{ "Event": { "published": true, "date": "2023-08-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-21", "timestamp": 1692662581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "90d9c07e-b0dd-49cb-90e4-25be3fb12c27", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d314397-3ffc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692606281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606281, "uuid": "2563ca9d-f227-4115-9ebc-3eb01ee6655b", "comment": "Malware payload (RedLineStealer)", "value": "d36c2fd2212b016fdd1836cdada1bd5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606281, "uuid": "73187549-5dab-494b-82e3-6d43ea0df5de", "comment": "Malware payload (RedLineStealer)", "value": "012fcba52a052c7381ece8ba0dee8f3898565f6547dfee4a7969aa0948eacbdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606281, "uuid": "d7ae73e8-f169-4e70-af05-f7fbaff674a5", "comment": "Malware payload (RedLineStealer)", "value": "63f68a6943b72567a8fcee148955d62b7bbfe095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606281, "uuid": "b25a1bad-245d-45d6-b141-0aea0758809f", "comment": "Malware payload (RedLineStealer)", "value": "bd3eb6cfda3ff8aaa565d3161b9f1c1f94ba4993f2934f1957d93cddaed9bcd0f4204a273885e55409641187ec459f7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606281, "uuid": "14457e05-ffdb-4f6e-aa67-1e6324e95838", "value": "T12A344922E25685AEF7B98D795B71BC5425F230C821D0269BB1CD3E290F1C75FAC0E9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606281, "uuid": "a8eb5377-8bb1-41b9-8c32-55d1e1bcd5cf", "value": "e9b89dd14503bc763f2f9c58c504e067", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606281, "uuid": "e1fd4ce8-4210-47fc-b894-0c16e68c04c4", "value": "6144:3J8i7UrGHERLj/kwzimKYQbRDch5z6iY8IXLXjKAX:eXBkwziXY8RDUdIXLXjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692606281, "uuid": "464b2d57-8e62-4e1a-91b2-d4d8c887e197", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692606281, "uuid": "7b7d2161-cc65-431d-8bed-66b3c90f5fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606281, "uuid": "e085d57a-678e-4405-bfe8-6284a2d3715a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4798b4-3ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602760, "uuid": "df89aa1a-0727-418a-b8de-00001c5ddefd", "comment": "Malware payload (AgentTesla)", "value": "70eea516beb76694349d33d5059078f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602760, "uuid": "c441f1ca-7ed2-4a93-a928-6b0590105d16", "comment": "Malware payload (AgentTesla)", "value": "01644c5c4e2ec7f16c7da5cce41e0f80f071aef7a781405cbfb2052a2ad05bac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602760, "uuid": "e7489842-d12c-4cf2-b641-1679e5ec9a1e", "comment": "Malware payload (AgentTesla)", "value": "21d63e3870cb713e3fff00d1e4e8b730fdd28822", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602760, "uuid": "0e84db97-523e-4cb7-9890-53e30e0dd169", "comment": "Malware payload (AgentTesla)", "value": "85f91878ab8a9a3115fc32e15612149b7c37777ab55f3ca795bd6232ee3147552e6838f00bdd13bc2b6a289156f2e515", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602760, "uuid": "58e21e4e-2947-431e-a91c-818485960ebe", "value": "T1A634ED037E48FB11D2AC393B82DF6C2453F1A4C70673964BAF48AEA529416436D6E37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602760, "uuid": "04296bbe-1b28-4055-b376-4b1127524618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602760, "uuid": "7cc07943-f8ad-41e6-b14e-4ddaedfb5179", "value": "1536:26MRCm3OfAPRNOjyw6+vDaekSXw6UWrlycKjdaS8qGXbVGA5e4AJzeJ2AfNSEwsf:PMRCt8KwhlNjd7ZGbVy0TF5DEat0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602760, "uuid": "9919adab-1249-4708-9df3-3ae933a2aa51", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602760, "uuid": "e56ba261-7b53-4ec7-bd17-34405de72050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602760, "uuid": "9941eb43-0ce6-4b3b-8f08-3a211aeab5b5", "value": "01644c5c4e2ec7f16c7da5cce41e0f80f071aef7a781405cbfb2052a2ad05bac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20fbd92-4007-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692611202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692611202, "uuid": "b82c480b-ee92-44c9-b128-035844185f72", "comment": "Malware payload", "value": "1a92454bcb41d6ee6236cbc6100471db", "object_relation": "md5", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "RevBase64", "colour": "#30EF69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692611202, "uuid": "9690d1f5-9135-4048-bdac-0f99efc1ea1d", "comment": "Malware payload", "value": "01679480a2019561dc10aaa3b0e19e060bcf11a0ff755d189dcd4ba1a4d7f7ae", "object_relation": "sha256", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "RevBase64", "colour": "#30EF69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692611202, "uuid": "471225d1-a646-4b8f-9526-31974ed81906", "comment": "Malware payload", "value": "cbbcfc3e7f5b301ce196351e507ce2d49883db90", "object_relation": "sha1", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "RevBase64", "colour": "#30EF69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692611202, "uuid": "2a01d382-047c-4d69-ab3d-dc2e148eec1b", "comment": "Malware payload", "value": "7c635be48005044565acb3c209af605a997f1304cc5d1aed3fab839f1cc70fa5b96d5ebc911c7131e85be3d617bb9255", "object_relation": "sha3-384", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "RevBase64", "colour": "#30EF69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692611202, "uuid": "9ff010b5-9b94-478b-b837-a6dd3218f691", "value": "T13964877A6076EE8A87370D44D1043F579C199EDF6A7847F8B78801C1C19CA8CADEA5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692611202, "uuid": "00c45eb0-8305-47a3-b115-2bb7828a8f4b", "value": "3072:bKfZXYiTBP49GJ/vYzcCg6Up+ktpmN+lgD2wRY4IVAw97x3/2EElPD83W26r9BIl:yrP4+jC5a+kfmNRUVpN3/2nlh7RCqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692611202, "uuid": "f82d3d25-4d20-4044-9fe0-caa3daa50415", "value": 324955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692611202, "uuid": "d262daa1-ee58-4c76-b3ef-e5c23c144fa4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692611202, "uuid": "83470f70-5118-4410-a566-dcf123941773", "value": "li21 txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e2a7fc-4048-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692639240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639240, "uuid": "60bec509-d582-4145-86af-f25591794ee7", "comment": "Malware payload", "value": "19124312cafa0b1c5524329755a5d6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639240, "uuid": "66c4e9ac-8752-497e-b17c-3f32621d43d8", "comment": "Malware payload", "value": "0190e867668e9be091e3d52261b62ef9b65059565ec17168813f82e7693af2fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639240, "uuid": "653566a4-a466-406f-bccb-a4b2b10e0622", "comment": "Malware payload", "value": "ccd8c01b210b26cd708a3e4cc49de45fed9abac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639240, "uuid": "30b59e93-4e26-4b26-ad4a-513b63aa795b", "comment": "Malware payload", "value": "4abb7e3581495bf2bd536c38a093c6b89a3f4a2104b3fb6342550e0e8d229390aee46a657be415b1074cedf10c37e1bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639240, "uuid": "4f4f750f-4b30-4d39-91ec-0272afa7bd5d", "value": "T102769D217286C43BD56A01B1692CDA9F5228BF720B7154D7B3DC3E3F5AB48C21636E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639240, "uuid": "b27e1a55-2560-4eaf-8a7e-e11675b5c0fc", "value": "8708d1fe1b5ff509570e29ce51663405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639240, "uuid": "4bb8aa94-2c89-41ea-84f6-0e105246ee16", "value": "98304:Uw5gk9MwZAN5CWj5QrOZAzojo6VE3re7a6fXG44ngx5fVD2InA:H5gk9KH9q4SKaSG44nUtyIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692639240, "uuid": "6932b2af-e717-43bc-85ea-692a08106624", "value": 7465048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692639240, "uuid": "b7c958bf-8d46-4247-94e6-45770366e057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639240, "uuid": "cd4a45ee-2ac3-4e38-8fd9-da39254014ba", "value": "SecuriteInfo.com.Win32.Trojan-gen.16963.11783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3a0458-4056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692644906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644906, "uuid": "71a30c6e-59fe-4a2b-ab1d-62e6b013cade", "comment": "Malware payload", "value": "319e413d3208e2f20e72d3c0150ccbe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644906, "uuid": "2b2d1191-22f0-4ef0-8442-b9e788c6c02a", "comment": "Malware payload", "value": "02e127954ea7ec51aafffb27723dbea3a43c040dac796d5ad1957e6f000e5670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644906, "uuid": "9452a08f-92ec-4663-89c7-582668fa791b", "comment": "Malware payload", "value": "036c72d7aef21caecf0401ee7da132d2a56533ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644906, "uuid": "9ad83afe-9c16-4a06-930a-4e4f0c2709ea", "comment": "Malware payload", "value": "ec3b3c6e890a4e20ac14729f966c095c838ed4e1aaf671a902e6d63695762d0126ad2bd818c400bc7a6b4cbee6533c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644906, "uuid": "1a006e89-3c50-453c-ad2f-a9d5fc2b5afc", "value": "T1C6849C77B39642ACA9C416258DB2EF1114FAD0535A2D12954CEB0FF8F2E91F9A0CF06D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644906, "uuid": "83ac310d-7b88-4012-a83d-b70f40b24b37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644906, "uuid": "e0542000-ccef-444a-97ed-b697e9bb892f", "value": "6144:iBe73lX4CEB/eeXvYPbluzFOIs2niR1tJk+uPUYJBnMI:ce7VyXvYPblDh2EXkRBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692644906, "uuid": "3cf47bc5-d04b-4731-967e-6ecc1b42f077", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692644906, "uuid": "d6a5fdcd-645f-4fb9-8c5c-d228199228df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644906, "uuid": "c6c8a396-03f6-4d60-b1b5-af5a53dc004a", "value": "Kryptex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5e08ef-4067-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1692652509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652509, "uuid": "31073f8e-5fdc-4080-a1f8-ea5f359bc3ed", "comment": "Malware payload (TeamBot)", "value": "e3fdc92bcf0f49d3a846ce16db6b0317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652509, "uuid": "6a6d72bc-3bcf-4761-ad8c-eab61c6862ce", "comment": "Malware payload (TeamBot)", "value": "051e69720c0a79768b2b9ae0564c3f4b5775f2d2177d247cf49ba94b960e820e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652509, "uuid": "858a5294-b326-4446-ae3f-de4027c1a86d", "comment": "Malware payload (TeamBot)", "value": "e556419f0d7c6577be2219aa40d68b1067edc30e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652509, "uuid": "d59f0d9d-2fd6-4221-84ce-14ff757f3161", "comment": "Malware payload (TeamBot)", "value": "aae25f651a1f093fd18fee309790cd050646ec47ca05d561955bd646e4f60545bc2481f73ae9d1d88f32c9d19eca4829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652509, "uuid": "45bf059c-691f-49f4-9830-b70961337668", "value": "T12F44BF2362A9E871C4574631D92ECBBC7BAEB8714F599A5733180B6F0C70EE1C663352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652509, "uuid": "0bd3d032-21c6-4871-9954-fbfee72cb8cb", "value": "83f305571af3bad4fd0b459ab4b0a012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652509, "uuid": "5c5e7ee6-d080-4316-9f53-5a3b1e781448", "value": "3072:1tVZ7LSWYn37DiyG0DCrKLfvuDBfpRJl5XiqF:BZ7Lkn37OyGKCrsvutpRJf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692652509, "uuid": "f1d3206a-ac36-44e5-945e-166fb80de638", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692652509, "uuid": "60050ebf-7cc4-4c06-b199-93e6b2ac0645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652509, "uuid": "a1ec6db9-ff47-49ca-892d-57e8fb212ce4", "value": "e3fdc92bcf0f49d3a846ce16db6b0317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b78d19-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MassLogger)", "timestamp": 1692627257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627257, "uuid": "03bb8614-951b-4cfc-9d7e-26a451dc7cc1", "comment": "Malware payload (MassLogger)", "value": "099dafcf699c37adf990bf7926580917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627257, "uuid": "515c4ab1-0fda-461e-9111-a546243a9141", "comment": "Malware payload (MassLogger)", "value": "069395ba2c278a8d5fe946e6414c3b028d04e906a166055c0d88c8ef6baebacf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627257, "uuid": "cf4ada98-c524-4fe0-8a68-e4bf2ec5b66c", "comment": "Malware payload (MassLogger)", "value": "b7852fad1e4dcb261993c2d1662b591fe118af57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627257, "uuid": "df976f73-96d8-4f85-96ef-9378ecf4c8d5", "comment": "Malware payload (MassLogger)", "value": "5752726eb6e89c847bf188359584f3faf20a08c6075adb578fc137880ae678a3a8403093c7d710538564f3244309092a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627257, "uuid": "9bf12279-7328-4f32-85d3-cacaf6330246", "value": "T1CF834B0E33D49820EAFF857655B14211077AF852495BD31E1FE1B8AE2F367C48A92F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627257, "uuid": "460045ae-4afa-4d80-9498-1acddf3ff6c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627257, "uuid": "fb69c14b-73ca-4e31-b319-eb207d4ad4c5", "value": "1536:tmo1Hwx37bvvrinFnjoPYjivgYN58Fp9bLY8Bx9WwIL:oA87bvvrSjoPYjCgYjS9o8Bx9LIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627257, "uuid": "455fcbca-3c60-4577-9315-82a24164bba0", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627257, "uuid": "8ae501d8-3ae3-4500-90c4-bae5a98139c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627257, "uuid": "a8302190-7f0e-4e2e-8f8c-c2e51dea7b7c", "value": "KrakenStub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ae3607-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602799, "uuid": "34e30327-abf7-4adf-98da-1e8aca38de25", "comment": "Malware payload (AgentTesla)", "value": "958bbaa5edcda12a3888b321432128ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602799, "uuid": "3f616fa6-4e95-4f8d-b7fa-e83b51330938", "comment": "Malware payload (AgentTesla)", "value": "07dd3eb6c616776c6f2176b35e3ec9809b9fb835e255e94d8a8ecdc30e91aab3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602799, "uuid": "3c0041e3-91be-4f6d-a1b4-742ac3706e29", "comment": "Malware payload (AgentTesla)", "value": "57e4dc27180cf85bfc296506427f18c712e216e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602799, "uuid": "7ef26fb8-a308-41c2-914a-afc91aeee2ae", "comment": "Malware payload (AgentTesla)", "value": "d6d4ff48152f70fae9a6740c5c73e2b5e91f144f7c4f06237ec069c11dda0eac5ce13ba89a21421646d0aa4f6dcb8e47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602799, "uuid": "5a8f74a8-0a05-4a37-97fd-a5a810435787", "value": "T12774B012BEC04471D573293459F5A734993DBD200F368ACFA798762D1E322C1AA37BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602799, "uuid": "d0f586d7-c0d1-4cd3-9776-e3e3dc9b19be", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602799, "uuid": "8cb98282-ace6-426d-a1ad-b2a07dd5dd3c", "value": "6144:OQ+KaiKX2omqZEIvjzmW69H7hEYLjnl01cDthrF:aKry2/qZXzmdH7htPnlS0thh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602799, "uuid": "0a9af5bd-98f6-48a7-8e0c-1f90cabd6073", "value": 340314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602799, "uuid": "a5ae843f-ac2a-48f9-8133-3e70b2925500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602799, "uuid": "921afc0c-ffe0-4aa6-8104-551666c9c6a9", "value": "\u0417\u0430\u043a\u0430\u0437 \u043d\u0430 \u043f\u043e\u043a\u0443\u043f\u043a\u0443_(PO5203922)_\u0413\u0440\u0443\u043f\u043f\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0412\u0437\u043b\u0435\u0442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7f2092-3fc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692582795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582795, "uuid": "4ff08636-b187-457c-a407-043f27c8e4b4", "comment": "Malware