F3CDE1269DA3B2D85E5A66D79A4CC530CC2DB370147A6FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755086, "uuid": "39c5fc85-8e6b-487a-8ee4-4894bb1a49f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755086, "uuid": "03b8d4e6-c0ee-4164-b123-3599ebc11dc6", "value": "12288:h8oU24xPyMrknWwli74hhYglFSXQDZ3B5tQrS5ninWzIGWJ:afxnkWw41gHSXMZntQrKedG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700755086, "uuid": "bc933066-07cd-44cf-b0a4-d14f7edee3c4", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700755086, "uuid": "31d9e5e1-de45-45a1-a4a3-24569ef83edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700755086, "uuid": "7467ce84-2176-4244-a944-bdd7b08288fb", "value": "rRICO0928-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31591dbf-899b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700701013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701013, "uuid": "d7ca3c08-867a-4359-a7c6-1d4d71105710", "comment": "Malware payload", "value": "fe02d953d674b982b4c4c7a719619a39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701013, "uuid": "92c8ee13-d4c2-42d0-91ca-ba15de5d69b5", "comment": "Malware payload", "value": "ec2551ec5bca2656dfcceb2a90b5f59e9454b3b634ca4b0c77debfc0a921bbf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701013, "uuid": "8bcdb1e4-7a10-4261-a550-ff6ac9b56a58", "comment": "Malware payload", "value": "eab7801da131d93a81b816009cd2b29f491c8bdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700701013, "uuid": "7ce8c6b3-8006-4385-8538-32b8d558b7de", "comment": "Malware payload", "value": "43cacd802ddae058ab5d52fcdb04ae7aee616c24652357064f73097cee926613ad7e2ed6465697fe50bc6b28fb22ac09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701013, "uuid": "28403f3a-a78d-46be-965c-f711ce404750", "value": "T11F332995BDC09662C5E416B7FB5F028C7B2613F8E1DE731299159B7037DBC690EAB001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701013, "uuid": "b2010fb3-f80c-4019-821d-b2d2ae1d6bdc", "value": "1536:jxNVYbff5BVqArzO6o9AJG9v8QIWCLZEMb+F2McpWgM:jnVYbff5BVqArzO6o9AJGl8Q2Lj+8MXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700701013, "uuid": "2421d104-6c83-4a92-8472-fc2d11adf0a7", "value": 50628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700701013, "uuid": "9dbe8c78-9bc4-498d-9326-ff44384f3b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700701013, "uuid": "fee2aeed-a322-4db8-a871-a986e86d80e1", "value": "fe02d953d674b982b4c4c7a719619a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310674ad-8a11-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700751693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751693, "uuid": "a4ca19f2-6f62-4084-96e7-3ba26c72bbfb", "comment": "Malware payload", "value": "541f3c6f49a3917a4ce34e771908fd68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751693, "uuid": "dbe00d5e-512c-4b5a-95a8-f0a842565f96", "comment": "Malware payload", "value": "ec29b63df59478900b6cfe8c6210cc535007df37077c8509766deae30ed4a7d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751693, "uuid": "bac9a3e5-10c0-4c3d-9c25-7cdf428da6ea", "comment": "Malware payload", "value": "66c7f3be9c1a695fcefdad8ec9425a708747697f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700751693, "uuid": "92ecba63-df2f-4add-8e07-1b0d21da2853", "comment": "Malware payload", "value": "3b5d6b4010c3e9c54ece95aecd9407df2b6f74ecb69d3f1a4743714372aca79e512899c483afaf7220a17221978c3357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751693, "uuid": "e541920c-333f-4d79-ad3c-1c51562bf9c3", "value": "T1C6161712AA968225D47E0475CDAA52ED53307C285F104FDB63C87A3939F32E17E327AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751693, "uuid": "bfad5d1a-cba8-4dff-9954-0c763a883438", "value": "6805b9d9f17bc82a9e79068d20b7f163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751693, "uuid": "c772eee5-6148-425c-bdf2-5d2f39f11f59", "value": "49152:97tar2G5DcOZgeihWiPBZGugXX37tv/UaSeGDEDHbsk4aXIMg2hyg/mWc2LbG/k8:Ta6yDcetih/PBZGr5HxIsorr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700751693, "uuid": "c489b6be-440c-449c-b748-5fab2bf1c926", "value": 4201984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700751693, "uuid": "f84d4ba3-62e3-4e98-91de-7965abf0d52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700751693, "uuid": "2966a54e-252f-4e4f-95ed-1b41e70fe68e", "value": "PayPal_List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4fdfd0-8a3f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700771716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771716, "uuid": "f27494a3-fac0-4081-ac7b-8732f4898f28", "comment": "Malware payload", "value": "655c9ab59afafdcc3c3ea06fe256c716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771716, "uuid": "3dd4003b-9bda-413c-bdfa-1a5110694087", "comment": "Malware payload", "value": "ed53c20f0d55834a573d7303e9ed64242568ae139b06cdbcac9bd173d0d23c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771716, "uuid": "472bcb77-4845-464d-b1c2-05955e411b94", "comment": "Malware payload", "value": "f9689d55005562013f98fbbc9cbb92d2c6016033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771716, "uuid": "7e7c25f0-e07b-4464-8121-4c3c7ea86f04", "comment": "Malware payload", "value": "56bebce82dac35322e13b26986ac551f7714724a368509aef4d3c3a3f4641371987e4ad3868402e4b4168ca4a52041f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771716, "uuid": "cba65242-c6f0-4543-abb2-3a1e16c3e5f4", "value": "T19D763AC7F85051E8C1ADD33586668252BA707C885F2027D72A60FFB82F36BD46E7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771716, "uuid": "27b7ff8d-a081-407d-9d0f-afbeb2bc192a", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771716, "uuid": "d72f7a15-1ae5-4f8a-9dcc-6f5d106d2009", "value": "49152:q7Nx5ZBZQgqykOKQrb/TvvO90d7HjmAFd4A64nsfJIkLPXdsvn30By+GaF9lhLQT:LgqeKxPXco3/Xxt1EF+CqLj4Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700771716, "uuid": "6a399ed4-3f68-4f60-bbcc-685a43e4de12", "value": 7423488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700771716, "uuid": "a2c2172c-39d0-45ac-ad73-99cb29b23575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771716, "uuid": "714e4ec5-f58e-4320-ad93-ea5fd76f7659", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb21e47-8a1d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700757162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757162, "uuid": "f21de3fb-e117-4a07-9a50-2e885c1686f4", "comment": "Malware payload", "value": "503c5269323a50f767405f9334b15fc5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757162, "uuid": "5b1d5251-31ef-4aa6-9813-6e3011da8d5d", "comment": "Malware payload", "value": "ed5da4b6d66d6080fc05cfdd6b70fca6ca59a7e65c1e3f994f77a12a094a0577", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757162, "uuid": "e8045fa0-a5ef-4a80-882b-63311c077c16", "comment": "Malware payload", "value": "d9abd44ab4735fed1de27dc855d7362275c538ab", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757162, "uuid": "97a75aad-8878-4cac-adaf-2246ae40abc7", "comment": "Malware payload", "value": "b38ddaf87e926c925f650c58aa5d115ad0450d6c854c45bd7cf5144b9265a46e2f0e2709024b87bff3ef0f3cf0a1923b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757162, "uuid": "199b5595-a7e5-44e0-8e0b-fe37116377f6", "value": "T179E533CEB188CD1AAE727CB93C899B1BB05F123A196703695D74E1F3D0DAB4F7509026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757162, "uuid": "f38c3dc5-82ef-4969-93fb-2875ceac5dc0", "value": "49152:FCYHs0X7IaXDncPcZvyoMpwKJALlR6rk3D6KQ9azBm:lsKncyvyoFOMKk3+F9azBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700757162, "uuid": "5e5cae4e-4ee9-48a0-b295-028fc028c143", "value": 3052773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700757162, "uuid": "f4a7f785-97a6-4b8d-af25-6dca9b1597e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757162, "uuid": "c3e58d9d-1b84-4036-9282-48ee7d83cfd3", "value": "FACT-NATURGY-A4-SIMPLEX-A9-TLLTK_NOPAGO201120232495259412.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b84a4e5-89f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700740598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740598, "uuid": "69a3f10f-4df2-43df-9e2a-80bbef04a909", "comment": "Malware payload", "value": "88af676747afd56ad9070479e1d38651", "object_relation": "md5", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740598, "uuid": "709f8295-a58f-4e24-a8c9-b9363ff8dabc", "comment": "Malware payload", "value": "ede613f851d9dedaa9d2c686f4b89d69a9e1d628476059f70e8a65e03e21969f", "object_relation": "sha256", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740598, "uuid": "a4703e44-ee99-4f14-a38d-2a2a82044197", "comment": "Malware payload", "value": "57c64a7d1b6b60417358f7079d086ac748ec7281", "object_relation": "sha1", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700740598, "uuid": "6e49d895-725b-40f2-92bf-3f59476b3cfb", "comment": "Malware payload", "value": "61ff22e86f2e21e18d361191edc54c9a80607bd94785a6b45d79d1990ccf1eb6acca7956feb6d566ea7d10ec323bb8fa", "object_relation": "sha3-384", "Tag": [ { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740598, "uuid": "db63d8c7-1d9f-413f-be6d-6cd2961027dd", "value": "T1AB76E100F6A0C136E9F745B68E7E926E953A7D71072490CBA3C40E9E5F71AE1AE31317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740598, "uuid": "b3a17f34-5835-4297-9756-75265bb1bfe1", "value": "49152:IhbiuH7S/bPD+MEYEVReqmG/2LmK/8JYy3SbWz:IMg7Q7+9mqjMp0JYhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700740598, "uuid": "2f1d3d72-4a4a-4900-a162-34c3f922d006", "value": 7340544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700740598, "uuid": "0eee8a18-f17d-419c-8099-4817706d855f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700740598, "uuid": "0cee1e03-b5c6-462a-85d6-7d794dda1205", "value": "support.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee7d2ce-8a3d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700770641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770641, "uuid": "1b3c08e4-8384-4921-89a3-232218aa2aa0", "comment": "Malware payload", "value": "5615922a245ae4a05cbb97031b687d1c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770641, "uuid": "ad23c183-bca8-438d-a893-9ef8dc2287ea", "comment": "Malware payload", "value": "f0134ff405cf5b97b4064a855059dcdeea4d0f31b5c35d4df0ccc54fdcc7f2fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770641, "uuid": "1195c1ed-607f-48c5-8327-f9ebbd8e2def", "comment": "Malware payload", "value": "90efed1b52c8b13d2107a1be4818e9d0a66a2cc5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700770641, "uuid": "e602fda4-1e12-445a-8491-52f19feaba47", "comment": "Malware payload", "value": "65924ef23518d072829adb5bf6d000721f1df01445a26c0d6f2a637eb433e4c2dc6986e1ba30338e914682b93b58299f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770641, "uuid": "db4962bc-b4a6-4170-a303-f8669db9d805", "value": "T1AA666C17B784653EC15A0B3A4877B658A83FBA7139128D5B7BF4488C8F359403E3B64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770641, "uuid": "81ad7e93-bee1-479a-8534-e15fe572fed1", "value": "99bfc3e418c7e413a6aa6cdcfb33d033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770641, "uuid": "74308f9f-e3f1-463b-a342-a581360b38bc", "value": "49152:UISMgzGywUfpwSLSr4bitF6yNkiicJTaQOtoiSe4VNbmS7CdiEbfi8Q36vAif80E:UgXyb48cJTaImS2diE7i8DAc39yOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700770641, "uuid": "262aecae-b764-4560-a1e2-28b5a610845c", "value": 6729728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700770641, "uuid": "ab9f4cc7-aa64-4001-8255-94430cd02526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700770641, "uuid": "78f6a0c0-2220-45b8-89bc-87960fbb77d8", "value": "SecuriteInfo.com.Win32.SpywareX-gen.9930.6545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6728bd9d-89da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700728162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728162, "uuid": "6a16df37-d906-4dcb-9835-4cfcd54c95a2", "comment": "Malware payload", "value": "1943dbce824f8d2e256a051d80a0ff58", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728162, "uuid": "1ad3c602-1949-4eb1-95e7-897664f39cd2", "comment": "Malware payload", "value": "f0155574ca7ef97eac11738118ced4dc57061c2e204190a4d191a6dd78f4dac2", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728162, "uuid": "86601cef-9a9b-435f-afd0-e23f22de980a", "comment": "Malware payload", "value": "f5e7d09053bd14b1269586d09b5d04d917ef27f5", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700728162, "uuid": "d5cc294d-0015-45c0-b981-cb42368b169b", "comment": "Malware payload", "value": "6e6d82db70ce3f25e50a51f8ad4001e4085942a76d05c786c2509d1e8ff22753c5371c034f89a21b7d7489af88bd9e33", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728162, "uuid": "8c8e899d-f435-4ae5-abe3-3412fdd4a35f", "value": "T174153319AE7EA82A947B5737839C86A53EA3EF0D73C82710535084ED5D1F1EA941CCB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728162, "uuid": "15c7dbe5-a956-41f1-8084-1d7bd989ca4e", "value": "24576:jMy/6tbb1+pDoe7XIVbna6WBBsN7fuL4xj:jMs6tb5+pDjhLBGo0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700728162, "uuid": "7f304f4c-2143-41ff-ad38-555d382bc5ee", "value": 934875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700728162, "uuid": "6fcc185f-e4cb-4d8d-a69b-7832986e3872", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700728162, "uuid": "3ac26a41-8f23-4c04-b84f-8a21c4049298", "value": "ordref_bomyogeshd_20112023165922.