payload (Amadey)", "value": "58097046a9482973b5be0240d04d232c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582795, "uuid": "ecdbed1a-0115-4a0e-bd1d-530ee17a84b9", "comment": "Malware payload (Amadey)", "value": "08e61151199e31c2cf54f12f95c8ad95ee8467bb630166800114c0b912682a74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582795, "uuid": "30979456-76bc-4baa-88d5-78d308f0fd0b", "comment": "Malware payload (Amadey)", "value": "c6fe197a59e6d1b11b7d5ccd519b19fe11b39891", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582795, "uuid": "2f1196ae-b741-4335-a8f5-208b1245320d", "comment": "Malware payload (Amadey)", "value": "8d6268da4ea541d214ea12f1872ff1f3f69e719dc9a954fd63ea82314a7b482d056067d7cc0694dcc156882dbd3334a9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582795, "uuid": "1bf7a91a-04c2-485d-b6c9-455d237c718a", "value": "T1C036BB91A750DA5EFFEDCE2AAE653CC7C066F3476C8299D40CC8A01D4E60ED476C28D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582795, "uuid": "70836349-7b2d-4ab5-81d8-5709f5f37e29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582795, "uuid": "94f2b05d-8d70-43c9-8e60-6f29b3fb767b", "value": "98304:UkOq61i5lL9NVVUvYdzg544F1+hZvk6die4eZOC6Ji5V5bNK:9xP5lLdVUvYZCT2vk6die4e56Ji5VNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692582795, "uuid": "a0d5986b-326a-44dd-ac4f-2e06d04240f5", "value": 5196288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692582795, "uuid": "f4058844-b961-44a2-90c4-1a80af551ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582795, "uuid": "dd726275-a5e6-45d8-b062-fdf91b1c91fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7b80eb-3fb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692576032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576032, "uuid": "91bb4351-cda1-4f96-bddf-6b8e4074074b", "comment": "Malware payload (DCRat)", "value": "a8fc6a0ba8accafdd8187d03f79a32e4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576032, "uuid": "93233aed-11d2-4b24-80e6-23ca464fe306", "comment": "Malware payload (DCRat)", "value": "09fc5f7263f74f847592f49a3dc7d58ee1a797157a335fb26146fdc798442ab5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576032, "uuid": "e436a1ba-d7e2-4274-b099-7e594467a8c1", "comment": "Malware payload (DCRat)", "value": "5260c3b2605731c10e66773ffd5ab641879969f1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576032, "uuid": "9e01f814-cafa-4290-bbf0-d07a3df77937", "comment": "Malware payload (DCRat)", "value": "ad5533cf576b9fdb6d96186491d36f3b66f0f98c4fc14cfb0deb84539aefce6b28e03b676b66e77c5462c79a2b882d40", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576032, "uuid": "38aa6767-8c5f-4f6b-840e-2a6024968aae", "value": "T176454A02BE44CA91F0191633C2FF490847B4AC516AA6E72B7EBA376D55123937D1CECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576032, "uuid": "6fcccb8a-4de1-49f3-a0dd-7b3dda9ac953", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576032, "uuid": "38b07a22-9cdd-42a3-9dc8-fb46014b1a7d", "value": "24576:U2G/nvxW3Ww0tb4fLzi6VkejONtpyXrLP1:UbA30UfLRBjODIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692576032, "uuid": "0fcb04be-25e5-4372-a431-c33653ec689b", "value": 1164413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692576032, "uuid": "7ac132c2-a15f-46df-ad78-cfe1589425fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576032, "uuid": "4a63eec5-8de9-41ce-b4e6-afe62ed16bc9", "value": "a8fc6a0ba8accafdd8187d03f79a32e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5321e2-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596217, "uuid": "e88ea6df-a4aa-47c7-85ed-b568e8c0a882", "comment": "Malware payload (Mirai)", "value": "546e6a1425fada9a66fb4c7a92160487", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596217, "uuid": "ad73c64c-d6f7-49b8-bd1e-975bf1bc5ade", "comment": "Malware payload (Mirai)", "value": "0a9a9c01904c1a04492942b7c25f24f11c57a7a4233e8003cb11638b2714f639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596217, "uuid": "8c50df6a-740b-4876-8374-647942fe5cc0", "comment": "Malware payload (Mirai)", "value": "515338240d160af5c9013091394ba22a7615b593", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596217, "uuid": "021119f7-f384-4c1e-bd63-1b817f27f6e1", "comment": "Malware payload (Mirai)", "value": "f4116a75effd1cc0b6c3ab517b57ec2b3d9996fd017b36cfbf4f4a32b06dac59e7d3cc3cf54d7c7e5cf3d7b443562abc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596217, "uuid": "2ad3ecc7-4937-4baf-9aef-4d8be2a8d0a8", "value": "T1CF3302A2676E29D191F09777FC32EC5A639C17A88C7730D62CF06A1577C58024EF2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596217, "uuid": "dc1b3aba-635a-43e3-a8d9-50b152abf403", "value": "1536:99O/ZMAXIxNUk0kLcPqF1aBexo4opKZbR:99O/ZNKyILGqFUFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596217, "uuid": "1ff16b48-6ac9-4deb-b04d-13bc19934b39", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596217, "uuid": "8bbe0a46-d51c-4a98-8424-28a950cc9a27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596217, "uuid": "8879c2e9-c2e9-4e62-b633-4fc41972e2ae", "value": "546e6a1425fada9a66fb4c7a92160487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee936fb8-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692647408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "52f70e49-6df5-487a-86d0-689401f73217", "comment": "Malware payload", "value": "dcb6b88e525740e6054cc8f84ff73d27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "8e8571f3-e759-42fc-9540-9cc6e8962293", "comment": "Malware payload", "value": "0c010cf4ec7c35ce737f4918bedbc4112b6a721392dcb781def256bdbf14cf47", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "f5ed47bc-b9cc-4c19-bf61-719ec6eb2d34", "comment": "Malware payload", "value": "d0ca6ba7c60bf5c3aac9f223acf2fa25e0e3271d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "e173fcd0-23c0-4f00-bfaa-f419db0b48a8", "comment": "Malware payload", "value": "d5d5b24995be5e0bf32f7db26fe133dd9538171dd4a6ca165e0b78e4b998d3ffb5bd334b8c1b0947efa27ebc86ea4b57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "a239c02a-c2ee-4fcd-9f90-a8d9565f957a", "value": "T16FE2DF015589D1B3C5C10CFFAC294A02A29E40A8D99301FD723515A8BFAB56ADCFB6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "4f78c3ac-2089-457c-81a9-ac27e04e8a99", "value": "768:BbOGgDtKZAbH1lciVYkQFI4TTZfazEKE3Wvn1OkhFKnwVTl3UP:BbAxUA5ckO/faZ1vnJ0nwVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647408, "uuid": "c38d56db-0d1f-4733-8426-1cbc1567a2bb", "value": 31452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647408, "uuid": "011b254e-8500-4262-9ebd-308b4f2501f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "e5c7c982-4d23-4845-9234-bb3d2c5e7342", "value": "devx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70246771-4026-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692624432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624432, "uuid": "76b1dbed-e5bb-4291-9564-95d6171960d7", "comment": "Malware payload", "value": "c5db585e10f33ba2290a5bd2371697af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624432, "uuid": "b3772842-8e34-43d8-b83e-670cdd829c71", "comment": "Malware payload", "value": "0d57ab7725b960a19d2d1472864e905a21c283d96273d41a1bb12fc1a00c5bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624432, "uuid": "454e1b40-85d5-45c7-bc64-508f59971745", "comment": "Malware payload", "value": "90a9265c3b698e0178a9e48c62d2ea6d33cda1ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624432, "uuid": "7b40691e-0a28-4e52-bb1f-98aac807787d", "comment": "Malware payload", "value": "14991b467bd3d8f8287221aa6e7a064a254bf6d1645640de5ac4ed67f623fb052ee7434a1f3a7cc5c24aa8ba626dda82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624432, "uuid": "5fe6a3db-6ae8-4ab1-b100-c226e3fca884", "value": "T11615E95CFA09DA3FD38C8C3950F9DB2B69B99BADD0E1E351C01191B518E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624432, "uuid": "d0d03236-924d-45ef-b531-af3c8fc204ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624432, "uuid": "2f9dfabb-8142-4c2d-89be-00a23dd200b5", "value": "12288:BzYljxsxos+Vv9/FK8WdTiqSV0ZsDDua2CeAiOqAUHSWrC:BJOtuDZgDhktOqu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692624432, "uuid": "06792d6f-9acd-4482-ab01-694e3cdb3641", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692624432, "uuid": "da732946-3f18-4437-8d8b-6ce7ae58a48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624432, "uuid": "6e9854c9-15f0-4021-a03a-77a4c7080c4a", "value": "new PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8804e91f-4027-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692624902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624902, "uuid": "1a8ba7e4-0e54-43f5-9070-cdf61815fb6c", "comment": "Malware payload", "value": "588cb1a8e7a30760b06e0d17e1d530da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624902, "uuid": "962033ab-000c-439e-9184-06b9b180a923", "comment": "Malware payload", "value": "0e48e95e34121c2872695725e6bc3a7b266112437733fe9d7f290e72d201f97c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624902, "uuid": "e72c103a-4057-43b8-9e1f-e2cb36b63954", "comment": "Malware payload", "value": "81c3b8ad80b3eab1cca85efaba50cc06f4fea922", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624902, "uuid": "962a175e-10c6-4d09-9bd6-0b7fc1ab48e8", "comment": "Malware payload", "value": "d59f14ca0df36f7d5891889364337f7d94975e91b7b7dcf0529750da7fcd3607ebf3c400501fd4f806d1924e998328ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624902, "uuid": "d9a9f2cf-78c1-4f35-a9eb-9799900847c5", "value": "T1B1235B447392C073E5DA163469BA865206BF7C93AEF4945B3FE9020D8EB12C17B2D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624902, "uuid": "4e0bd934-193f-4b7d-9b35-7cc4c034a636", "value": "e16bd71cc52f8b2347f0367958a2caa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624902, "uuid": "773ec0e3-ef65-48c2-9fb1-900a90071c16", "value": "768:MpS4WFkWFhTdW66YL36jOG7bYtEESAboWV2NKsEBsQyddj5MzxqD1wpz:MpS4U9XbgdKQf56qD1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692624902, "uuid": "aed7bffe-b689-4d5d-acb8-90f653f30a8f", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692624902, "uuid": "8b15de02-6711-4d02-8173-6c793c6a9e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624902, "uuid": "2bcc0591-0f40-4460-a653-450b04411954", "value": "SecuriteInfo.com.Win32.PWSX-gen.15584.26253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b14a83d-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610277, "uuid": "58ef8f94-018f-4dc1-8423-29b135b7de6d", "comment": "Malware payload", "value": "b4529b164b85653ed3d552ad6171625a", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610277, "uuid": "ebcbb90d-ffe6-4706-adf2-a5ec4164d6da", "comment": "Malware payload", "value": "0eefb9a1439bacca8b9b2f6fc215ba2e9682fc86ef15cf3df36a80b3045a1e91", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610277, "uuid": "cb5109a4-4b6d-4e43-9abc-77c6debcbd85", "comment": "Malware payload", "value": "0f62a02cc4fd94efe866b30f9ca15d3d531b99db", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610277, "uuid": "7c370174-3cd3-44ad-b884-69bf4cf2cc16", "comment": "Malware payload", "value": "04d71eae245dcc045b013010fe0e6813343346dc935911130df8eeb4ba877172768626ec3811768f3ccd8d886fa9ca11", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610277, "uuid": "20f29f5c-a0bb-4315-a4ee-536654ba423a", "value": "T11E31C1321522804C9EF24C5D637EA77C67B7C4183BA4D7AEA79809A85C02A7B857CC5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610277, "uuid": "79057656-0c80-4a62-b4b4-e9c8639ec588", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlM4ItakK:4oyeP9YeYaMImCmY4ItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610277, "uuid": "adbf66b3-0be0-4296-aa20-5176c1c0302c", "value": 1800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610277, "uuid": "028a7217-b7b4-4b6f-b78b-fd881ffc89b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610277, "uuid": "53cfd844-043c-48a2-85e8-2a33dcbb3e62", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d43673a-4020-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692621904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621904, "uuid": "b8e0123c-5c55-4f4c-822d-9e9fa57048db", "comment": "Malware payload (GuLoader)", "value": "713d9a176e2b8e86459e334b5d3d3eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621904, "uuid": "86062083-8264-4557-91b1-1ec7a0828d04", "comment": "Malware payload (GuLoader)", "value": "0f63dd5f968d6de1240cc5122c8b0227b4ea5558abd145435a6c0ee84a62d5f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621904, "uuid": "eb6261b5-04b1-4bf4-a965-e870f07d0003", "comment": "Malware payload (GuLoader)", "value": "2225a62d777f3bdae2ac44b2a24999182d5e2b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621904, "uuid": "05e22f79-4017-4910-a338-e59276f2ad6a", "comment": "Malware payload (GuLoader)", "value": "c131320257a1051972d864c6cc508d2bc298441617fdb7bf44dbe8dd550761404a6d11f7790b2aed0c1ea58a1f84556a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621904, "uuid": "ca7eda62-483d-4f0d-97ad-caed8d00c06e", "value": "T180B49D9239CA756FEC2F4A74035FEAB22A755CD0739249AE5F40320D4C3664A80EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621904, "uuid": "80622e9b-6851-441e-adcc-e0cd31c88e97", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621904, "uuid": "05df39f9-3eff-4e2c-a43f-ba09b884b307", "value": "6144:qMfQPZVheNA+ff0O5mR7pxKKnI/Z8fFU1dPrLHiBYYlPRWkt7MgD5Cw1yQ3Mwg8:72nhe2e5gzxKZWfgiBRNRWa7MYoPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692621904, "uuid": "57c09bbf-b5bb-49fb-9c0e-6c4a6498974f", "value": 510992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692621904, "uuid": "6c82faed-b2e6-42bb-81b6-926d7f5a1247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621904, "uuid": "27d5debe-2552-4604-9eaa-74e1125e19bc", "value": "re_160000676_165004943_c60_60178163pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404ca3b5-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692629936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629936, "uuid": "6cb621da-b4b5-4cc4-8f99-baa5b75c1b64", "comment": "Malware payload (AgentTesla)", "value": "20ecbc56aa1a151c24849914ed4c7601", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629936, "uuid": "20d96fc8-31be-4385-a097-b531ee34e922", "comment": "Malware payload (AgentTesla)", "value": "0fce8ae83f10479e24aff84627d2cdabe5f656b9e2db600a136b37c818b7ca8f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629936, "uuid": "5a010f84-dafe-40e5-a060-368f031c6c7d", "comment": "Malware payload (AgentTesla)", "value": "070cb4190d9d3c569967e0f7f0a8963e8789cabe", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629936, "uuid": "c95ea666-fb08-4dbf-bd0c-9aa4d559a789", "comment": "Malware payload (AgentTesla)", "value": "c13dd374a0a4ca319179cc828e5d250c7652a48d112fb0e23773c10097a00f78568c6aeb1a3c556bff2e591909dfffdc", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629936, "uuid": "8e84524c-5196-4182-a1b9-cdd2d9a3d667", "value": "T1A0E4E09037FDAA4BE9B6D6F855B9114443F27E6A2120E3DD1DC520CA28F5F404BA1F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629936, "uuid": "55e10ba6-f335-4fbc-9da5-d4ce67b862b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629936, "uuid": "58c66c51-6c9e-48b2-b0e0-b8b7513173e1", "value": "12288:W3mHFFDMd9jAgBHpM1Zo1wG3sRQuy2HqkU+F7WNoZMvLl3Qu:wmXORvy1WiJyrbDtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629936, "uuid": "1288c7a9-a47f-4a3a-9173-f4654bfbb465", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629936, "uuid": "94dfb2a5-b073-4f9f-8035-85187f23bc9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629936, "uuid": "39180235-2ba0-433e-8972-c4b64e3c5e90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b030d96d-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692627546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627546, "uuid": "1fc56ffe-79f1-45fe-8c78-84b72857dc55", "comment": "Malware payload (Mirai)", "value": "b643f9c04322ed4b01d48b18ec2443b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627546, "uuid": "5433395e-c74d-416e-bb37-bb461c283085", "comment": "Malware payload (Mirai)", "value": "1063787de4737db2ff83e049eeffbed0dcf2d5be0485b4037644b198b6969a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627546, "uuid": "0cbc1e67-dfeb-4376-a163-becc1caab9bc", "comment": "Malware payload (Mirai)", "value": "f423656eadb38667eb77d9ce60f672819f11dc25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627546, "uuid": "47f9a998-a7ef-4820-873c-e927bdecbc48", "comment": "Malware payload (Mirai)", "value": "356ac608e7a117a2c5cf97822b4aee0d493790b2af40d136fe70f0c00a28a8fdbb1191c68e84361f98c04c3a0359b073", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627546, "uuid": "51b6a11e-608d-408f-80ba-03ff46d0e3ae", "value": "T190336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627546, "uuid": "bc6b1a43-5345-4dc6-b1e1-96a0f75db3d4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627546, "uuid": "3726daa5-b075-4883-b69a-038c60e5e9cf", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627546, "uuid": "71033b4c-f6a5-4d62-8839-54b1e351130c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627546, "uuid": "1e4306a6-3e14-4e87-a63b-2fef34efce10", "value": "b643f9c04322ed4b01d48b18ec2443b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c755b5-402b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692626405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "715541a7-8789-4ef8-9201-29bd76c5effc", "comment": "Malware payload (Mirai)", "value": "ca064c006af20b548b1b79c4e207e72a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "e1149fcc-8407-49cd-bbad-4550b421eded", "comment": "Malware payload (Mirai)", "value": "10647925d95c79e57a67c3e58a7cdd8f3a591e5bec1df5194c6f40cb8774e8de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "d211f0db-62da-4b19-a8b0-6090de4d8e0e", "comment": "Malware payload (Mirai)", "value": "98f7cd2fdb8374cb398e75342c67f4c3ccee4924", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "ffc7aec7-517c-4ed8-8aaf-0182e40192fc", "comment": "Malware payload (Mirai)", "value": "1ce7a8799f3b03ca3a33fe76b0a8a8f3b101332736939a24b7afdd2f92f551804f36491ce1aafe6ba110747004aa6cf7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "9b6e268c-9aae-4eac-8e9a-7a0116963f2f", "value": "T1ADB2C0CD61543084C98D7C7C278D4A665F6CA1D0BAED9F26E350CD98B3BEA4F3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "d91f1016-916c-4a4f-a050-6e9effe47557", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBp8XjZqEWv1:/QlS07FUXqIYSXQKqu8X1qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692626405, "uuid": "a2a2f50d-18da-448e-9c24-47f158955a5b", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692626405, "uuid": "92c9b38f-5177-476f-bebd-aff62bfe6d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "b4998f9c-7e61-4ddc-b108-583a8f00367d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ac31b0-3fdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692593140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692593140, "uuid": "fc448dba-f4ba-42a9-a9b2-ae20291ad8b8", "comment": "Malware payload", "value": "4019c66c4f377d53ea9c9b461ba8cd16", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692593140, "uuid": "b2576d4f-3bdf-49ae-abcc-ea10c5baae52", "comment": "Malware payload", "value": "10ba9f88d25be23954a4fe5a037c41c4b28c8356583a0a54da15d38237c59080", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692593140, "uuid": "c57b54ed-bf2f-4529-af02-8d81dfe81f8d", "comment": "Malware payload", "value": "bfb0b3cbb87813d880762d5263ac897fabd42266", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692593140, "uuid": "de537f8c-0dc8-4aa8-a772-a72d76040338", "comment": "Malware payload", "value": "feb34776a3745ac5bba24050597c6d2b6d95d31dea469624fd1a4afdc696830b19996f35697f10c408ab334fae2917f8", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692593140, "uuid": "8fc3687d-7f97-424b-b917-9859235686f9", "value": "T15652F8296BE48234D6BEBF725C32A68106B1BE08DD33DE6D09D4A41D4D736448EF1F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692593140, "uuid": "b8edd5eb-152b-4da1-9e52-d5c321d97ee5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692593140, "uuid": "3e4b3de7-589c-4c47-902f-7ea0dcc74042", "value": "384:1nlkLUkrgcMdhQ1C5SONZiufchrMIndsQUkkS/gjHpB:1lkLUggphmC5XzqhrMI6KkS2HpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692593140, "uuid": "a47450d7-3131-4cde-8bfd-b754a21122dd", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692593140, "uuid": "64f92ea2-788a-4d75-8142-dd4bb13516b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692593140, "uuid": "f9e14b95-540b-4ef1-ad2e-2dbfd8ae13ef", "value": "1692593139c4ba7d39577763d6519b748e8f8b485ede1d057fe60708c44c84ae577887040e236.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3100111-3ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692605325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605325, "uuid": "48229028-4777-43d8-aeb6-5fd77a8d8695", "comment": "Malware payload (Amadey)", "value": "c8539848d047d28a28c78ca364247e97", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605325, "uuid": "798a3ed5-d513-460e-836c-5acbd786cf08", "comment": "Malware payload (Amadey)", "value": "112271b9c7f18734a5ea9c0e41bbaa1f7a493ec9dd83c8a10fd133067f22c9fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605325, "uuid": "08a3bf70-1b7c-4b4f-ba95-2b8e8a3143df", "comment": "Malware payload (Amadey)", "value": "24e5b020d397a9dbdb73526f89797035ecbd2974", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605325, "uuid": "17c850f7-0c69-4b96-836e-f7f21c399985", "comment": "Malware payload (Amadey)", "value": "0d20c92a39bf6a0f7df51f07aafa4674b7ab0c18d6b349d4d1143d521ebdeeabd89bda09645d63fac5682084bd071e57", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605325, "uuid": "2724fc33-f810-4c05-bc5e-a422b0c5c984", "value": "T164252212E7E86836D5B027746CFB22931B373CA21CB8566A2385596D4DB3690E473732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605325, "uuid": "7c8f01e9-3dc7-49ff-bc56-c639f45483af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605325, "uuid": "dad237bb-029c-480f-bce3-e32a94c5c0d8", "value": "24576:ty8hm82CQ8qf2JNlFCzdw3Q23yPWzshLK4:IIJrQ8M2JNlFCx/PWzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605325, "uuid": "d6a2d6a9-5ba7-4f4c-a53c-15995dd63fd6", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605325, "uuid": "230baa2c-fb8d-448d-aef5-cc5ee1d83c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605325, "uuid": "a6b45620-a779-4fb9-9ee8-72870c2548a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b8c4c0-400b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692613035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613035, "uuid": "8b625105-72f0-481a-9db0-d739fcbaf885", "comment": "Malware payload (Mirai)", "value": "83e7bfc39d47b9aa0c656325d9a8c789", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613035, "uuid": "82967d5e-30fa-4198-b4c3-62cc48d18046", "comment": "Malware payload (Mirai)", "value": "115b556446dc00d4f851fd6908e50801e80c7057751ae8015fcb3c1397837a79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613035, "uuid": "42a5cce9-7a86-4947-b035-04b0289f2662", "comment": "Malware payload (Mirai)", "value": "d4e86d2cf12e9a9d13553e38f054ed5e0ce9a596", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613035, "uuid": "562a731b-14aa-48de-b3f3-a69b8306228e", "comment": "Malware payload (Mirai)", "value": "a3bd636dbec775749c336fa6f5bd23b9f754190db311fcdcc206112b99a2756cbf3cde08197590e223fd5af07c65ab8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613035, "uuid": "10103403-e2c3-4dce-900f-a16a08a725c2", "value": "T150334AC4AA97ECF5EC1506753073EB338777F03B612ADACBC3999523A881A41D50B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613035, "uuid": "55df486c-c107-4f17-9fd4-51458a984d68", "value": "1536:Z8MgMbNgZpAu+h9afOs+ORXZhgg2NvC4ObwkZw6PBe:azMbKZpADh9U+ORJhgnxC4sfJZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692613035, "uuid": "cb3e2487-099e-4d70-b505-8febe8c829a4", "value": 54288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692613035, "uuid": "fb176206-4b6f-4194-858b-65121749897d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613035, "uuid": "577c4d4f-6288-4fd1-be6f-69380669ae4d", "value": "83e7bfc39d47b9aa0c656325d9a8c789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04502a47-4000-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692607931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607931, "uuid": "930738a2-039a-48a0-9c78-f32d6182c6f7", "comment": "Malware payload (LummaStealer)", "value": "0b02742b5d489839e5e112bfd2e0e653", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607931, "uuid": "fde74ddf-bcf1-4db5-8342-1316f73c3bcc", "comment": "Malware payload (LummaStealer)", "value": "130208c4a8f02c294315c49274f1e5266d9e1e38290c03ef5d1fc192cb8748f7", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607931, "uuid": "f4f9f40e-7fe6-4bbe-8d83-e04404aaf839", "comment": "Malware payload (LummaStealer)", "value": "f1d5afeac227fa81e76a57374d6614fa078e4865", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607931, "uuid": "54242973-5233-473d-8d9f-a9d4f80f6546", "comment": "Malware payload (LummaStealer)", "value": "af8b792b1699255879f3239138d52ba44516147ec806b02ca6efe8a357ae608f7cd23db48d49d6d7f93633e887841ea3", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692607931, "uuid": "0705b16d-7010-46f1-b046-a7552caeea87", "value": "T15016BE12B98ACDBAFA6F6932947AF6B2137E7EE0077244C766D53D7E19704C00631B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692607931, "uuid": "89ef0e4b-5b6b-4a3b-8815-46356bc5a534", "value": "98304:kvCv+uKTFHA+XWBflMPzidUtybVkw0KAKnZelHS:2CLYIBfMEbqw6KnAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692607931, "uuid": "3be6a89c-a9d9-4854-b841-d079c1dc6b0b", "value": 4345344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692607931, "uuid": "89539180-6580-4f78-bd18-6f25a75191be", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692607931, "uuid": "d6245e06-0cdd-4edd-802e-d4dabfde3e37", "value": "0b02742b5d489839e5e112bfd2e0e653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76204982-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610269, "uuid": "9a35891a-51b1-4ac7-9720-eb45608c8d2d", "comment": "Malware payload", "value": "02cf72ca035407f9ed7993e58097a775", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610269, "uuid": "8fc1c6c4-9719-4072-8ac2-355042e2a900", "comment": "Malware payload", "value": "13b829763e4dbe9d7c71d2f7b2b654e2ab0d0a12be4ebc28460515833dfe2c55", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610269, "uuid": "91d29f31-8067-4334-b7de-7e7f2516572c", "comment": "Malware payload", "value": "cfbbff6b42d110932f62845c0c7e78b0b5d4b8d1", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610269, "uuid": "ee766d5b-8565-4dab-a290-26204d728612", "comment": "Malware payload", "value": "b22920524a443f584eac060eaa6554bd37055b917a3e04b0a85689947bedd8e5e617c74d416e832a3d3e39ef3b812a0b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610269, "uuid": "a2adbeb6-0c9c-4c42-ab1d-7e9a5b0d16c2", "value": "T13F31B2331522804C9EF24C5D637EA77C67B3C4183BA4D7AEA79849A85C02A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610269, "uuid": "b19362c1-b045-4fb6-807b-1d5331a32b11", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlyfItakK:4oyeP9YeYaMImCmufItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610269, "uuid": "95ccbdf4-2239-4a4f-8f66-49fcff64ca5b", "value": 1792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610269, "uuid": "bce40e41-6173-44be-aa3d-705009f3d08a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610269, "uuid": "d6c6cc9c-8faf-4081-9d66-3722b0d3b058", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c31a758-3ff6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692603837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603837, "uuid": "2af8f253-07f1-4207-99b2-050ec69ae682", "comment": "Malware payload (Formbook)", "value": "0ffd72eec6cba70da080f56fca50afbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603837, "uuid": "33f8363f-bb1b-49cd-8768-497e65818145", "comment": "Malware payload (Formbook)", "value": "155240d8bf35cc3a5c6b2703440162da4cdeca7d3faab01e656a4b401e2eb15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603837, "uuid": "c98f7714-924b-467b-814c-6219bba2383b", "comment": "Malware payload (Formbook)", "value": "b03ae14977597fcb9e091ec8b9c6875a9c21d455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603837, "uuid": "c76e2148-634f-4816-9f45-b306cf017f9c", "comment": "Malware payload (Formbook)", "value": "80c8786cda38bdd190af1849fd783f4369cab1e93739af958dff4abe5f2c7ef55f3986abdeebbfc5797c2f0e27903db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603837, "uuid": "cc43e8c6-1a85-4f70-b22a-901066aaca82", "value": "T162441290BAF4C4EFC4730B710C36876659E6D91664B8875763606B0A797A301EECEF32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603837, "uuid": "8c24b47c-8223-48aa-9e2e-c147b4db58f4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603837, "uuid": "5db8410d-f538-4144-a81e-dd3cfb93dfba", "value": "6144:/Ya6cV5hOjPq2FBHZweADX/t3uN6LUxiIGmIV+VwgB9Ed:/YSV5SPqkNZwxIHiIGmIV+vB9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692603837, "uuid": "80cf6507-a6cf-474b-97fd-fa3d28a096c8", "value": 259996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692603837, "uuid": "52605614-6279-406e-8533-afedeebb1bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603837, "uuid": "5fe20846-2a43-4299-abc1-f566e9a19026", "value": "isoHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2844368-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692627523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627523, "uuid": "015405d1-91e3-4d2f-a47a-bfb622f9f2fb", "comment": "Malware payload (Mirai)", "value": "699208c8d349fc3cb354ea034d483845", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627523, "uuid": "88fb8b66-5768-455c-8046-4c4e58cb64e4", "comment": "Malware payload (Mirai)", "value": "16aef158ba153ab87de8f6d5fb01670f017a41f34aa7dfa7786bbc79c45e671d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627523, "uuid": "ee361d06-918c-4893-afda-1588de8d1fdf", "comment": "Malware payload (Mirai)", "value": "6fb855419ba26e60bee8f4245d781546380aa933", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627523, "uuid": "ba38908e-86d9-4e80-ba1a-a9ddf5516e74", "comment": "Malware payload (Mirai)", "value": "f3861a6fb90c5af06b68efe575f77bffb1d311934e855a900ae030d9a9d3d7e5ff5a17e67090062e0e7e40dea3ed1b83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627523, "uuid": "d46368f3-f073-4ddb-989d-669683cc8358", "value": "T1E3230261880A9DB164703C72EBD99383B6E12AB1C5673023D62C0B3C6F74B531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627523, "uuid": "f195b95c-8334-4382-9007-5498f6143184", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3h9q3UELbUXfi6nVMQHI4vcGpvC:gECFd+A6YHAxULRQZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627523, "uuid": "9bb4b831-df22-48e0-a3fa-34a6f08f3d50", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627523, "uuid": "0c105bc5-ce38-4ac8-8399-13af2ee3c298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627523, "uuid": "424c47cf-8e76-44a0-9eb2-5293ffac9963", "value": "699208c8d349fc3cb354ea034d483845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45cd1c3-3ff5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692603609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603609, "uuid": "6bf3816d-ba5c-43bc-b955-3108c9f42f19", "comment": "Malware payload", "value": "a76b0ef48628beb40af053708c225330", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603609, "uuid": "989771d2-0d62-4fb7-93c2-ab85bc904524", "comment": "Malware payload", "value": "16b26e7e9af25df444a45be5a31fbd3e1ff7b57b85cf027fc0ce6611382ae60e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603609, "uuid": "8e3d9392-9ebc-4d98-ac6c-b00a83d6310f", "comment": "Malware payload", "value": "1cf558f4a65c48f438da006765f008b75b115513", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603609, "uuid": "9d3368ba-c011-49a9-b2fd-62fe7e091874", "comment": "Malware payload", "value": "8f13386374a867eac79ede61b1449d6cd3db87b840565846639f4dd21c28f969eca3e93d5baf06ea4c1af04c0213f98c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603609, "uuid": "57bb029f-be87-4a42-9cf1-60acd04971ae", "value": "T1E2215922596340889DF28858577E963C57BBC4043B70DBAEA79909A41C01F7A8A6DC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603609, "uuid": "b0711842-66fc-4947-b8ae-b1d09d1c735d", "value": "24:Qr8Aw8qxOrrhrN6piBZrzWu5gw991jrbNTAuLtFWBEBMIiFWGA5UNvFWqaL:MwSIiXWu5gw/TAqGEBMIsA5UNPaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692603609, "uuid": "2634eb4c-354a-4889-9240-98704783512c", "value": 1152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692603609, "uuid": "f37530f1-6d2e-4ecb-80b8-eb0942f2bb65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603609, "uuid": "d15115e3-a558-4f84-9375-dddbde91b3e8", "value": "Photo_Image_Store-MnZ8RD7ic7oBUDadT3RD-22100-17668.