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336c4481-89ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700722921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722921, "uuid": "af6b0191-e90c-439a-89c8-6fda8a51d583", "comment": "Malware payload", "value": "b50840c0d0b09f10b5859e6e413f3ea2", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722921, "uuid": "c57f3a0f-aed1-4bee-ad90-98b5085a7963", "comment": "Malware payload", "value": "f076a54fa1b53a09fbcf0681e8bd52ccc19c2854c35bcef590cf074ae8b439ad", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722921, "uuid": "6ce3f8e6-fae6-4eb1-9269-cd7928676813", "comment": "Malware payload", "value": "440a561b7c117e8e2e6ac8f1c07e13066b3ff9bf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722921, "uuid": "824e96de-a9a7-4908-99ed-db15abb12598", "comment": "Malware payload", "value": "a2380c46dfbfeba2ebc9b0461ffc9718a3ebc9316094ec0aa1fe7d3ffcf9f607339b30102c8b84e735439a7074d8e20f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722921, "uuid": "93e00ea6-9c20-44dd-963d-cb9e5998d74b", "value": "T1363523A04CA4EE4BD4B19B78B2D0C4218F7B548EB789F6350D25BACE31759105EC1BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722921, "uuid": "ba332853-92ca-4ecf-b134-622c6c4ab087", "value": "24576:BBudSBeZ1gvNg85PHo4tHYmmG8Aj7RuweG4eJRLyL:GWvO85PI4tHYmx8Y7A1syL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700722921, "uuid": "29cca254-5da2-48f6-b518-b48b94b94388", "value": 1059429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700722921, "uuid": "195deae7-4a7f-4608-99ef-da21c29bf2e4", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722921, "uuid": "3fec1355-77c5-4d66-893d-50cad117184b", "value": "jouk_1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e93edb-899d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700702148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700702148, "uuid": "de88535e-e110-4bd7-b964-f1c74d53de06", "comment": "Malware payload", "value": "4c27d3bc82fbd4475d05f8763336d709", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700702148, "uuid": "3b67fd2c-5892-40e7-8d0c-5c1e88286b5f", "comment": "Malware payload", "value": "f09f2deef00409f486a035172f1d7b2afcb8a843ac7ecbdf77f3956cb8c90930", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700702148, "uuid": "072b11cb-f712-4b29-be18-98ea78b07a5b", "comment": "Malware payload", "value": "e6a5bfc3ca66b4ec4075b78b5da5504020767803", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700702148, "uuid": "ae04ab39-b017-49c0-8352-e9087a3e3334", "comment": "Malware payload", "value": "e29142f1873eebd927c6fb5eef4357fc8ab8b4b4861d58b2e55b01489f32505696ee6624575b8ac488a7deb57e6acd14", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700702148, "uuid": "85214371-b36f-4edd-9c61-ec5c402695e9", "value": "T1E8923382EC0F0445A0B2FF5C5992C4C6F90D7B732A621E12B69C4184CF77DB9A2ED56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700702148, "uuid": "cb3f621a-a381-400f-b070-f6f95e82da9f", "value": "384:vIoxoicdVUqLloPNEN/PDY/k74Pft1frfMzO5DEbWM:QoxoicdVUqLloP0sxfIyDBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700702148, "uuid": "1b60301b-3a19-4ed9-91ac-bd143bf41ba7", "value": 20212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700702148, "uuid": "e633ae5b-6a7c-4855-8b7c-dd67f0933897", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700702148, "uuid": "59cb943e-1be4-4da1-a17c-44ab290ffd5a", "value": "mahoa.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd291a5-89ee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700736605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736605, "uuid": "958d3bc4-e5f1-44e9-b53d-681357c6a2d0", "comment": "Malware payload", "value": "538917c95743a3a2bb095088b76f5b68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736605, "uuid": "64c53b19-a0ea-40af-ba72-4309ff2a0b4c", "comment": "Malware payload", "value": "f0b46f0628e4f6cb302a3bc80fc1141e5da15bd7260a625adff428eaa8565b61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736605, "uuid": "382194b6-225f-4349-81cc-61630f40999d", "comment": "Malware payload", "value": "4d8da031343659cce048cc72716c9935e5844cb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700736605, "uuid": "5439b6ad-8c0e-4aa1-8e01-5572b483420d", "comment": "Malware payload", "value": "1249c91a7a6643a90483cf4c42071803548ab044d8ff2442e967b924104a4eae12fa85fe39f8314b1d010a771509ba4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736605, "uuid": "9d543909-59b6-4312-a1fd-7dd6e3501228", "value": "T1B2530747B44180FDC149D03443ABAA76C8237EBD1B3AF39637D4EE3A2C2AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736605, "uuid": "8e57d90e-43ef-494d-9559-211bc118f065", "value": "1536:anF9U0FferGtOW4/RWo4Lz8kkRqwphJOlQ5M7WR:0FK0UrUO3JWvWRqwpOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700736605, "uuid": "ce38904b-2d19-46bc-945a-761682c51c28", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700736605, "uuid": "73876615-bf65-47b7-9a16-a89fb7daf427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700736605, "uuid": "4ca4a83d-5e14-42d8-9f08-180e8be3a32a", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd7896e-89e9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700734672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734672, "uuid": "9929e717-02d5-4b4e-a95c-f9ab808f5f3a", "comment": "Malware payload", "value": "cf4579241582dc23052c3c402e9bac4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734672, "uuid": "5b6200fc-59c0-4443-9778-4c4b40f2953f", "comment": "Malware payload", "value": "f33c9c0741e252d85c7c7515d7c9d23c5710ba2a69e115883db9d693ae741736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734672, "uuid": "a25bc4c6-8e47-4a24-b3e2-68bfd56646e9", "comment": "Malware payload", "value": "24cdd15f4a5e00d1362b0854e3832b789d6a5eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734672, "uuid": "d283c8f9-09df-4012-889b-f64e81dff310", "comment": "Malware payload", "value": "23a8fff8f397f21c1a26d55e5379856d411232313731cc154278a56d07db9267897e36c7533ac2772870c37383725ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734672, "uuid": "5fd18eb5-8500-4ac5-bcf8-ce7a9d57cd6f", "value": "T1B115D01466B91FD7EB3AC3FA5410520447F6AE2D106EF31A5CCBB0EB26E4F904685B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734672, "uuid": "7287656a-2a25-4db3-aa4f-f4e54bf918bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734672, "uuid": "7897519a-3aa2-4b09-9cb1-f58217c2923d", "value": "24576:UrtD/F2k783O0Ic6PItWuTUGiR0DvxDf9Ja7CwEuE6c6:UFgk783LIc0IEuTUGiR0DVf9Mu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700734672, "uuid": "a19feb21-86d6-419d-993b-8b35f0c7bc48", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700734672, "uuid": "6f1d7381-4313-47f2-abef-8fd108e81d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734672, "uuid": "5490ed40-e5e5-45b7-9dc1-253b0db7dd44", "value": "SecuriteInfo.com.Win32.TrojanX-gen.31838.19980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775f478a-8995-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700698554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698554, "uuid": "ce3414b4-1e05-4d2d-96a0-68e910e609cc", "comment": "Malware