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e449711f-400b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692613031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613031, "uuid": "3f4e93ee-ebc2-4f07-b795-87066bcaffa8", "comment": "Malware payload (Amadey)", "value": "05ed7f80c9a3d4df8013dd84b7d0841e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613031, "uuid": "6a56cbac-de3c-4095-8d5b-20d234f64c2f", "comment": "Malware payload (Amadey)", "value": "17e9943c01ded30ef2334a1c43f3c38206e824fb6e4be3db4bf75745350a584e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613031, "uuid": "183be7ac-13e0-4572-8937-749341932a73", "comment": "Malware payload (Amadey)", "value": "fcc4521c9eac39bf0dbab47a3124b48d74f34c4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613031, "uuid": "ff714216-b812-49a6-a1f4-65a20bff8c0f", "comment": "Malware payload (Amadey)", "value": "8988e7d33a1d89c63eaa818a5cfb4fe6f74f977d9dce1d7bc0befe3338b3ef46ffb8ca875c54682b9f2c7dd20fa14f55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613031, "uuid": "25c4b133-8481-40b6-ac28-05ad2f94f0ff", "value": "T13B252383A7E15522F8750B70A8F703D35B35BDB28C74A24B3256D81E4972AC4E673B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613031, "uuid": "19ad4300-cbed-4476-b19a-15192f741d14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613031, "uuid": "6fdd70dd-769d-4df0-bbab-7a0adc8f5792", "value": "24576:oy5EoArw8TRzXaRzXoQupqdFmWBkZ6Y6dgnKnw2:v5EoV8TRzXA/umFI6Y6gnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692613031, "uuid": "ca13ebfb-2c20-4a00-b361-39526e1f4b53", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692613031, "uuid": "04e5386c-0769-4a37-9f51-bff9ac722c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613031, "uuid": "c57d6dda-6acb-486e-a9b0-146551f466ef", "value": "05ed7f80c9a3d4df8013dd84b7d0841e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdabaed-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692630176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630176, "uuid": "7d7104c6-3948-4123-b97c-90558aa25064", "comment": "Malware payload", "value": "ff03b431aa9f1c32c372d5a49a10d71d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630176, "uuid": "0bd27884-080c-484c-bcee-bb0fb022886f", "comment": "Malware payload", "value": "18283fc3167ba2493455464264ba8c635f67c232020992a8a8883bf01578a195", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630176, "uuid": "6655f3bc-6ebc-4005-bd8b-0cdc54c166a2", "comment": "Malware payload", "value": "4e1dae85cd6403ba43b276fe8e9cb608bf8ddb5d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630176, "uuid": "8aa798ed-e742-4e7f-adaf-53dcb1e20a26", "comment": "Malware payload", "value": "9ec463fc06a1c4b94236774b103a015d5520a6347cc1cb8b9bf8487ceb7b7a0ac7910dc1dac2c22152e9a7235ef8d8fe", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630176, "uuid": "1f9ad250-4848-45a8-a88f-9fef0dc4e553", "value": "T107C4DE3466DFC712DF2B0E3366ED1191043DAD9CA3024923D798607CBBA3F625E5E6A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630176, "uuid": "c3425308-47d8-4189-9137-739b0180bd23", "value": "12288:oABVL6FUf6MJU/ST6Kzn/0wqLz1R4ZcRUu5nXg0lBIyNj69ag:hpSUyUUqTNb/gHRUmg0lVjTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692630176, "uuid": "f57bfcf2-c017-4a6b-8941-77e5d8981a0f", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692630176, "uuid": "8e143188-fa1c-4993-a4e6-fcda04a99dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630176, "uuid": "f1a30a2e-5130-4267-8a63-4d9f53bd0853", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb09824e-3ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602761, "uuid": "2fbeb1ea-6ddc-41aa-84cc-05ab57092d7e", "comment": "Malware payload (AgentTesla)", "value": "f974b7543f875f3460fa946e01a36ee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602761, "uuid": "e2e3af52-9db7-4e17-8a0b-f7a7d27b9192", "comment": "Malware payload (AgentTesla)", "value": "186e9ac371aaa85c335ee912e54c1d8d444022268dd47570a7373c6cb830ae8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602761, "uuid": "72f06672-9201-4160-851f-c14f5dd12fb9", "comment": "Malware payload (AgentTesla)", "value": "c00dd52af949acdfe453832b3737e30781a3eb5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602761, "uuid": "70592590-f8a2-488d-8bfe-fc2491114a14", "comment": "Malware payload (AgentTesla)", "value": "0e94377d538a6c968b28b012dfef934a7b3640bb59c342aeb7e097da50ec4fa4316df95063b8df84fd2d3230853321f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602761, "uuid": "cd1f8f90-7cd6-4e2e-8dd8-3281ce3a5255", "value": "T16D34DD137E48EB11D698393B82DF6D2413F2A0C70673964BAF48AE6529592437C6F37C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602761, "uuid": "78529994-3f89-4ee2-873c-c02b66acff7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602761, "uuid": "28a10da4-961e-4ab2-82af-6c5f9b35a593", "value": "3072:Uu/G472dG1e4V+BbEahaiIZQNpa0LzkEsSYb:UsGg1e4VWbEadIApdzkcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602761, "uuid": "daad2e9a-d0e2-48d7-a1af-cb62a161aedd", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602761, "uuid": "d6c0b3fd-3c04-41fe-92f6-b274aacfceb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602761, "uuid": "95ceb2bf-b7f8-4230-ac2a-fc2824d856dd", "value": "186e9ac371aaa85c335ee912e54c1d8d444022268dd47570a7373c6cb830ae8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d18dbd-4038-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692632388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632388, "uuid": "45f7020f-acbd-43a2-b913-b1b5d9d50544", "comment": "Malware payload", "value": "89fbe5476cbd2b4fa4a190942bb05698", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632388, "uuid": "3443fb26-ec39-4eb0-854c-0e5aca35d4cb", "comment": "Malware payload", "value": "1a7badce5f3f35c5d1a8127e206cf1fc44e38d1713b85fd35b11ae1241db66f6", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632388, "uuid": "8471763b-1344-4d3a-8695-87489c7b8e3f", "comment": "Malware payload", "value": "b3fbd7aba2a06d4d56f751f35a148759b8cdb3e9", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632388, "uuid": "2be4e6bc-9249-486e-931b-118fee731298", "comment": "Malware payload", "value": "5c18c31131b702d31f9074e4ac2d00f97869f796ac6ceb0c0986fe26525c8e19a551d10dc0107557f52c91345b508d33", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632388, "uuid": "5b413283-1104-4d7c-a725-cd33973cd32f", "value": "T1F2520905A7E44638D9BF6F725C33A20142B6FE85DD33EF5C5994852D0CB22884DA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632388, "uuid": "7c51fe33-f6fc-42a7-b6c8-ed2931067566", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632388, "uuid": "49925036-e58b-4243-b4a1-72259ebf8ea4", "value": "384:LAWznOP0zOLijgKFBe51nbGyfchtdsQIUS/Of:LAWznOPEykFBg1ShkeSGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692632388, "uuid": "824573e0-bd56-4cc1-ae69-beb3d936dc01", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692632388, "uuid": "324255a1-f6d4-408b-a074-5c44174bbcb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632388, "uuid": "9106bb32-a701-41f0-b615-70a87682965d", "value": "1692632386a1c2b8b0e5b23944e1c31bf06aff9032f3e12f782b3706930736588f86699bbc756.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a769c4-3fdb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MassLogger)", "timestamp": 1692592062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592062, "uuid": "d33ed38e-6fc5-4eab-81a4-3a67493005fe", "comment": "Malware payload (MassLogger)", "value": "b304c62dee801689bf60e25aeea14503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592062, "uuid": "5000baf9-f063-4f30-bafe-661e9a6bc1f6", "comment": "Malware payload (MassLogger)", "value": "1a9580a9f9bd565ed13ef7af3ccc191e790a530c995d695965277985d29a11ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592062, "uuid": "e15c0b32-ce12-4fb8-a714-b6ba3e759534", "comment": "Malware payload (MassLogger)", "value": "12a3a89ffa8a2365315a9b196379e66f6e283ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592062, "uuid": "21f4f6da-e963-433e-b2e0-98ea24d0303a", "comment": "Malware payload (MassLogger)", "value": "3a2269f3248ae3014b64d7132c1631b76f459f510e8a3e23e0b870a42d7f65b3a5bec0767ce22c5c5e37269d3d8d9320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592062, "uuid": "8b257a7a-ae7f-42fa-9ccd-a85062999897", "value": "T1A094026DF2E12BE0FC95C979D5543FA54AAB131A0413CAF2D734608F0FFA285E9941B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592062, "uuid": "8f65efbc-a4db-4594-982e-600c1c3d1257", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592062, "uuid": "bfe99254-c647-4b21-af14-798bcfa389de", "value": "12288:z3sS7RpcldCRLlcAHawZgiDv9mzXSL+uMSn9X+GbwQ:z85lsRpnPqiDlm267Sn9X+Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692592062, "uuid": "f858f38d-1695-45b6-8488-e9c00c4b418c", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692592062, "uuid": "369b1d9a-5be9-4c06-9537-970d191fe7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592062, "uuid": "635f6fbf-6d99-4e00-829d-649dcd3cec98", "value": "SecuriteInfo.com.Win32.TrojanX-gen.8413.13557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549de2c6-3fca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692584873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584873, "uuid": "4ecacb2d-f08c-42e6-89d7-49d95f3c97b9", "comment": "Malware payload (AgentTesla)", "value": "75181320ea3b8765dd40bad311d90621", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584873, "uuid": "201488bf-22ef-43ba-9e17-cc5fc60d4b50", "comment": "Malware payload (AgentTesla)", "value": "1b3a82f21226cf22c6b935eeb7ca17fc2c36ec65cbf1f4fc32cc8b79fb3252d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584873, "uuid": "dc70bb5f-d243-411e-903b-8e45c03a16f5", "comment": "Malware payload (AgentTesla)", "value": "afbbc390f746d409122bdc8a824989f2cbfb6ab5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584873, "uuid": "b8d1a9dd-5c91-4b36-ac46-3132cfba9c8a", "comment": "Malware payload (AgentTesla)", "value": "d7047172ac72e5ddc6cdbb7eee544d7c81459dd5d2de91bfbc2909d07105c26a246ac480eb51143afc67a73835fa2587", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584873, "uuid": "aeb217e7-684d-49d5-ac9c-639a7f2cda6c", "value": "T1D805D04173272815DA85F83A954FB6CC5AF328227B6247FA3CBF235045650E6CAC9E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584873, "uuid": "608188a8-f7be-43ad-971f-cfce0b886bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584873, "uuid": "11fdfb56-8fa3-4966-a8e6-c9b086b63c1b", "value": "12288:IssBSinvqdkyWw2svBQ9usr859FdtXDFTcGp6sVCTtUzxLhq//sPgXeMv33Gq8WD:IssBSinidkj9u7z/A8MTGxLhqiQ33I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692584873, "uuid": "7c20860e-b506-48ba-8b62-9e7bc4d8ec17", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692584873, "uuid": "2915b33e-a60a-49fe-8c49-eb3d5fcec27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584873, "uuid": "a4ad0241-e6a6-4d77-b59b-c20335cb0695", "value": "SecuriteInfo.com.Win32.CrypterX-gen.19846.9171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b09e3af-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692602788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602788, "uuid": "66882595-6b12-4838-a950-c3d52b32fc63", "comment": "Malware payload (Loki)", "value": "9c28b35fa30057b169dfdd7f2ecb3880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602788, "uuid": "0a594c78-bcf0-465b-b949-af149b07fa17", "comment": "Malware payload (Loki)", "value": "1d351ceb7d0a2ccafd111aa4b85c7d6bb7917e51f4db8599f6e4789cadbe54b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602788, "uuid": "3037aebc-eb4e-4b59-83cb-9b786cde5c87", "comment": "Malware payload (Loki)", "value": "04809edf852e964b693e53fdc5d8fb459327faeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602788, "uuid": "71a2965c-f7d9-4b3f-8b12-bb02858c010b", "comment": "Malware payload (Loki)", "value": "9e6c5e6efa7226700ae63e6d05d9deefe83f726f861e20f32c6a7a041c2573ce87fadbeb6fe11bda6d0a1688db07368a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602788, "uuid": "98749a9b-6dcf-40c7-b687-dde3b6f8483b", "value": "T15E44399463E88E1AF2BF6738E87809140EB5F606F97AF74E0E8954E91C533418A1537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602788, "uuid": "db45b173-3391-439e-bba0-46ed2bb9af39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602788, "uuid": "7d4fb732-968e-48f5-89ca-cd7778cb94c7", "value": "6144:/bRf2qT+5oFMnT8iouaMcEal15xazfvoHCoChdfK7yY+8:zRf2qT+Gio/Mcvl1/aLvxwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602788, "uuid": "91a6fa54-482c-4984-91d7-4a5d19befc2c", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602788, "uuid": "6bd26b6e-8a12-4673-9f8c-9074e3244ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602788, "uuid": "1c0bfb81-37d4-494a-9a6e-e9207e93439e", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc88f326-3ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692602764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602764, "uuid": "12f6eee4-4e25-455a-bb2c-45bcc9ca8229", "comment": "Malware payload", "value": "4217437adbc6c5a165e3d9f4e9fc8b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602764, "uuid": "ae54bed4-b5bf-41e3-8734-109309d317d0", "comment": "Malware payload", "value": "20c14b1c18e0c5cde211a2446aff24625a0879aa92a6af008792898768668362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602764, "uuid": "06c0d6b8-f58d-4ede-b4b1-8165bc872498", "comment": "Malware payload", "value": "1a15912cb4c254aecf6e93abf331615b738fba74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602764, "uuid": "73508fff-23d5-4e16-98a3-beca3133b9de", "comment": "Malware payload", "value": "92bef74b04390e790ca83d3b9c0211263d2d90c04f2476e1f9ebe93686cea763ca293a2f3fc1edcf0676b1f2ba27734c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602764, "uuid": "e9847dbe-b602-4e5f-9ccb-5dd68393602b", "value": "T189037D2476E0C4B7E8B307311E7A5B666FFAE92214B4870B13505F5D7D32682DA0E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602764, "uuid": "536fa547-8ac1-481d-9d26-4152f4930ca4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602764, "uuid": "b42dc0bb-e870-42d6-b91f-9e14e59ba185", "value": "768:iXWsAYF0UQj0TU9a+IWNu9B1MxlthhMLWI02TzpiUGtu0b:imsAYBdTU9fEAIS23Etu0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602764, "uuid": "c09c0c79-2ca8-43ed-8990-1c0c228df94d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602764, "uuid": "8af23b6a-efc6-40e9-976c-afe715bd336e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602764, "uuid": "06e73ba3-a14c-4de3-8dae-47bd2d528ecb", "value": "20c14b1c18e0c5cde211a2446aff24625a0879aa92a6af008792898768668362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0110eb2a-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692595899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595899, "uuid": "fbf6a53f-ac75-4f15-b1a2-63cbaeac0e7a", "comment": "Malware payload (Mirai)", "value": "92b188436d0891c21f5ad6121e347ac3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595899, "uuid": "3c9deb87-591a-460b-bf5d-64cc418be2e5", "comment": "Malware payload (Mirai)", "value": "211c8b4f136a49c3a2752e9e5947d53fe52749b1633fbb0a7e9bd72598f0f5f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595899, "uuid": "938eb53e-5a84-4ac8-b84c-b46628a4c6b2", "comment": "Malware payload (Mirai)", "value": "b571affc85cb7561785ebb49ded9c903358a5ca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595899, "uuid": "4554199d-2f4b-447f-81c2-980b4c416635", "comment": "Malware payload (Mirai)", "value": "e01b3af6350508e4c0b72f69c70f35b943f4ec6956429137dd4f57aa3c1e0d735a844ea4653957fddfcbb1489142e675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595899, "uuid": "24dae35f-56ed-4533-a2cb-bfca15ecf5bb", "value": "T146D2E12CD65D6D09C6AD3EBA51CE96B5294CB0C0635DE68E1726844CBA27ACBEC070F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595899, "uuid": "efd63b8f-4814-477b-bb3d-d393dcf1d848", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNvXJsJbKWUK:DbDs06t4BEub4sU/MbUfJs+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692595899, "uuid": "b53630e8-0341-4b44-aee6-08f06915f027", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692595899, "uuid": "0cb719bb-94b8-452e-ac8a-c541332665dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595899, "uuid": "80911756-48a4-4533-b989-b5ed2d621e8f", "value": "92b188436d0891c21f5ad6121e347ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb67f76-4027-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692624808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624808, "uuid": "7ce2431e-670b-4b9c-88a4-d0cd98ebbd23", "comment": "Malware payload (AgentTesla)", "value": "69a53b66a5f5851a4cdac0af49f313ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624808, "uuid": "6952c8fe-61ec-4109-8154-4c4447d8287e", "comment": "Malware payload (AgentTesla)", "value": "217a04102c6021e98815a35feab526e99a259f01c9baee3e143288dbc160b920", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624808, "uuid": "e81210d2-f193-4978-a74d-bf5d4979b300", "comment": "Malware payload (AgentTesla)", "value": "5d3c70dca105afdcd473f231b5611cf4d6017354", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624808, "uuid": "00528783-120c-44a5-bea8-e25d0975e213", "comment": "Malware payload (AgentTesla)", "value": "823fd6cce3948c2dbd3955abb5a37148df8452d8b0ca52acf703bed5cd6f64bd415d43d36afb0bb77c219cae48ee1353", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624808, "uuid": "7128f4d6-732f-4f7d-b901-b33237d495bc", "value": "T112250117B1AADF01C67CC3F6A0512F8463A759CE1175E2784CC6A4DAB2EA7C20E525F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624808, "uuid": "b939a259-952f-427d-9593-5e6bec6979d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624808, "uuid": "02ca4275-6ada-4c0e-a636-575dc5fa964d", "value": "24576:oSRlCe9qhJHjalKAATyw/6UbWHX97wcFbSJM2nPpjKLJF8r0DX7Ds:1lCe9qhJHjaliP/6UbWN8cEJFBGLT8rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692624808, "uuid": "314af99c-4c3b-4ccc-82da-6d1b9a1a6f91", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692624808, "uuid": "43369f52-fe2b-44af-9ed3-908007be9a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624808, "uuid": "7ef9bd48-3c57-430b-b724-6ca431951786", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5bd73f-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596239, "uuid": "86cea79b-35e3-455a-b758-f2d2db6badce", "comment": "Malware payload (Mirai)", "value": "50d4030a32e6f655b4dfb50dcc3cef30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596239, "uuid": "69104ccc-3863-41e9-aa07-561323774976", "comment": "Malware payload (Mirai)", "value": "22197ffdaa7713366b4c371f7543a763d0a8c38568ca50547f05a9a9427497fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596239, "uuid": "c217ad2c-6cd3-4399-96d6-b1a2d7c057d3", "comment": "Malware payload (Mirai)", "value": "eaa656a3d0f57efae9e7020713a75cd9d1615a91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596239, "uuid": "fa1f9f67-13fe-4768-81c8-09e50690f72f", "comment": "Malware payload (Mirai)", "value": "ba4b341440c42a3122550d81c3431e1c50291c85fa50ee7b612f5a3cf5ecb1fc5a2e370af817924d761ddaa98d24d4a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596239, "uuid": "bf243cde-f790-4b8c-b5e8-ffda0f0375e9", "value": "T1D3C2D084F142CA45DFEA29F53D50DADABBD02F1EAA65CE8022A053D25F5C2B75305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596239, "uuid": "c8e22fa2-c5fa-4e0f-a827-9369ccd8d6d8", "value": "768:vVdafO76jpmNJJKehmA7trpfIX9KeA7P/U4uVcqgw092I:bam+AnKehPRa9aXU4u+qgw092I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596239, "uuid": "eea7363e-b2ba-4b8c-a85c-1f67b26f6e42", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596239, "uuid": "96b0c548-77ee-4421-a087-027904d05095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596239, "uuid": "523ffd48-97a2-4bab-9004-814b2abd0f00", "value": "50d4030a32e6f655b4dfb50dcc3cef30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381dde20-4030-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692628633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628633, "uuid": "edff171a-11cc-4bfb-9732-9904a6e30ef0", "comment": "Malware payload (AgentTesla)", "value": "e3784db49544dca148dfc60004578da6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628633, "uuid": "fdf2bbe1-d6a7-4a6b-b47b-f9a2029ea931", "comment": "Malware payload (AgentTesla)", "value": "2627e96c1ea96adf04b4709b5cdb2fe6b9cd9b82ff959cdde4e61a4acb9cbf4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628633, "uuid": "be146928-0e08-4a35-b917-3e3f72963e19", "comment": "Malware payload (AgentTesla)", "value": "046e167ad1e2908974946bd61ea96b8361090a79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628633, "uuid": "e8e7f813-a620-42ed-8277-c47b9e603476", "comment": "Malware payload (AgentTesla)", "value": "9be6cc562c4f8f4570e7902a50be9c30dbafb0ef7f40b5b50f81b89472624462a5be7022752d37967be42ccbe7ee7a02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628633, "uuid": "042f116e-d9a3-4aa5-9b75-3a472bc9c880", "value": "T121822A48AA1DC133C6AD097E68AB038683B5E73BA453E35F4CDCE5613D173D1A9C16E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628633, "uuid": "52ea69e2-aae4-4f1a-a6d4-cc207c0b8398", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628633, "uuid": "5013ab3d-9484-4c51-80b7-a0a172f3e844", "value": "384:txClkRSuWfTlAuihndj/fLC/RHfIbfI3uk/QaaslwCz:Xa7lAuCRbC/R/IqCCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628633, "uuid": "0e072d7d-029f-4a96-b145-a9e7d5b306d5", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628633, "uuid": "84bc2a26-f5f7-46d8-b7d2-871b2c552527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628633, "uuid": "71b29f60-cf84-4a74-95cf-70da2f066871", "value": "Payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dd462f-401f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692621625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621625, "uuid": "3d6a6f63-e6a5-4671-89d3-e4e56ca61bd5", "comment": "Malware payload (AgentTesla)", "value": "e2f25200e5f8de490f8ad800dcc559af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621625, "uuid": "8eec15e5-c9a8-40e8-9283-09b6c65f3f1e", "comment": "Malware payload (AgentTesla)", "value": "26abe03ac80de180d96c7145ac90af912cf0c9dd90407749b8877b1b02d64f0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621625, "uuid": "d328bc66-a463-430f-bc80-4179b8757ffe", "comment": "Malware payload (AgentTesla)", "value": "88c13f3a90a7f8d32a9cf42fcde737c6af2a8dc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621625, "uuid": "1d645107-8c6a-4e5d-ba64-42955339c562", "comment": "Malware payload (AgentTesla)", "value": "487a44630ae4c8a642655a00996c072d7f7099def4d88d4768a03770c850fd2328f3d445a8bef312ee533cbf62c170f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621625, "uuid": "ebe910ec-d4ad-4dbf-b22c-195381253051", "value": "T16315D63CF616DB2BD0CC8CF988A5192F79F99CADD0F1B3A5C173C1A85BF981045A6462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621625, "uuid": "b641a0d7-e620-4919-b344-2cd6426b44aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621625, "uuid": "00d94726-43b9-4e0a-b69e-adddba4d326a", "value": "12288:U+70pKXQl2FNGp/SWrz4412Op1jzUX6qXfFdYL7LN1wjYY52x:p6c0UX6qvOLgjt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692621625, "uuid": "79dc9a30-3671-46e0-9bf4-35a29e4a9a27", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692621625, "uuid": "2e114efb-8e57-44f8-a105-17134a183b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621625, "uuid": "048c0295-9299-46cd-bc5f-f2cc386d0efe", "value": "SecuriteInfo.com.Win32.PWSX-gen.508.12387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ff8c31-401f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692621620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621620, "uuid": "0f79b009-cc95-4800-a0e5-50770395c0b4", "comment": "Malware payload", "value": "11086c12fa66d4d537cb9a9549631c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621620, "uuid": "837cdedb-5fd6-4e1c-841a-135acd0068b7", "comment": "Malware payload", "value": "26df1e4a5d6cc1c5b072363510ffb26356f2d16e5bd2e59f794033860ff0e19a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621620, "uuid": "031a0995-0d49-499c-aa7c-43b4ea3ee52a", "comment": "Malware payload", "value": "16720ed7723a90a15411a60c978c0747867bd143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621620, "uuid": "93c295b4-c769-49c8-acc7-ecfca6e8ac76", "comment": "Malware payload", "value": "5b9868262aeb3398258c5a9c87e0a3124b8af450a73c4b5694658fe0544af423bdf15579cd455c284cd13b0238028b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621620, "uuid": "02520ff8-2318-49ba-b3ea-ce54c750cc51", "value": "T100949D223AD2D433D8B211701F69EBB6567DE9700B6209DFA3E42E6D1E74AC15732B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621620, "uuid": "7bbb9924-b974-4d38-b436-f5f88a142669", "value": "43b6aad63215aa6e4674d5e2172b7a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621620, "uuid": "e5f74732-c9e3-4e65-ae03-c0463f557a50", "value": "12288:5JbiQnSDqYisDEiD3jbTFiuiSiO+3P53nUNlQIf:rbvnSDqJsDEiD3PTFTFiv53UNWIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692621620, "uuid": "ff148a5f-bd80-4b42-babe-ef3e610e2c48", "value": 436024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692621620, "uuid": "6967816d-0990-43c8-92d1-aa4b21c5a619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621620, "uuid": "3410a726-7e3e-47b1-a347-f08723bfdd9e", "value": "SecuriteInfo.com.Win32.DangerousSig.25243.11817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ada0e1-3ffd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692606985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606985, "uuid": "78896e8a-90f1-49ec-9fc4-29b7f06f07bd", "comment": "Malware payload (RedLineStealer)", "value": "5fe0e5d492ab44f902c8f40b835a9e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606985, "uuid": "290ddf64-dedc-4cf2-bdf3-d008f1361c88", "comment": "Malware payload (RedLineStealer)", "value": "27e5e5b03cc0d6a14205c26d63eb7ae0f522f2829f7e94f5524e304147fc1445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606985, "uuid": "7d3f086e-39f0-40b8-8fa3-1f4c855b34e3", "comment": "Malware payload (RedLineStealer)", "value": "09719078368ac633a03fbb4e2f65df8f5fa2652a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606985, "uuid": "b7819242-26be-40f3-a61f-2f943a355ead", "comment": "Malware payload (RedLineStealer)", "value": "4e06b4116a96e8297389a792864378bd44cb9c203ad32a2f15033009d9c2534ccfa9fec0b90ffb10e10d1b932df034ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606985, "uuid": "99d7cc82-a57c-40a9-ab58-2b78b5658ea9", "value": "T1C8355A2138909331EDF613BAC6ECB5E4816DA4ECC72455CBD1CA06EEE6905E33A3D653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606985, "uuid": "8dd21702-23d1-4129-acbf-ce1e7fc4b342", "value": "91a8ee4bb3398526d3d00fe42765b55a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606985, "uuid": "fec4c41b-edb7-4bf1-afe6-52bf5c7f019f", "value": "24576:+iZ5VjiNe30i1sCi8xzfyowFD/aNQBXtRjXwNZNQCZPCfE:+GiNe30iuZ9BwOCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692606985, "uuid": "82c5415c-9345-488d-a636-3e2fe6886d2c", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692606985, "uuid": "c20d9dff-bc1c-4010-a469-c257c5ff87db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606985, "uuid": "7703cba0-63db-471c-bde2-58361726422e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a10c1c-4048-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692639237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639237, "uuid": "22e2fe8c-8710-473e-86d4-b2f0eec00247", "comment": "Malware payload (AgentTesla)", "value": "11abb9235921c95264b1e8aee5cb1a1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639237, "uuid": "8646f9a7-8c8a-404c-928d-efa633a2ceaa", "comment": "Malware payload (AgentTesla)", "value": "2856592b60d78f976492007d0a0d846070a9cfe90c586f104c84f6c38aed2ff2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639237, "uuid": "05154dd9-93ea-4065-aa3a-e22881d21b8f", "comment": "Malware payload (AgentTesla)", "value": "6a5c98951640de354b53df5d959ff7868933cf65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639237, "uuid": "c75c4f39-29e4-4b0d-b1ff-b83a36af83ed", "comment": "Malware payload (AgentTesla)", "value": "dcf0da73d57ce3fcdffbb2591504ccd60d228e03020cec604b1dfad0c23640bc710f021eadf3282c60fdd56392552ea4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639237, "uuid": "7100e8b2-141f-4679-a62a-2d57c990b541", "value": "T18C15C63CF616EB2BD0CC8CF988A5192F79F99CADD0F1B3A5C133C1A95BF981045A6452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639237, "uuid": "e9603505-c827-42f6-9487-a8b3367d7511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639237, "uuid": "2f5b1989-b77c-4a53-ab36-d2dff8129932", "value": "12288:6+70pKXQl2FNGp7SWriPIoVcdR+OdUJXceGebdjndH3qpA:36wdZXJljndap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692639237, "uuid": "ae3c0d0d-8959-4d9c-872c-19b54cea0983", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692639237, "uuid": "62f35c41-fa00-40e8-a4ea-5fd41037e4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639237, "uuid": "c8e00b4a-08f3-4795-b5d5-5e168dff95a8", "value": "SecuriteInfo.com.Win32.PWSX-gen.10653.20560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691fb800-3ffb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692605952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605952, "uuid": "a55bd2eb-e3c5-4b47-a29c-571645b2155f", "comment": "Malware payload (RedLineStealer)", "value": "3275ff2e62b0205d055e89dce0379d2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605952, "uuid": "fc263d8d-35eb-46c9-b02d-2131ff431a81", "comment": "Malware