payload", "value": "d0fe27865ab271963e27973e81b77bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HrServ", "colour": "#13989F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698554, "uuid": "e28024d1-e4ac-4b0f-9cd2-3ef7cbe06efd", "comment": "Malware payload", "value": "f38517692ab3e817182a396a407d9fe1c260c89bb6b733764737562f235115f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HrServ", "colour": "#13989F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698554, "uuid": "7fd956b8-9fdf-4f82-8759-e7ad8333672a", "comment": "Malware payload", "value": "a5796a2cc31e1ab1a8a12131f803affe735a835f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HrServ", "colour": "#13989F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700698554, "uuid": "c1089186-2921-47ec-ba23-985189f3d776", "comment": "Malware payload", "value": "82285b4442b0a599e149c73289c2634fc414e3b2f0ed7a80cdcb066564d07564a96e6034c6386dce3938975a1ab03aea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HrServ", "colour": "#13989F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698554, "uuid": "5c61ff3b-ca59-4296-887b-bb47901d71ff", "value": "T172045B0D76684075E976C278CA539A83F77274150B319BEF2394433A5F2B7A09E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698554, "uuid": "efc10e42-5403-4114-8af5-26e7888a7300", "value": "640ef767b60cd41dc392cf589951748c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698554, "uuid": "dd498e35-500b-4048-8165-ed2ea8a21d87", "value": "3072:lkpTnY21vDE9rZVan6kyHrTqBai3oRu0zPgTQ7dL6HtdJkkQVEypc94tG+c6ThN:lSTnY21w9rZk6kyHiBb8LzPgTFy/c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700698554, "uuid": "aa04f66d-ff97-49db-a17e-f53559e370f5", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700698554, "uuid": "0f34159c-c48d-4f85-a7d2-2657b9f5e294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700698554, "uuid": "fca04ceb-8480-4805-9a2b-46bca5042db1", "value": "dss.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d06536c-8a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700757297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757297, "uuid": "1fe6b1d6-8046-4af8-b6e6-6e4921d7a52e", "comment": "Malware payload", "value": "d17f9e5578c61a0dced306750cd84a73", "object_relation": "md5", "Tag": [ { "name": "pw-111", "colour": "#D9D0FD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757297, "uuid": "ae7dd10c-5e34-41dc-9653-6d71b38372df", "comment": "Malware payload", "value": "f45f934f6a1ae749571fa93684653b87eb18fd0f8e75afa58061b209cd43a22a", "object_relation": "sha256", "Tag": [ { "name": "pw-111", "colour": "#D9D0FD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757297, "uuid": "10a0c9b4-eb8b-47f6-91a9-34d13c54bc4a", "comment": "Malware payload", "value": "19aa6d2422e23d2e8dfabfac39b5b6e403e4893d", "object_relation": "sha1", "Tag": [ { "name": "pw-111", "colour": "#D9D0FD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700757297, "uuid": "fd5bb934-0b30-4415-8e81-1202ba2cf0cd", "comment": "Malware payload", "value": "34c92d6f27734b1618ba9508890bfbba39a0a0610fad0564def739cbc68c46196ba9c491b32eac97bc1f06bd682ef9e9", "object_relation": "sha3-384", "Tag": [ { "name": "pw-111", "colour": "#D9D0FD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757297, "uuid": "19eb633a-2d73-40b6-b895-cb728e42d3c1", "value": "T13F32C0348D1F50CEDCE19DC7597EBD845243C86A7DA88C659268FCDA4D7FB8A827D200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757297, "uuid": "b665d82a-6624-4613-9e3d-9b89e7c365c6", "value": "192:wRmZHnXi/8IfwaAAGRCG46tEIRS7EOYMybeue16PkzpFhBR98ObddST+2m2:+mhXLDaABrtEIcAODySue16MdFjR+ODo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700757297, "uuid": "dc536089-1eda-46fb-b8d9-5b56d0738398", "value": 11344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700757297, "uuid": "181a3c56-8bfc-4533-a9a2-b2aedba1af07", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700757297, "uuid": "eb9010c4-8b0c-4d24-b1a9-2be2947c2191", "value": "GbardSetup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95206f7-8a3e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700771330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771330, "uuid": "534b5f61-7a7e-460b-86df-5116ffd3d0e2", "comment": "Malware payload", "value": "54111658bbc2db3c42907a2b67c40061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771330, "uuid": "3d62cf79-149b-4f29-9e34-2e751f220d7a", "comment": "Malware payload", "value": "f4ccc11af9fb37da6a79c9534f04b308de5cc48e29ab4226a94c18ffff40ce69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771330, "uuid": "f7e86730-cd6d-486e-bf7d-87eeb6a065d0", "comment": "Malware payload", "value": "704765e955b780f100e6ec7903ef7d259143be31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700771330, "uuid": "36f71f65-cb1e-4af3-83d2-5bb90c62e0b4", "comment": "Malware payload", "value": "aaac4e306015dd78cdd7fd637fe4b3463f130526b844eadcd59361de0aaa4e4cf3106a00dc1b2b14d482d6bcda4e03ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771330, "uuid": "3ed8a5c4-5782-46bb-9988-6291c1873df1", "value": "T149C6335564B183FBD7EF8B302849029FC380A347F19DEE5C19A12593BF66CA25B05E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771330, "uuid": "af0c589d-11d9-45a4-847c-bc34ff832c0e", "value": "d5fbc33b0f5785677c487e99bad937f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771330, "uuid": "5ad74a7e-78c6-4d5c-b3d9-1d29cfa488ad", "value": "196608:n+XQ4OtD5n6Etfzl3aSfvh6W8e81zS8cN6lkUVYWb05wx6zI:n+NqN99xf6fY0lZVqdzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700771330, "uuid": "b8c70c32-5565-46ee-a127-cfc8a069bf7e", "value": 12123648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700771330, "uuid": "122ff0d8-64c3-4ab3-a1eb-3a5238a8c6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700771330, "uuid": "17c86dc8-076a-4cc7-8dd7-3b6059ee8e0b", "value": "msray-plus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddfad4e-8a31-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700765405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765405, "uuid": "10cee043-83cc-4221-b0a5-02abc5e74bb4", "comment": "Malware payload (Mirai)", "value": "85ab738761f88fd80f12138f5f6a7022", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765405, "uuid": "e6ae5e94-4a0a-460f-af5b-b89084214854", "comment": "Malware payload (Mirai)", "value": "f4ddeb76807845b85d3d3fed3ebccaf5c135bb1fa1278f06388dca8542ef2555", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765405, "uuid": "e326a957-aec7-4e82-ad26-30d3f67d2f8d", "comment": "Malware payload (Mirai)", "value": "f3fe55011ad440d78e58bd20ae1007a7840bcd79", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700765405, "uuid": "ba6b558b-2e3e-4fa4-806a-5296c050d829", "comment": "Malware payload (Mirai)", "value": "b65b6f3fde969019f8afec8f67debbe14cc94df70f5b7cda080f526329f280ca36300980c20c84b668c07244e5afafd9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765405, "uuid": "7adf7cf9-9f32-4dc8-b4df-3256c0d4d9b9", "value": "T1E0A2E1257F1DE88FCC37B27886E5E9C693D07D24D2DCC9866741C16FABA36846830E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765405, "uuid": "a46d6704-e40c-40f0-924c-6be667c2870e", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtQDlS9:x98o08kxofBE+ZkXaT47C2EpitwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700765405, "uuid": "5b456adc-af20-41a2-8090-068ddb675a23", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700765405, "uuid": "6bb10f89-d93f-4a65-a245-760a8876df0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700765405, "uuid": "3c2b65e1-5046-47db-bc99-ca0ed46215f0", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7438b4b-8a0c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700749878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700749878, "uuid": "42fe584c-aabd-4604-88ea-26de29b7e05b", "comment": "Malware payload", "value": "50127b46d9312d41a8cf5c3ab4a2d0ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700749878, "uuid": "1d4c0ac5-47f0-4d29-ace3-ddf17def8550", "comment": "Malware payload", "value": "f4f6e26c82aebae328be74a76c4cd83c62a47159a29e0fc673be000a74c45c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700749878, "uuid": "3b3b910f-e72c-4c5e-b790-1aeecff9678a", "comment": "Malware payload", "value": "881102534491420e8f736d0d6c897f8f3b920d10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700749878, "uuid": "2f77a349-a4d7-4de1-b310-b0452c04e9d5", "comment": "Malware payload", "value": "d51a420cea96f49c51955b891b16082dc4e4644fc37b2c9e4f14ecb7b6d8950411cfdbe97acc43607a2f297d590871fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700749878, "uuid": "e39ca673-c664-4bfb-ab82-c0dd5fbec5d5", "value": "T163546DD352E16875E5134632CE6EC6B4261EB4A0FF457BBB23775A2FC8B02A2C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700749878, "uuid": "6f88bc34-f96f-4177-a7d7-df7caf030d9e", "value": "c8a467701c8f12711115d82fcd038f48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700749878, "uuid": "156f6b3a-1002-4777-964d-17fff42a87fe", "value": "3072:rPtAJB7iY8unJzlDPG20L3bLQHjVkE/z8qYYHUW6Jj0:WDOwnhlDPeLL4hkE/z8vYHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700749878, "uuid": "3a27ac3c-132a-4345-8f18-e3987d02332d", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700749878, "uuid": "53b6f535-79f3-41d1-a0c2-916afbc86f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700749878, "uuid": "93761210-b2f7-498d-bcfb-973f689a9794", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4fc405-89cc-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700722209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722209, "uuid": "c7f47671-0b0f-45c2-8877-2f74899f21e0", "comment": "Malware payload (LummaStealer)", "value": "14644a030a4d02360e6502c5ac9a2523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722209, "uuid": "bfef3beb-db18-477d-afa8-cf16b220e8e8", "comment": "Malware payload (LummaStealer)", "value": "f58ed466d6af193f741f1dfda5892193dae42dfa9419acacc7a76f68a7f56b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722209, "uuid": "ea2963e3-234c-4009-922a-1db8e02cc17b", "comment": "Malware payload (LummaStealer)", "value": "cfa85d3fdda8ced9699b98c61989bb09930d9b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700722209, "uuid": "56f9d97d-66b8-41de-b4bf-0f5b3fbe49e4", "comment": "Malware payload (LummaStealer)", "value": "45addb2db9c8bea806da26e763c931cf6c1215a8073257d1ee373c42bb02c44048e8cac78faef2beb2d4d7e769567d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722209, "uuid": "a81ba5b6-bbb9-4bfd-8b84-d0f0de812fff", "value": "T1D706CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722209, "uuid": "3a202068-d33b-4a26-a3c5-f9383b2d9c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722209, "uuid": "64e7bb73-e189-45b5-b7a7-e199de356ca5", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYr:8AqA4bNMAeLVdWRC9bO2IyOnhJYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700722209, "uuid": "67f44cb2-17a9-412e-8c31-40c68893e9bb", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700722209, "uuid": "25b46d74-eb01-4446-b311-7550a679745b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700722209, "uuid": "b3244041-7658-4e7e-b55a-95844797d790", "value": "14644a030a4d02360e6502c5ac9a2523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578fb754-89ae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700709238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709238, "uuid": "f896dfab-8198-4f36-9c1d-5ca5b4787c76", "comment": "Malware payload", "value": "8d60f53862ab12a62542a625617cb7f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709238, "uuid": "e2eb6133-431b-43d5-b012-0c1a07163c69", "comment": "Malware payload", "value": "f6095eb7c5759c19ddc15879bb68bcad8ea5a1c30a7767d7b2b45ad837567a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709238, "uuid": "cbeb90ff-2c76-43dc-88f8-bbc38e801d5a", "comment": "Malware payload", "value": "6a0731ebdcf99ee6a47090c14e7dd05e5f3dd61d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700709238, "uuid": "a5ae67f9-e776-41c9-b332-e3f6e5ab2d9c", "comment": "Malware payload", "value": "04b672461c07c2a4040dabc445d86ab52c2266d3e1b4321c1e3388d516bbed063f6a848c79d0978d1e8c15e42d38aeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709238, "uuid": "b775f31e-e6f6-4cdf-88de-56d935a7252a", "value": "T1F5446B1369D3EC21ED5607304F2DF5EC7B6EB8A25E65874B3F182E1A29302B1D663319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709238, "uuid": "946f9c9e-6045-4baa-81e6-bdf371b65863", "value": "aae67b5fef530aece88f7388e72aec2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709238, "uuid": "927e9c74-f6e6-48bb-950d-a2e6abafd490", "value": "3072:PcHJJ4aGrl+S/nsDNExeYLcvlxo75EBAvif5t6XqBPEIAT:gmrl+knsJEQYnDuGiPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700709238, "uuid": "36b476dc-1ccf-4c7a-bee4-1053080d943d", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700709238, "uuid": "770a0fd4-43a9-4758-bd80-5cafb6059f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700709238, "uuid": "743da2b0-55e6-4dee-83c4-832575b2fa6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dc5f95-8a42-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700772716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772716, "uuid": "8d083f60-6a00-43a2-b2d5-983a0efadf20", "comment": "Malware