payload (RedLineStealer)", "value": "28a3ae6d3a619913a031246e44cd5fe2596614cbd306f55bac7e679d9a4ade13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605952, "uuid": "70397a6b-965a-4b59-b48c-e54d76c52cc6", "comment": "Malware payload (RedLineStealer)", "value": "3149fd0220d14ddf808b48e9c0fcad331d2810c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605952, "uuid": "d752add6-3f5d-4dab-af8a-6e7b075baec5", "comment": "Malware payload (RedLineStealer)", "value": "f85daaec0a0407b6860c230da8bf2306d37c6fb84573f72fe395ba897744dff2ab36ab42a9f2495ab29cc543bd1ab150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605952, "uuid": "b9b16456-d01c-4d4a-ae9f-b82ec4870517", "value": "T12D556B103980DE62DDE620BF46EE7A2472BFA1EC071946FF15C847EE96109D13E33696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605952, "uuid": "ce9e6455-ac15-4e58-988c-86d9c40000f8", "value": "91a8ee4bb3398526d3d00fe42765b55a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605952, "uuid": "9d852dbb-3c14-411b-83e8-262a5c20461d", "value": "24576:iTZ5VT/t+lcBY1+ANWNQZDCyP9ZIZbzsbx6eHCC:iF/t+lcBwFJmy1ZOPg6+CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605952, "uuid": "77195e48-4a37-4d13-913e-bfe1e7e5ea17", "value": 1329248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605952, "uuid": "4c73056b-da18-4498-b29f-18c3b22fe76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605952, "uuid": "6f364beb-e5e2-4bf4-b0bc-f4c82fb045da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d9c632-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1692629938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629938, "uuid": "67a8ec42-f60a-4d79-8051-3f44907cf535", "comment": "Malware payload (Havoc)", "value": "e9d5c93dddcbd74935f1532560ae89e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629938, "uuid": "ef28c8bd-0faa-4046-a675-2bf1c04ea235", "comment": "Malware payload (Havoc)", "value": "28c79c2291c86b81a561d3c882d946ec63bafe48ada96ca0936fdbef0d067a72", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629938, "uuid": "f7bf5289-eaca-427d-a0c8-c6bec64e6318", "comment": "Malware payload (Havoc)", "value": "1aa2de54646d5c07c3e36779985d0cb3fee5e7b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629938, "uuid": "737882f9-a7db-4a5a-9fef-0cf1747dd84b", "comment": "Malware payload (Havoc)", "value": "385720261bad48a185f2829387b10b07f7ab0292513ed2d79ac96f38be03f14d279661948ee95985e0bf0cba93e7d124", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629938, "uuid": "5b523818-7095-4d4a-aa9d-3e8e5a26f506", "value": "T19A73C817E19370FEC9B6C17047EFA637FA73F45929341F4A5B24CB182B60A71262DA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629938, "uuid": "00733772-63c1-40cd-be35-38ba8a3d3db6", "value": "1536:ogo2smHsP4j2e84tApNSkPOdKra0IFPeaoYoW5ud693abCjccr4:xtHsP4j2ettmSkPOor/8PXoYoW5udg3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629938, "uuid": "ccb52a9a-4e73-4904-af41-c3598f8e56b9", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629938, "uuid": "d9366f03-8d79-455d-b962-f2497957dfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629938, "uuid": "a7dae751-c685-4c7b-a999-554c14dcc4b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8805c1-4040-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692635650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635650, "uuid": "8f11aa1e-573d-4cc0-8e35-a4b8e977f479", "comment": "Malware payload", "value": "381cf00625dc55db25821720db5462d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635650, "uuid": "91172afc-743f-49ba-ad15-f00fe344f90d", "comment": "Malware payload", "value": "2c2f7cc79f24a950a670cfb0a3269f751358f5bc15e5ba832ff299a3669162f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635650, "uuid": "38b760b9-158e-4f49-ac65-d2d1961149b6", "comment": "Malware payload", "value": "a5658887493ffa57356a437101c9d212965f623f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635650, "uuid": "a5b152f9-40a3-4c26-bff4-2a3acf8d3db6", "comment": "Malware payload", "value": "807a8d563af06c27e2affa9ce72aae614e87e8f95c9db707febe7801a7e9832c55ca9ad0ce6c532b6edd65354dd97e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635650, "uuid": "1015bb2c-b245-4bec-aee5-0df58b255ebc", "value": "T10006BE12B9DEC532FA7E4175A968E77721BA7FE00B7184DB63D42D9A0DB08C15272F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635650, "uuid": "2b3fc9b0-1658-493f-8027-031a876b8860", "value": "43b6aad63215aa6e4674d5e2172b7a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635650, "uuid": "8d2ba93f-b89f-473b-9eba-38e5da56132f", "value": "49152:J+DqJsDEiD3PTFRc5CWIk+q4E5q8g73dBflKp/Dz/f2sbQEidUt5K35Bz3w0RZq8:J+uKTFy+XHBflMPzidUtyWmk60KAOmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692635650, "uuid": "09ad2599-759c-4bd1-9a7c-600fdb891485", "value": 3694592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692635650, "uuid": "a0066921-6b9a-4212-8c96-2d0fc469fe65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635650, "uuid": "e19633cc-2c06-4a9b-82dd-67ff328c53b7", "value": "SecuriteInfo.com.Win32.DangerousSig.25350.20576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ce9b1d-3ff8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692604798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604798, "uuid": "5eb3e8b1-d89a-40ef-b5d1-b5cd7c7a90b3", "comment": "Malware payload", "value": "0a4f0faa78975c74260efbd859ac6282", "object_relation": "md5", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604798, "uuid": "25c800e0-ad14-42de-9e67-8a6538cc1f9e", "comment": "Malware payload", "value": "2e0f093aec2db43730e2b9e50e0156b7f69f9f30f7b744927ed95efa7f84ec2a", "object_relation": "sha256", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604798, "uuid": "7d5ab087-cdb7-4992-8e65-9b754d02d267", "comment": "Malware payload", "value": "1df3d05c9847f7efc3dad5b8d31c48cff0ee69e2", "object_relation": "sha1", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604798, "uuid": "e753a5cf-ecfb-4a3e-9070-475e08f08836", "comment": "Malware payload", "value": "dabda6476817f10f0fa0a30ba49c3ef3acefd317fa268a87e26444d335a44fdee0b8c635dc77ae4495b3ff695d81f642", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604798, "uuid": "10f2e4a8-0104-4f62-b563-b1489d982f48", "value": "T119C51206FAE45137E66762341E204661836EAD740B3581F9FE1C76A99FB0E40CEBB713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604798, "uuid": "79f16d06-12d7-4cd0-a66b-8302ca9af7aa", "value": "49152:qVcMDa1y97n0d33BL8oeQjq6owuLpvKjjIcc5xPlBb7/nSej8ARI43AHsHoQD2w:Eckaod0dBL8Gq6owJIjbI43hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692604798, "uuid": "9ed06e2c-0133-4d88-86b2-c8d48ca5e36f", "value": 2596864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692604798, "uuid": "95a4fa74-cccb-4bd0-a92a-a64aacb7d97d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604798, "uuid": "a8e80d14-c14b-480a-a1ae-f7e2efee26b2", "value": "FromEnergyBadx64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62f2edb-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596230, "uuid": "03d574ae-4672-4436-be75-5852b5810f0a", "comment": "Malware payload (Mirai)", "value": "01adbfb1a0107fee935b5b7377c9d428", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596230, "uuid": "d32abe98-83d7-4406-bde8-c8a4387d13b8", "comment": "Malware payload (Mirai)", "value": "2e1080e4f0f1e1774e4e8d4653f64ee8b7b845ded39ed4f513077429471e5dd4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596230, "uuid": "e2a77128-c7eb-452f-b5a2-a96e0d6eaf0d", "comment": "Malware payload (Mirai)", "value": "9f6257a5bf4857059737768655f4e09b76525dc8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596230, "uuid": "027a5c12-29bf-4d3b-8d28-89818f210793", "comment": "Malware payload (Mirai)", "value": "104b9b163d01a22938882fc966f568cdda62102f046a8434f9890506e82c01f26d7478793ce8388e3397898376de8974", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596230, "uuid": "4fc80a67-24f5-475a-bd7a-0827185cdf85", "value": "T188D2E1F7E2FBA2F4D4F2B871381AED80F595306B9724139A01BEAD85DBA734C5530912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596230, "uuid": "f3412040-1330-42f2-8d80-2bcebded2f50", "value": "768:NYSoXdJZgicCHD+C98MP7L1YVPb2XBZ0Sx0sV:NYJdJZuCj+CiE7L1APbaBVtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596230, "uuid": "610ea35b-8e29-4566-af6f-7e650d2ed23d", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596230, "uuid": "f6b16baa-1adc-4dff-abea-18c879418e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596230, "uuid": "ed175ecb-f7ff-4d45-bfc0-18651b83c299", "value": "01adbfb1a0107fee935b5b7377c9d428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10269371-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692602797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602797, "uuid": "2996b6a1-8457-4615-a7ca-b97f6feaf3c1", "comment": "Malware payload (GuLoader)", "value": "8e49a96dfe023c9033816228375ae6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602797, "uuid": "49b4e246-d171-453f-9d92-0c9ab9b21f6a", "comment": "Malware payload (GuLoader)", "value": "2efc26f4debc076df44e6ac846dfd3d84e31d860f1309d29e7c4beb54a748c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602797, "uuid": "e73eff2e-8521-40a8-bf6b-cdba3f1568a2", "comment": "Malware payload (GuLoader)", "value": "6beb85fd83e16bf76dbc42f975b02692579e444f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602797, "uuid": "e9108820-f085-4d73-9c83-a4a7d2d7b290", "comment": "Malware payload (GuLoader)", "value": "28656942e16b113111ed5fef6e170cde1f186b5b133aea4891ae35824a8eafbd8d34dcc7bce6feede35d52eec7fd3664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602797, "uuid": "25eb99ee-3492-4441-b738-ce4f7e41a688", "value": "T155A423C83ED6E006D85755712D5BDEB7EE7CDD2918158A0BE300B76F3B3134E2A16A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602797, "uuid": "d928614e-63ba-46db-926a-c74946d8e186", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602797, "uuid": "e787414a-e01b-4707-8f73-7a8afb2bf766", "value": "12288:Cgk/hu4PlxetbKXNCyJmdqZF+qBRSUY/ubzdfWRPnx:oZuwlx2KXN7Jma4qHY/uPdedx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602797, "uuid": "28fa6210-5a19-474f-b62b-8f4a0bb65ce2", "value": 468328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602797, "uuid": "0e1f2961-011e-460c-adc0-09592fbca5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602797, "uuid": "c34e3ac9-0379-4f77-b93b-fdadd70712f9", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cbab4c-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647422, "uuid": "d493d30d-bf3a-489b-8c89-7f4bc76b12d3", "comment": "Malware payload (Mirai)", "value": "ed061d79b97830f8d4c637799b431397", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647422, "uuid": "0f0dfda2-f30f-42b3-b874-a15d3b619e16", "comment": "Malware payload (Mirai)", "value": "2fb03c829f23c54b62d4cb7905ab2bd44bdbd627ef03ceb2b97de13d88e43434", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647422, "uuid": "e5dc8776-3dc1-4e4d-ab83-ec6191916ecc", "comment": "Malware payload (Mirai)", "value": "70ef4281d3f160adc09d5b9792bee4252510a552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647422, "uuid": "9c052244-08d6-4d09-9328-a79878275a75", "comment": "Malware payload (Mirai)", "value": "1d1a8184b7e224a54237480885b3147d9afcc7c9f08d3db19e001aec7158b0d219b75ab93666bbe2c002d391d97843a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647422, "uuid": "1ab58221-070b-410a-b7f1-7a0724e1f2ff", "value": "T16AB2D020F1689EE6DC6BD9B648F589C037F0BADAB54C84F27114FF42D501672C824EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647422, "uuid": "497c4b81-5aa0-458f-a017-2b7d16938c15", "value": "384:EiBp4/P4BvyXKlBovwq9tagujiZ6KxjP7bMPrFyhtQnC9eZaO1m3WZ3cKG9NTC6Y:hBu/P4Z/lBZqdEKxwPRItuC9eZzk3WZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647422, "uuid": "1bcc269d-347e-490d-b5da-1dd15d088a3b", "value": 24136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647422, "uuid": "5b12ec03-8519-4f3e-9608-56874f9a97b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647422, "uuid": "a7a87a6c-246b-4e79-9253-0244e837dcf4", "value": "ed061d79b97830f8d4c637799b431397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8449e803-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610293, "uuid": "6043bcb2-d83c-4604-a49a-18fe0fc8a12f", "comment": "Malware payload", "value": "cc351aa8da3bbd3d6b5a724bae4f7937", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610293, "uuid": "17ba385c-fb6e-4b19-8595-5b24664dba48", "comment": "Malware payload", "value": "327c745862390382ffd3dfa570ca214e45c9a630842713ca674221b52af1e8df", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610293, "uuid": "82570d32-d214-493e-b13a-c5f625921697", "comment": "Malware payload", "value": "416b4f7727e18329a227c4f4d946da21115a0964", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610293, "uuid": "5f72fc67-98fb-4dfd-b5d0-28009b5f6ad9", "comment": "Malware payload", "value": "f64c8d53e75c8a83d9e384914ba310f9ac23adc7e382208a91a45f8633045b4b40042e39e343964d41a1f8f7e49616f6", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610293, "uuid": "72c18c57-6118-4f22-872f-fd776fdca840", "value": "T19931B5331522804C9EF24C5D537EA77C67B3C4183BA4D79EA79449A85C01A7F857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610293, "uuid": "922d5d92-c221-4d83-8b10-e517d5688300", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlqItakK:4oyeP9YeYaMImCmuItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610293, "uuid": "d1277fd8-019e-4804-b8f2-d9645d5cd478", "value": 1789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610293, "uuid": "e9d89b5e-8ca6-40ca-8db3-8672a96148d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610293, "uuid": "a8400b22-dee5-4fbf-9237-013eba12871d", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521f4b3e-3fca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692584868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584868, "uuid": "06e9c0e9-8ad8-4ee1-9883-2b1140e918cd", "comment": "Malware payload (AgentTesla)", "value": "1edbf56b41d9169b4575487262b26b17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584868, "uuid": "916a799a-72da-47f1-bfcd-a69085f3af77", "comment": "Malware payload (AgentTesla)", "value": "33e2fc0182dc134c577da9d0b092660a29a3e3d16a662e8ab2bc23311a9b3a0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584868, "uuid": "4002fc27-d8dd-469c-824c-1c0a247a72f1", "comment": "Malware payload (AgentTesla)", "value": "27bbccdd0b44163e4f25b7a9df26a746da1d6e83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584868, "uuid": "4bc77964-c53b-4090-98a7-d9efe4b1f87f", "comment": "Malware payload (AgentTesla)", "value": "80746fbee335ff8a73f633ec62ac3ca8ae0420cec62fc2b86041dd5f5b1f4e072f47a464237b3c90a2c08da2a4bdddb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584868, "uuid": "df53e330-1953-437e-8b11-de0353bb4079", "value": "T19505B43CF616DB2BD0CC8CF988A5192FB9F99CADD4F1B3A5C133C1A85BF981045A6452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584868, "uuid": "6cd57b19-6eaa-4d65-a9fc-f8277cbfd054", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584868, "uuid": "a25040b9-26a2-467e-827c-78b0e6d9768f", "value": "12288:A+70pKXQl2FNGpGSWr1aJ5fx8Nd2bRrKPe04kohTWG4dQ:g6UJ5JaIJKyVhP4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692584868, "uuid": "0a482865-6b7c-4b51-917f-53403171765b", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692584868, "uuid": "2c0ee6ae-a346-4836-9b47-d0646f042449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584868, "uuid": "e754563f-6708-4eeb-a636-9028b1ce8220", "value": "SecuriteInfo.com.Win32.PWSX-gen.1317.31514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7933ca-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "53d70580-4b65-4d8d-b1c8-b121ecaa0a4e", "comment": "Malware payload (Mirai)", "value": "5e4b182197a17a25dc431ae7c66b76e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "e01ca9d1-dfb5-484b-a220-936dab8a3e05", "comment": "Malware payload (Mirai)", "value": "350493ed153be6020ea3a11fecc913c13f7791baa5f9ab52c2dcf1b49642f1e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "dc533c06-fc0d-426e-b28d-cc78adc94e3b", "comment": "Malware payload (Mirai)", "value": "68b8a55fc6c3260b65706b6295128c974c61e484", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "f257e736-88da-4ba7-8784-18584d28c47a", "comment": "Malware payload (Mirai)", "value": "e585bb4a3be274669d3d43cfad639180accc1b28a00bf6699cd393f6409d0b7e59692e4a315f903258e9cc74912e96c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "7eedce67-8c52-423a-b2a0-e92b98336450", "value": "T1E44301F08486BEF6C9716C31A2BE424282BF1FF2D5E1BA81E630BCA1AD9744C157904C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "509cf13a-d265-4128-bacf-e1a53de59e9e", "value": "1536:7av8sgzBQvlsREb4rMsSAhnJpscpxaEOTjbuBGT43SqboJPA:7avfgq9BbcPSanJpscpkjKUWSqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647404, "uuid": "a05e3493-af89-4f4f-b5ba-8551a92baf07", "value": 55388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647404, "uuid": "286b4cae-4cb6-44d4-a114-2582f6e378b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "ac69aa16-940b-4a91-b272-cd898bc638d9", "value": "devx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac394e4d-3fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692588456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588456, "uuid": "01a58774-e070-435b-aee0-c8ee89e7667f", "comment": "Malware payload", "value": "a1700a4eb8b31afc577a9cc4f11406f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588456, "uuid": "a7a14e03-f712-41b7-8356-9a53a2a0744c", "comment": "Malware payload", "value": "3527205379eccebff4c7b6d7844ee7534eab92472a9d4ddd4c0846bc361612c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588456, "uuid": "78a83604-b2e8-4b93-8cf3-62337c021b05", "comment": "Malware payload", "value": "796208280ae12d1b82a6b2de2128fd87ccdbd1bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588456, "uuid": "3464e82d-00e5-4e2f-8368-be8edf3e5607", "comment": "Malware payload", "value": "777acf6e93ab01400cf996ea8dfa70f4f14f300f374201e5cb0712b0959e25c79f35b3ea90a8aa8680955f595766f54b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588456, "uuid": "741db274-002d-487a-9f42-e6830bfddff9", "value": "T1F9D633AB357F8E39D62E8B75296D637E07263CB18E91057A772C18D438B09C19B341CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588456, "uuid": "756382cc-a69a-430d-8e75-ae093e640655", "value": "5f6abed1463f328cfc96cac6cc37c8e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588456, "uuid": "402a7b78-1e34-4948-b411-26732b6247ee", "value": "393216:x2ajq5X3pHvX5Njc+p/w3/D4tmrzeOwExxAzT:UGaXdLcww3Vrzen3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692588456, "uuid": "2d1d2dc9-efa5-42e4-9a74-5ca82752151d", "value": 13768704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692588456, "uuid": "1869f1cf-c1c7-4e9d-a189-fa81240ee079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588456, "uuid": "9998f55b-0ebe-4e95-a3f9-88ec1ee2c851", "value": "SecuriteInfo.com.Trojan.TR.Redcap.ziyfg.13896.13250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed0b3dd-403f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692635060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635060, "uuid": "e6797c05-c817-4fca-bb00-3270aa517451", "comment": "Malware payload", "value": "0c6f57e34c60e926869925974c0ba0c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635060, "uuid": "8fd8d3f7-8482-46af-a74a-b7c90f7f066e", "comment": "Malware payload", "value": "3818bc71c250768baec123373d2e873428509f7dcef12a56f4d428d488661c71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635060, "uuid": "014cf0df-fc5a-4c17-8b8c-699871ede76a", "comment": "Malware payload", "value": "c2c96e1a4da5fe008796801569ebdfcde4d3c07b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635060, "uuid": "4a4b311a-b528-4174-96ef-d8ccceaa2e69", "comment": "Malware payload", "value": "dacef5e34b1187cdd696ba14ab7e41993bd0ec64d9e95b0c59ff8ba856c1f831a641ae98a5ab079c8283095feabfc3af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635060, "uuid": "58377755-6fbf-40af-b888-822fb1583c02", "value": "T163346B5933B8CB17E25F8BBDD5B1158F87B1F103E90AF78E0C8895E82412B42E949E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635060, "uuid": "038666f3-28fe-4f71-89ca-88384381a309", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635060, "uuid": "031c8467-ce8c-42a3-87ab-d75dca9825af", "value": "6144:+loZM+rIkd8g+EtXHkv/iD4n6rk/1+mplsl3ySX6Eb8e1mai:ooZtL+EP8n6rk/1+mplsl3ySX30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692635060, "uuid": "1489cebc-9fd0-4d06-a8d2-821775c902df", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692635060, "uuid": "7ae4d652-e52f-4e9c-8bf0-2bc480d08549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635060, "uuid": "56270ada-84e9-4512-84cc-638f95ce2a1d", "value": "3S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e5a1b1-402f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692628475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628475, "uuid": "0f3db20b-125e-4574-8421-2d09695b88de", "comment": "Malware payload (RedLineStealer)", "value": "065753f740a0b465cefbf65f1a1716a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628475, "uuid": "f008ae5c-45f9-4f6e-80d8-76087fc9a591", "comment": "Malware payload (RedLineStealer)", "value": "3905c987a1acfcd789a7e9ac5e66d4445abf120fc1a7b81fb77e9444182d316c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628475, "uuid": "37ef05b3-3b99-48d5-91b8-91cd1f0af191", "comment": "Malware payload (RedLineStealer)", "value": "8d91143b08904bd62f306154af2c26a713034ae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628475, "uuid": "4e14a649-1208-4269-b77d-07725fe881d9", "comment": "Malware payload (RedLineStealer)", "value": "ecb15a825f0ae5d8b8c604cf591f0104fc72a44c1f62dc09e1da58894aadc15ed3a683a751efc1809957bd9a84a5f66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628475, "uuid": "92adaa93-1c8b-4d4c-978c-423dd7595434", "value": "T1FF356D217C809572EDF210BBB6ECB8A9471DA37C0B1A57EB52CC13EDD6205E3BA31546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628475, "uuid": "94dd7ecf-45bf-4463-82dd-5915d23fe8ea", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628475, "uuid": "f89ca78a-b21a-4ba1-ab69-0f42ebea05a3", "value": "24576:tP31/j4b9vK4XWNlM+MAPuh15yZbQzIEMFwpz0:tPSb9vK4sEA815yZbQzIElS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628475, "uuid": "540c8fe9-e645-4a22-82d5-fbca7485858b", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628475, "uuid": "2a4af955-48fb-49bf-bc14-332ae0bfa26f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628475, "uuid": "d820ff0d-b169-4cbb-9087-ebbf9f64266a", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.16602.13584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cafed26-3ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1692605019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605019, "uuid": "fb2b0be5-9c09-4e51-a671-d5f6318fd714", "comment": "Malware payload (ArkeiStealer)", "value": "54d43648a2480eb57eaf4211ecc8f99a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605019, "uuid": "42808917-56e6-43c8-b0b0-e1754644a1fe", "comment": "Malware payload (ArkeiStealer)", "value": "39cc90115bf3ff86da4a7284b54d8f9f59cb8359dd4fa48f7188a1d604bc185b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605019, "uuid": "86457c23-e023-4ba9-8acb-54ff7799fd03", "comment": "Malware payload (ArkeiStealer)", "value": "3c7957cd71ce0eb5305c4f812ace1ab4f31e6de5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605019, "uuid": "af9d40fb-fc87-4dba-9c8f-5cd754bb45a1", "comment": "Malware payload (ArkeiStealer)", "value": "30058ad3468d0daba474812c77812a4481798322a4a071869f1438921d30969dd865c460d65ad6afaa17e036514a10b0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605019, "uuid": "b97439a4-cf85-40de-888b-d37afb5d124b", "value": "T10C45E11137E69209E979033198BB80B11376FD667B21DBEE1F85230D1D636238F16BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605019, "uuid": "d4fe4003-1e13-45c7-b76c-15f1d5b80109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605019, "uuid": "046e2617-9af2-44d4-b6b6-65b50d5e09a5", "value": "24576:8SNHKi6oraPIIbbGc1e40SKFV5QlRoixAZ3ALy6ffASI:8SNlcGc1iSKFHuejMyHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605019, "uuid": "4eacb99c-134d-41a2-8573-8289d3772b1a", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605019, "uuid": "700da037-939e-45e5-b303-889578b5983a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605019, "uuid": "2404466a-afd9-4e3e-881d-2b8b74c9b933", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039184da-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692595904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595904, "uuid": "72eab373-b75e-4340-aa1b-6dd1755f3541", "comment": "Malware payload (Mirai)", "value": "bf23fbc3fb2294d577d408562d061d1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595904, "uuid": "06ce64ae-d2e0-435a-8427-42cc06ebc4cc", "comment": "Malware payload (Mirai)", "value": "3a7739ddc9e0efc1391fabe38d8bc8ff221676628b678bba11345986d8a4f4c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595904, "uuid": "f1279a1b-d4bc-4ae0-b57c-54cd99912ce7", "comment": "Malware payload (Mirai)", "value": "ba622f06c935f9685a7cea5e456c5c3111636df0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595904, "uuid": "aa8728e0-3210-409b-b3bf-8b6ca61b8f0a", "comment": "Malware payload (Mirai)", "value": "c775dcd0ff74e8331261c907e07d4b31befca60a8d1bbdef5f9989c15f37722e60537f56b80736533bda4ae3b736f198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595904, "uuid": "c29a66e8-c47e-4042-a614-2d6e5b719863", "value": "T12A93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595904, "uuid": "c5ee2839-745d-48b2-9808-a28f2b0d04fa", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZq/i:qCYxrKDy46N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692595904, "uuid": "0f052e8d-018c-4780-9c6b-47598205bbaf", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692595904, "uuid": "d798a104-7940-4183-a4a9-74cc20a05feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595904, "uuid": "54dee67d-4e1d-4621-bb25-d9b89dc591d4", "value": "bf23fbc3fb2294d577d408562d061d1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beada84e-3ff8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692604807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604807, "uuid": "3a78b450-76a6-4ec0-8303-594559015cad", "comment": "Malware payload", "value": "e11a6d20830940b1e91a2f40af3f060b", "object_relation": "md5", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604807, "uuid": "126a9bcb-d221-432b-a238-e113b482b543", "comment": "Malware payload", "value": "3aa8199d973e136fef73bdca391b460b7498c3625d9c0ffd607df325425bf85e", "object_relation": "sha256", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604807, "uuid": "a2559909-4ee1-4c70-ae43-15a2b172aa07", "comment": "Malware payload", "value": "937b7fd24da3f9973e9f9c6da6c3e95d1e0e1aa3", "object_relation": "sha1", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604807, "uuid": "93d5b162-aaa1-480a-ac2b-bd7d5a17383e", "comment": "Malware payload", "value": "85cc1feddee9f82bcca1d7cb6e53c1e537926462503c0a5608c94ebd416c0e5769715221dcbd26c266d86e29dda4b34f", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604807, "uuid": "f3c407b7-79cd-4ee3-b6ce-ab39448f6cf8", "value": "T110011296E1CD6665C73DD03964B28A5DDA7580A092E0718802F0AD33AA352942AE2357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604807, "uuid": "55e1ebd5-6857-4e5a-9610-dc17ebda8c29", "value": "12:5jE1tSO44UENQjjV/7nZSx7ma5E5mC9Rr4S2ZkJ1wJaG:9etSp4D27nIx7ji9TrT0awh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692604807, "uuid": "f0b3059c-4fef-492b-964b-a69ba18fdae5", "value": 810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692604807, "uuid": "c7abbf07-28be-43e0-9767-398afc20b962", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604807, "uuid": "2e18eb65-568f-4c72-8a6d-0c993ab92c01", "value": "vip-book.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20e7046-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610370, "uuid": "16392835-23e1-4013-9689-1a4de4383a78", "comment": "Malware payload", "value": "9a8644b726ec78672d961964c0a085ec", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610370, "uuid": "08c6c0fe-8747-4b10-8155-d6cc1f849fd7", "comment": "Malware payload", "value": "3f25d0165b5f3a7d5bdcf078dd71f933f433f05830d694399480a546999aeae7", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610370, "uuid": "127e5309-70ca-4cf3-94ea-d78ab6922090", "comment": "Malware payload", "value": "b45ca2182bec97de106e246a1e7594e0d7f156df", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610370, "uuid": "a162e418-bf9e-45e6-8d8f-b85e9df89f95", "comment": "Malware payload", "value": "28095796a2cc4f1be4eaf82fa7d96b68e0403cd3028a98f2b5389c40aa95b8a0e897dbb190c7e5440cd1bdffe483dc8e", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610370, "uuid": "23f2237e-084d-42c2-9f7c-9bc06973def6", "value": "T1CF31A1331522804C9EF24C5D637EA77C67B3C4183BA4D7AEA79849A85C02A7B857CC5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610370, "uuid": "f14bef71-f240-4d1f-b2ef-5b6c7a64dc17", "value": "48:hi4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0Yl3ItakK:noyeP9YeYaMImCm7ItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610370, "uuid": "687c806e-85d5-4c88-9616-647f4351eb45", "value": 1787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610370, "uuid": "88c879e4-2fe3-46d2-9102-f2a5d7652e03", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610370, "uuid": "7b06d3ae-3fe1-4ea4-9eef-ca9a5d9aff02", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0278f342-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692602774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602774, "uuid": "81b657ce-d41b-4674-a974-b384efb9acdf", "comment": "Malware payload (Formbook)", "value": "d7483c4d727a821be6ddb83a83b09132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602774, "uuid": "f1e77cca-c262-41e4-899e-ec2d6b140a86", "comment": "Malware payload (Formbook)", "value": "40954a03ff9b5f841c40b1091fcea523c2ad99db64f20463a90ddd61e3ef38fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602774, "uuid": "5f91e129-bd80-4dc2-ade7-41fb4de1d211", "comment": "Malware payload (Formbook)", "value": "bc0b420baf0f214ded7f5d9f9280535557d0e444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602774, "uuid": "2d9feafe-900d-4c8e-ae4d-7ddeeda320f6", "comment": "Malware payload (Formbook)", "value": "e6826334c37331616f0c80044b8bbfe63d8902230800f7347f0258889eb04f45c270c504f66f077dd9a7fcd31e3d4661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602774, "uuid": "afe82bfc-17d6-446c-8ece-bb8b28efdc59", "value": "T18E83F53C1A8A4AA7E6B941B9E5C1814EC7B1D63FE542EB4AFF4C4DA41F523F064062C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602774, "uuid": "7b97b762-74f0-4bb3-8a4a-96005edc21b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602774, "uuid": "3d64562e-4daf-4dc0-b180-ff0f58ec8802", "value": "1536:etRH5xBFeI6o545DT2BEWYzZG0Yw2cwwSgijBiDCSSwDTDCwtjw/8lUbeD/hwwQO:etRHDB4I6omzgrwopk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602774, "uuid": "0fc669bb-c052-436f-8a98-bcb3cbbbfd7b", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602774, "uuid": "98614050-6a3d-4c3d-aeab-81e84d087a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602774, "uuid": "a21a4ec0-795d-4102-9b4c-ef523e0749fd", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9832db26-3fdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692594005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594005, "uuid": "83b1e89d-4e9c-425a-9dbc-9b34e8c56ecb", "comment": "Malware payload (Mirai)", "value": "4f2125adcba0812609f5279c910f730c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594005, "uuid": "29c89690-5065-4b37-bb13-8526cb851311", "comment": "Malware payload (Mirai)", "value": "428dc1283e660d3815f7765a14536299b80a0c8342a06224dd8db25dab279157", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594005, "uuid": "cf5c7b19-34b1-409c-a4fe-c2927f7beaf5", "comment": "Malware payload (Mirai)", "value": "7a8bbd587b3318ec4cd17a066f1b4eb52268c64d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594005, "uuid": "30667690-eca8-4311-abb3-bec8a64d8753", "comment": "Malware payload (Mirai)", "value": "2dc3a84ed48e426530f7efe0cf9d674ab5ec78cacf11fffc5dd399c32b763c4ffc817f3d84492c6d3c1d4aa033fc20cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594005, "uuid": "e6b24877-3136-46d6-a0e7-23398a746fb1", "value": "T1E75329C8A593F8F5DC140978307ABB66AEB3F13F7035E99BC3D86927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594005, "uuid": "31a35877-c793-4ed8-a062-f2b3607cc418", "value": "1536:IEX9170vwHbQXZ5+qXDEuXi95TSW7V/DjObeFt6PuQ4ZR:d917iwHbQXZ5+qXA599SWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692594005, "uuid": "11bda629-690a-4ef8-bf0b-ef2e75bc3ace", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692594005, "uuid": "daf70d99-7002-4573-8cad-c53cecb101ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594005, "uuid": "e85c9819-28f7-4ac4-a7b5-d1bc37554ca4", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b74bf9-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647396, "uuid": "8dc8a7c0-7459-4db0-a42f-73d66fb43884", "comment": "Malware payload (Mirai)", "value": "a22de55f2480fc401befcf635437f5d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647396, "uuid": "0531c47d-6c9e-4787-9d10-2e071b5a0bab", "comment": "Malware payload (Mirai)", "value": "456ac2923139a6279e278c4ff2970acf6e7a71ebdf09485b3d13f836343423ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647396, "uuid": "b0bec861-887a-4fcb-ac5f-6074326fbe7c", "comment": "Malware payload (Mirai)", "value": "faf0f8fe996eda1254ff26fa7a807fbe1dd26879", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647396, "uuid": "b754ab83-cab7-483d-ad23-135cfc644a89", "comment": "Malware payload (Mirai)", "value": "ed5d1edb00b102b343a6edd36d1e8b649b689b5ae6a9f38e3526e7c629b15a2f207ad96df5315f26fd7ee90177870b4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647396, "uuid": "4d28edd6-a284-4424-9197-2f44e7729085", "value": "T12DB2D0BA6AEB0591D85932BA2B6E2AF77341B5D41F21CFD03EA4DD5928F30288740C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647396, "uuid": "06792469-2a55-404d-b918-f6deec9d8c24", "value": "384:Mv7LalTr/lS3rOVT6rJoA/0np7NYLPr/IIZeAfSB1BFRhoUbxeKprq6fwceG9zk2:o7m2bOVWNj/0njYL7rSz17esrq6l4Qh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647396, "uuid": "b55848e6-d50b-4549-b71b-0412f56be962", "value": 24484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647396, "uuid": "36658d80-cb08-4cd3-91d5-ae545da2c8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647396, "uuid": "028fb00f-6f79-4a02-90bc-4e43b3d3687d", "value": "a22de55f2480fc401befcf635437f5d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095fe793-405c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647453, "uuid": "9f82c3ab-93e1-4ae6-8349-3b0c30797629", "comment": "Malware payload (Mirai)", "value": "4e7a6652a6f0ec4eea9c7e381969a535", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647453, "uuid": "0830028a-6ed3-4599-a39d-65857fb161af", "comment": "Malware payload (Mirai)", "value": "48e1f31486591145187a0b3afbde57781a14f93d887864af4cf8a78ae2054c6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647453, "uuid": "059a80c8-d0ee-4b8c-a155-1c714ce5c4ae", "comment": "Malware payload (Mirai)", "value": "733989b444b7a9a642001a5aa7a6ab1cd34d3019", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647453, "uuid": "8d2728ab-3b7f-47b0-9fd3-f51e9cff6cea", "comment": "Malware payload (Mirai)", "value": "492ad93b1a7dd1127b83e3c9c411be22e0b7ea85cf7cf23762c8c171b1989833edac8f2124ebbb3d504892be4c1c52e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647453, "uuid": "9e7b9c49-ba8c-4159-9546-a3bf365b03de", "value": "T1B9A2D0B38B8521A3CF710D32956E4342D74A9868E1636124782C4758FBE386179BF67E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647453, "uuid": "92721ec9-7987-4337-bfc4-2f175372cabd", "value": "384:6SwZfBW+Ggi3r5ZBeA4D8fExHXCQsM22JXkIRufWEw5/vO8YVMDj9288WmdGU5Ew:1wZpgr5zerD8fGXCjM9+QgWx5/WDMVFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647453, "uuid": "86c64a79-8401-4019-b752-53c136614114", "value": 21832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647453, "uuid": "681d53e1-2d35-416f-a636-e7d56d310775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647453, "uuid": "b35caf4f-0b7a-4dd2-8118-6566d182678a", "value": "4e7a6652a6f0ec4eea9c7e381969a535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97439ade-3fdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692594004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594004, "uuid": "248bafde-24bf-4e6e-b3ed-f4ad701ebeb3", "comment": "Malware payload (Mirai)", "value": "59b24a88a3f7127f64e3ca25e2589b61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594004, "uuid": "84cc5447-048d-46fa-aa02-7392e0a03657", "comment": "Malware payload (Mirai)", "value": "49d46bb8f9d8abc0c8c84b1bb200664458a130970fc0438e872570ea65d901c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594004, "uuid": "129517bd-e880-48ea-8a6f-f702c3b3a410", "comment": "Malware payload (Mirai)", "value": "4feaa4c282da6f59196ce74fae5b4588bff64d9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594004, "uuid": "bc55a1b9-d02a-42e6-a3ba-1877c6836b27", "comment": "Malware payload (Mirai)", "value": "b834bc82efca7ac3cf24d258fbac923f0201c969cb71ca6ae690c351c5998a29d70d2658aece6c89cb9971f01ebc0fbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594004, "uuid": "f7caae47-25ca-4197-bf0e-c33e66175003", "value": "T160E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594004, "uuid": "87a51260-d701-4845-befe-a46922ed69fb", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1QR:walgM69pe0QmlTvI8t9mrsplDKZUQQBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692594004, "uuid": "c33cfb46-2a66-44e2-8f81-064e77047a4b", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692594004, "uuid": "a5ecc963-22e4-44b7-8c11-6ac746e980af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594004, "uuid": "494fdea4-94af-48e4-879d-fd79d1111fe9", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6dbff6-4034-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692630441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630441, "uuid": "cbad96c1-056f-4f7b-a30f-91d4329f4f6b", "comment": "Malware payload (njrat)", "value": "93c9932bb4d7694d7faf034c774f69ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630441, "uuid": "ff4c81a3-cfe4-4a43-8d24-910939f24915", "comment": "Malware payload (njrat)", "value": "4af08d67c5c9aa9287b61632223f0dfb2784e37469aa2aac2f47b62a59508bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630441, "uuid": "7ff4a6d6-218e-40d7-8a28-492de9c9a94e", "comment": "Malware payload (njrat)", "value": "b31df13c384b1995ecce8588cc1a9e49b44a2226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630441, "uuid": "ccdff91e-f099-43eb-829b-ff25565b1a78", "comment": "Malware payload (njrat)", "value": "110e0c0b4fb8fcd7378ccefbd510eea80ac2b253adf531bab88d84f453d41033d6f25e27c9f2cc65e4b76c6cefb23987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630441, "uuid": "73b68eec-7047-42cd-9cad-a88b5cf9c9a5", "value": "T1F8E2F84A7BB94125C2BD5AFC8CB3131107B2E3478532EB6F5CDC88CA4F676D04255AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630441, "uuid": "ed1fe537-90e7-40b4-83d3-d486053d9a71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630441, "uuid": "40462f3d-1e5a-40e3-a173-157acbf0c67c", "value": "384:d0bUe5XB4e0XuOluixBr/Q/WTEtTUFQqzFPObbu:OT9ButMifrYbBbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692630441, "uuid": "71dda464-b52b-4d67-b96b-68936f001cbc", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692630441, "uuid": "5f326a34-fcb0-4f93-8b85-a1023723ee71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630441, "uuid": "983bf504-af8e-445f-85d5-e8df99d790ba", "value": "bPbV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceef46b-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692602791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602791, "uuid": "0ddd547e-de5e-4d2a-a988-3e935c3d294f", "comment": "Malware payload (Formbook)", "value": "9aebfdf948174aaba5f12366c5fc9777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602791, "uuid": "cb3abf0b-9bfc-4c9f-8ba6-ed38162d1574", "comment": "Malware payload (Formbook)", "value": "4b69699cd5a3bc207b49b7466bfe990c4989e7e61ea372deec14c61d7e8baa32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602791, "uuid": "c8a24d83-e2f4-4653-b921-4794d3f4a83c", "comment": "Malware payload (Formbook)", "value": "f6811145b117e7df50ca99c728aa5125545e1fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602791, "uuid": "01db100c-fbb9-4e92-936a-e52c828beaef", "comment": "Malware payload (Formbook)", "value": "0eb273e55b3172c76d697ce9925a8b3b00fe4f611f77beaf7a5f83505e77ba88e7ce9ee539bd2fc1f5cee06f1e62f4ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602791, "uuid": "5347107c-335d-4a7c-940f-56e6d224e3de", "value": "T16AC42302ABE19B5DC09B53F418F0950707B9B6262D71DA2D366A16CD49A3BC07F10FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602791, "uuid": "123b9045-4520-4900-a76c-4d5a7a0749b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602791, "uuid": "c4605787-182c-465e-a9f2-42b6af414785", "value": "12288:o0Dl+C42xjW5KDUkMDmMBHEsbqO6akKWXPdyltRCHg2Oqjeh58cdY:RHDZMbBHNqO6/XPYlK5Y8cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602791, "uuid": "1342f458-b555-467a-8a70-a687313b62e3", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602791, "uuid": "2f773cc1-1c8d-42cd-9329-32447065d6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602791, "uuid": "84ee9b22-78d5-4397-a25b-1a69be8afc47", "value": "RFQ-Material List0816023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd0a486-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1692629930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629930, "uuid": "ba6a022f-2be0-415c-8515-5fc3a5b662e6", "comment": "Malware payload (Havoc)", "value": "c9e6e4d394d7452b79351028c4da0cac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629930, "uuid": "9eedf6e8-dad0-433d-ad41-f6dc8cbac673", "comment": "Malware payload (Havoc)", "value": "4ce5f00cf44673e80fcdb462b15f1ac379c18754900e30ed9d667e8aeb34bd70", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629930, "uuid": "28f136ed-23d7-4f58-9cc7-68568b0c694b", "comment": "Malware payload (Havoc)", "value": "a92e92ae68c1252d583d54b34f44289b00932bcb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629930, "uuid": "0ac9a2ae-bca4-464a-8ed6-2e1225cd21d3", "comment": "Malware payload (Havoc)", "value": "2a6e26c1789813f502b94e62c643130711628e595398aadd6de3ad849e1314453f1ffb2466f9c569c8c02cf709c4109a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629930, "uuid": "7e972ae3-f901-4744-859e-43df355981f7", "value": "T11473B717E19370FEC9B7C17046EFA637FA73F45929341F4A5B24CB182B60A71262DA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629930, "uuid": "b4ef633b-6381-4526-b22a-edc054b79f10", "value": "1536:2go2smHsP4j2e84tApNSkPOdKra0IFPeaoYoW5ud693abCjc2r4:LtHsP4j2ettmSkPOor/8PXoYoW5udg3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629930, "uuid": "747136c1-fcc0-40da-95ef-41c7db16eeda", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629930, "uuid": "c7db0a31-a848-47e6-a9c6-c7fb47d3f4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629930, "uuid": "8351d575-1c69-4dfc-a1c6-269b4177db0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0639695a-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692595908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595908, "uuid": "7e1c7fa9-00c6-454f-8d63-a955f5cca356", "comment": "Malware payload (Mirai)", "value": "77ef7309c95e074925b96461946da21a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595908, "uuid": "0703c093-a2d3-40fd-95a4-d616444d4dfc", "comment": "Malware payload (Mirai)", "value": "4de2b00e462c9e62ec1bffc4fe2c61e01827bf4be7c7b4bb39c107b25119af9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595908, "uuid": "fe08c3ce-d56f-4fdd-b3f4-5dd54064702f", "comment": "Malware payload (Mirai)", "value": "be7c979a315da7a6a5e36184246aed7a5b39909e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595908, "uuid": "5737da79-8c40-41ac-a340-c0696d0c5d8d", "comment": "Malware payload (Mirai)", "value": "bb1e3d5daa9da6ef3cc31ab006ab1c90bfc5283a3fc53bb0d1f2c1956805a04f0ea25b8751ef0ffd0fd46aea4969a618", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595908, "uuid": "30326b29-7970-40a3-aeab-cf1f8668d4db", "value": "T104C2E0E63E77396BDA25003D359DDE368674F012C76EA713A240924C200B17DBB769ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595908, "uuid": "936101e6-e6e4-4fa8-8637-d2647cdebd0a", "value": "768:pMwoDZLFbBy6HQHRYfeAxdd82YjvVw0N7:polcYfe6KthvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692595908, "uuid": "eb69e7cc-65e7-4d6f-a154-57c3530c5eab", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692595908, "uuid": "1eb163aa-ef1d-439d-b70c-0059dab2589d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595908, "uuid": "cd836926-0d86-4c65-a74c-e0cfc3eea7fc", "value": "77ef7309c95e074925b96461946da21a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4226333-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647417, "uuid": "a5fbb965-cc3f-4de6-8bde-cd3b8fae0d5a", "comment": "Malware payload (Mirai)", "value": "efe5edda2f172d4040468cd766e24d04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647417, "uuid": "459a0a4a-b4de-48b5-a2af-323cdb210a7d", "comment": "Malware payload (Mirai)", "value": "50b1ff7c659345d560167dd0db2f61c86082b6939c2a33186cd0c56cc0f28549", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647417, "uuid": "170b1b06-6a16-4e2e-aa08-78592b5deeb5", "comment": "Malware payload (Mirai)", "value": "6bbdb21d7e08ad79ab78845162f19e15d80280fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647417, "uuid": "232afb02-7bd7-4ff2-a1cb-927a32c755b5", "comment": "Malware payload (Mirai)", "value": "05c7ad757e3f66d30d4afa735b2e4645c7d474a500c6e02f9b58fe97626dd6236f4f27baad8373591f63fb2ca9b6e65a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647417, "uuid": "fa5b42df-af91-490c-b646-0820e9fc75f4", "value": "T186D2E13380483BB6F3B32976DD374213AADD1F3C85DBF556962466882CE7091E924D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647417, "uuid": "adf0560e-89fb-4068-81d4-ac371302e370", "value": "768:EWfqCHsF6at08FqjMCmRdtzjUUxPiss1/wcq3UIyu5:Bf9MJt0qHzxisgwTX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647417, "uuid": "3a113f60-1322-44b9-b535-377319b1ddfb", "value": 29272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647417, "uuid": "d5373759-7d49-4f0a-bcce-c102a48fd230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647417, "uuid": "86c0387e-9d55-4c4a-8711-929e26071a97", "value": "efe5edda2f172d4040468cd766e24d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12a8753-3fd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692590665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692590665, "uuid": "e5d6f305-4