payload", "value": "960678449687d57024c080f63065ed98", "object_relation": "md5", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772716, "uuid": "1a3c39e9-0309-4514-b5c8-a3d0c8996c35", "comment": "Malware payload", "value": "f6a061618ec6b85b33ab8d8ea2b61a2dc634f6e9125a2e1b0986a198f070aa93", "object_relation": "sha256", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772716, "uuid": "2d26a2a7-688e-4b2a-b251-a26254ef3a84", "comment": "Malware payload", "value": "cd651a2734c42f267a9f3cc900d5030fe93711a6", "object_relation": "sha1", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700772716, "uuid": "a67ed81b-3b66-4bb5-9afd-cd036411e3f0", "comment": "Malware payload", "value": "0d5f5eafaca44a81a555fb58d325cdd9e0693801ccb296f9dae023268d16d0b0050fee7d7d54d6a02000fd012639b0fd", "object_relation": "sha3-384", "Tag": [ { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772716, "uuid": "4a543a98-0bed-41d4-b435-16a8ddd703fb", "value": "T167D73357089D0C66B13020665F80F2091BA3C4BB7659EA7B72177E11C5FCAEBFD98B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772716, "uuid": "747d51e6-4c68-4c4e-83e8-24e93dd72824", "value": "1572864:hTapcFLZEB3ACJn3Arzu3AlC3A2HZuS0KKxz9XsxB:hTapclZEBpnwzu2C3ZrgzexB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700772716, "uuid": "221919b2-a7d8-409b-92a7-d3b1724905ee", "value": 63622286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700772716, "uuid": "dbdd42b4-89fb-499f-aced-e5348f23f3b3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700772716, "uuid": "d2646ca6-8615-4079-a827-a0bfebb4c123", "value": "E-Rechnung_DocuSign_Signiert.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4737ed24-8a14-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700753019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753019, "uuid": "7a3b4a27-1f35-4069-b335-58ce1d589d3e", "comment": "Malware payload", "value": "177233c88c71a12b6dd192ad1cda735f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753019, "uuid": "63692be2-0982-4215-8547-240692784e27", "comment": "Malware payload", "value": "f6b71317e15b0fe5dd80e6dbddf09e7935c270eeb13c2cd90cec12b069359255", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753019, "uuid": "12e87231-3c5f-4507-b932-4950a8a6b3a4", "comment": "Malware payload", "value": "fa36613e47fe2bf72657767ba87f9ab6a86bc9ca", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700753019, "uuid": "65e7d68d-f28d-4aeb-8cda-dd3f081db6c4", "comment": "Malware payload", "value": "d03b63282e94fd7cbdf07a875e1f577c07245c97d659782672ee304ef3550a64c1686119f7e3993cd112678c5e3a4363", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700753019, "uuid": "f1e75ff4-ae17-4f80-8117-2e9e61cf63f7", "value": "T1CA459E1276C2C536D57F0670292DE77A016E7D200BB189EB53DC5A2E2FB25C29632F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700753019, "uuid": "7f4698cc-9ef2-444b-80c0-c099c15ede56", "value": "24576:3sIYKztdfG8NQGafAdbe/IEFXsaV5C7eYVLsTPRDKe:3sIYefNQGoAhRaV5C77yPROe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700753019, "uuid": "8549b300-5f9f-4b1b-bac2-a94deaa7377a", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700753019, "uuid": "cd4c34ba-49fa-431a-bc7f-f0472a7ffe2f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700753019, "uuid": "83032c3b-00b0-423e-b83c-d62a6bba61fc", "value": "nf2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d376b6de-89fe-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700743805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743805, "uuid": "38dd9818-da78-4099-94f4-c5969a1a05c7", "comment": "Malware payload (Mirai)", "value": "cbe318a633cce1f8462b33bbfa804f72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743805, "uuid": "c1c8df27-9826-4f5b-a365-5ab9d9b9dfeb", "comment": "Malware payload (Mirai)", "value": "f75c8b3fa2bf7907afedbcc64d2cb9cf40cd0e4646d01a3e31662f22fa8e612b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743805, "uuid": "dada12c2-c19c-4803-aeda-aa4dc65a3ae9", "comment": "Malware payload (Mirai)", "value": "96b39eef6a86f90abdce0aba5cb1d21668f23c2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700743805, "uuid": "e3520e83-cb76-4dea-9828-06a36dbe99be", "comment": "Malware payload (Mirai)", "value": "4b68441fb3e3acb2b47240584f3d10afe7c3a0444558bb14becb9e259fc7d25c7b9e32dcdb9753ba117df2952c372bf9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743805, "uuid": "505409d8-635d-458d-afd3-009b3f8df099", "value": "T16B330272666929E251B09777FC33EC1A96DC17F89C6730DA2CF0A51977C18024EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743805, "uuid": "c33b1ce7-349c-4769-b170-e83dcc6b03f8", "value": "1536:s9O/ZMAXIxNUk0rLcPqF1aBexo4opKZbx:s9O/ZNKyHLGqFUFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700743805, "uuid": "95a72735-2609-4df7-868d-96435b397a07", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700743805, "uuid": "29e3737c-d674-47ae-8598-96bdecb220a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700743805, "uuid": "498c75d7-b813-45b9-a43c-20f473075394", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17295bd4-89b4-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700711707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700711707, "uuid": "6971f976-9a69-4799-9054-ac72ca01a711", "comment": "Malware payload (LummaStealer)", "value": "f25408985ee97d52d8723bc49aa40272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700711707, "uuid": "bc6f1d18-a562-4fe5-b653-95a112a3bebf", "comment": "Malware payload (LummaStealer)", "value": "f7f3a637d3bb2232a40a4657843f146a0d72580f881c45955fae4bc7d33d12d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700711707, "uuid": "1333fb64-9059-4feb-b83c-dd4c29ef037e", "comment": "Malware payload (LummaStealer)", "value": "f0f8745fc5d599946732a80ca9efe43b8c7e5068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700711707, "uuid": "3238af5f-e067-45ad-beab-fe957c668f2a", "comment": "Malware payload (LummaStealer)", "value": "ed4e559f326a35482836f4537e1b729a49fa1d54aa2f7efdfe1e1a5731f1965dcf9da084123e3bda04a7f47bee996859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700711707, "uuid": "7b7444bc-2c4c-4964-8d86-952c7daeb178", "value": "T1D406CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700711707, "uuid": "d10e93e2-d1f5-441c-b158-76c6b5a94bd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700711707, "uuid": "f0571eef-ba6a-4676-a592-c20ad2e2972c", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYb:8AqA4bNMAeLVdWRC9bO2IyOnhJYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700711707, "uuid": "8a68de37-3f01-486f-a167-a26a252e26a6", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700711707, "uuid": "12430f91-0886-4d99-bdca-410c6a2b595c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700711707, "uuid": "3a446db7-6ed3-4b21-902b-f16cccbde70b", "value": "f25408985ee97d52d8723bc49aa40272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8558e0-89d9-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700727795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727795, "uuid": "1f52f5ef-73e0-4ec7-a0a1-80b6db133385", "comment": "Malware payload (SnakeKeylogger)", "value": "f4e9acbb76a17418e01d5c2ba397aeff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727795, "uuid": "d2504594-3291-4ce4-8c59-162da529141e", "comment": "Malware payload (SnakeKeylogger)", "value": "f9abeebda334e6ff506326bb578cba3b1e3309b04641a3cf0adb4302a03c476e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727795, "uuid": "6e39f569-5952-4eea-828d-bea956557b6f", "comment": "Malware payload (SnakeKeylogger)", "value": "115d6837f1b7a14041ce446901e642f668eed9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700727795, "uuid": "1184d571-418f-4609-b61b-8641526a71e3", "comment": "Malware payload (SnakeKeylogger)", "value": "6c0d592d002343e3e730e83432ccf0c295889f92411cb114ba6a32440e386b2e24cfbdecaed7dabd1b81f79c34cd91fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727795, "uuid": "c5349bda-f5e5-42b8-ac92-5ea9e9c9102f", "value": "T13DF4CF18A6B95FA7EB3A93F95411520447F56E2D103FF34A5CCBB4EB2AE4F800684B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727795, "uuid": "bec60f8f-865a-455f-813e-1e443639ce15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727795, "uuid": "81649496-8fe1-4155-a62b-bf8ed62dc592", "value": "12288:sUA7NEE6jD/pLXGkJl8Me0rllpJIPdOjwX7IHpBaQo3wMPQeLgH0JtvL:eEtD/F2k78erllDIPzqpBwwLZ49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700727795, "uuid": "9ce4513d-0be2-4121-a40b-22fea5e6fda0", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700727795, "uuid": "827533fd-cc43-437b-b53c-9875bd0ef523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700727795, "uuid": "30e85643-5599-4bc2-b351-954a279a9919", "value": "SecuriteInfo.com.Win32.TrojanX-gen.13038.29708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e14f68b-89e9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700734669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734669, "uuid": "ad36970a-fefd-458c-958c-4af002a85f6b", "comment": "Malware payload", "value": "de528d5534d0d274c039ed07f6dd70c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734669, "uuid": "5589d948-5b7c-4783-89ef-74d5e63868df", "comment": "Malware payload", "value": "fa1268f5d18e814cd471bea9d91c971489a04f810a974d8c9136ba3062923679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734669, "uuid": "fccfc8db-bc79-422c-981e-9e778651d3bf", "comment": "Malware payload", "value": "487d974b1db91d1a369cc2782e7937307c38c4a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700734669, "uuid": "9687648d-3462-487c-bae6-20d977cf09d7", "comment": "Malware payload", "value": "43d8d46ec1d6db0c4efcc127d1926a69d5f8f0f80bc26e47e232d89f127c85a07964011b584488e417a0ddba0d812cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734669, "uuid": "cb325283-88b8-452b-ad84-4cc5fbb9e4eb", "value": "T1C925D017657DDAE2FA2EBEB45110430407B56E2A103AE247DC8F7CDAE9B3B43C6446D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734669, "uuid": "5524778d-a5cb-4c42-be83-d52e3661780d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734669, "uuid": "2626c630-7b76-40c5-97d9-c2210c29aaba", "value": "24576:wdtD/F2k78Xw/5n9hmdMloRfp7MOMpIqRlDEgo6:wfgk78QVrmdCgxMOjqRw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700734669, "uuid": "9a189725-4465-4c5a-81a2-369331c38c4d", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700734669, "uuid": "ced4502d-e235-46af-b8ed-630ca5867783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700734669, "uuid": "fecce138-2c7f-429d-9ac2-c4df26705769", "value": "SecuriteInfo.com.Win32.TrojanX-gen.31944.24747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5990e50-89e3-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700732212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732212, "uuid": "bd27c3f6-0d4c-4cae-af59-889b53344e7c", "comment": "Malware payload (RiseProStealer)", "value": "bc2da1ab04e3934c2a85f542f78ccfef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732212, "uuid": "5ef8aa7d-78d2-43e1-b89b-2f06c2811b5f", "comment": "Malware payload (RiseProStealer)", "value": "faee82e213715d16d55fa81816171d686f0e28eedde195b730fc6d1f11fc4ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732212, "uuid": "cc8e2e30-8ef4-4cc2-a8d9-9f80dcd7c243", "comment": "Malware payload (RiseProStealer)", "value": "b506efdda3b77676522c23823453289dd7b1ce4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700732212, "uuid": "789b2182-ea8b-4cad-bcd0-5e8865912aa2", "comment": "Malware payload (RiseProStealer)", "value": "4f97e27a34b9fc46f7069fc288b5c81c8f375b407c6bef8fa33aed375a841cb10ce78b0eaa5f7516861d41bc1074942a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732212, "uuid": "0b75d46b-bbe2-44b0-a486-b860f782dd37", "value": "T1A45633067CC19A88C08AA4B8C696EEFD36F52C695250885EB050FFC7BCF37B515BD642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732212, "uuid": "66a3e580-cf1e-4fb1-91cc-74609dab2824", "value": "c0d94d1625215fc1c0eef60da72422bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732212, "uuid": "0961c2d4-f98f-4aa8-b5f0-d403bd09487d", "value": "98304:gFFmZurHIWhto8xSkbVroHO0KE3eHc/912VuKhHP1Zr4XKp0Ruhx4twPeRwoK+Pt:IFsurHdSQoJKEpnKd1Zr4XK+RltfRLWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700732212, "uuid": "4ea2a3dc-3f57-4c24-a6a6-42c45aa77f39", "value": 6027040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700732212, "uuid": "766b67b1-35a3-4f3e-ae1d-81eced335ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700732212, "uuid": "ef12b2e4-cee2-4a52-94cb-d22ad1474f7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7df71b8-8a0d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700750309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750309, "uuid": "f79a42d8-80f3-4a9a-99cd-308936186fcd", "comment": "Malware payload", "value": "4bac64201080a64042ac113f69f22507", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750309, "uuid": "20ae6d22-2b31-47d7-b72e-56fbfffa4657", "comment": "Malware payload", "value": "fbe2ef8fef5ecf8f0b1ccbb1a3121f1d426f7af17281525915b997462d946a22", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750309, "uuid": "d0b0680b-933b-4e86-a55c-fb485cd1a52d", "comment": "Malware payload", "value": "e11dc926fb6f2322eac8a644ea6c7667a7d849d5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700750309, "uuid": "96ebe906-174b-4179-9c95-6a78324a79e4", "comment": "Malware payload", "value": "95b62a6d1fc67d096a8dc9de319ccf2f8f61cdfde2db582b0216a5818c107834d68ac7ef54d7a6f50824749c5c57bacd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750309, "uuid": "e2d09b17-cfe9-479c-9233-923f62490102", "value": "T17395AE1175D6C53AC47F45303AADDB2B107E7AA10BB588DB63D40A2F4EB94D20272F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750309, "uuid": "44653bd6-22c3-4be4-9775-2c44be2af6e7", "value": "49152:yVL5WynKsQTVWEdVxyJpMNCvosTi0sOAZnWkwfNQGqAQIv/BoaTzuVJHsgsFhY:OY2KYcOD16AQq/BonAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700750309, "uuid": "95e75961-8801-4031-9d1b-ef0b0190e02a", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700750309, "uuid": "cca8ac43-c969-41b2-8bdb-82528f0b5ed5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700750309, "uuid": "88f2cfaa-1c99-4968-895b-2bbfb35e037f", "value": "nf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5e6cc1-8a2b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700762903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762903, "uuid": "b8c3c6e1-8fcb-4e32-b57f-9bf9951181ab", "comment": "Malware payload (RemcosRAT)", "value": "680c84bc607a230b3e2d0460aa7a4c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762903, "uuid": "23c0728a-850f-4804-9e61-5c38e29e0b9d", "comment": "Malware payload (RemcosRAT)", "value": "fc49361a1feda5ae0fd73ab7e4b87ef199c852309f042c2884ecbb0855b2e782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762903, "uuid": "c1192c36-1e78-492e-9563-892ffdea602d", "comment": "Malware payload (RemcosRAT)", "value": "c70bf16b588a96ddc976ab09f44d19057b004821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700762903, "uuid": "8b77795a-90e1-49b7-ae03-39a4d73f814e", "comment": "Malware payload (RemcosRAT)", "value": "ebdadb9eabe4ad41d196ba6feae803869058410d668edd5b277a3c49e858eaeb4fcb27bc3c28a795e9c4dc7f8e0a977d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762903, "uuid": "4844c7fc-c49e-4f40-a4f8-1284761cc44d", "value": "T148B4C0C353E16C74E51246328E1EC6B4661EF9A0EF057AB7233B5A2FD9B13A1C663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762903, "uuid": "0f9d39de-4cf2-4e05-8f57-24da7235958a", "value": "c8a467701c8f12711115d82fcd038f48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762903, "uuid": "a48948ac-b0be-437b-9afb-5eb42a371995", "value": "12288:z9fF7HKbLyzr2jj/TtZ9us/KOgFlQth+:H7HKbZj/xZ9IRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700762903, "uuid": "449ed7e9-7c81-4119-a5d9-ba739f529af2", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700762903, "uuid": "dec8cdad-3d5c-462a-9e55-7e960cb0b803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700762903, "uuid": "fdc61aea-14ea-4b55-874f-c7ce3a359cf9", "value": "InvoicePayPal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8584a7-8a23-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700759742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759742, "uuid": "1bc00663-ff3b-4faa-b3bb-54d4a9dfdef1", "comment": "Malware payload (Smoke Loader)", "value": "7734a40020a43e5fe4fee73fe44bec32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759742, "uuid": "0c3381a2-a004-4441-8b03-ed71fc0c5bb7", "comment": "Malware payload (Smoke Loader)", "value": "fd01181f0a584579a652ad899163477ff55dcf48a8f1017e07805c69306b9731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759742, "uuid": "62e0f7ed-48bc-48dd-8d0b-5c9b4472c8a6", "comment": "Malware payload (Smoke Loader)", "value": "9e45e4a6e3727b465fc3546a271005603e04d6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700759742, "uuid": "de2e5276-e947-42af-ba1c-de4bc44294c8", "comment": "Malware payload (Smoke Loader)", "value": "1564d8a2c6afb0aa8535bc6a4e1c67b35b21526178ccc24318c1b60335652131ac5e0fa332350671e487347d90185703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700759742, "uuid": "49423d61-2a2a-45fa-9ffe-e6dfa50e567d", "value": "T101445CD253907871E52746328E5EC2F42A1EB8A1FF557BBB23776A2FC4B12A1C163311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700759742, "uuid": "cdfd50f2-9c42-45a7-9faa-75854389a3f0", "value": "38512f187ce560aad231123bf7f8c4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700759742, "uuid": "aea99d7b-f0c6-433a-b77d-1df1dc5ebae4", "value": "3072:qMtkosLUIgJ35TaNe6Dg+2qFVlPgyNlpTuqmq5+DAZUpN4cS:2Nw/31a4aFHvTwrDvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700759742, "uuid": "a0c4cc60-2a6e-42ee-a096-1622a7625259", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700759742, "uuid": "aed33857-6044-418c-b609-60c3d4b5fb4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700759742, "uuid": "cabbd079-ff3a-4b3f-8c25-abba5b1365b7", "value": "93e0099a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e52cde-8a33-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700766516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766516, "uuid": "3a561152-bffe-44df-b97d-057e2b581cc7", "comment": "Malware payload (Mirai)", "value": "92b495332a92109bbe1592b9af848e94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766516, "uuid": "3b649ed5-0ae2-4715-abb2-1dd7c6752d65", "comment": "Malware payload (Mirai)", "value": "ff68e7cfbfd00d19ec287dc1d24f1e14e063b5a65a2c47580cd2682bcf5f0f17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766516, "uuid": "ba34566a-0cfa-4706-bf32-bea452b032cb", "comment": "Malware payload (Mirai)", "value": "e3c355523d5cc004be60efff9ed01354f312d1d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700766516, "uuid": "115fd348-684d-4c4d-a71d-3fca1d2b635a", "comment": "Malware payload (Mirai)", "value": "0b34127ba297fc1df343fbe455f16e60b402ee22967db23942aed109ed52edde0f6865babc1582a8a1d83dab9204dd82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766516, "uuid": "d896c118-7128-46b0-9910-4eca1c8cab1d", "value": "T1C982CF30529B74E9DBF10431FAEE8EC69B1A0BF9D1FC36D316596B38894250211F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766516, "uuid": "03c2b78a-cfe1-4471-9971-a2c2c9e50194", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa9hymdGUop5h5lG:6/V0P6+kom0tVAoNvm+to19s3UoznlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700766516, "uuid": "0f51b943-38b4-4fe2-b2a9-972e3ee8ffb3", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700766516, "uuid": "2ff3a2cd-8adf-4183-a8a0-d88f320ec01b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700766516, "uuid": "14a35bf1-4436-4f0e-bb2e-e3346deedeb3", "value": "92b495332a92109bbe1592b9af848e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }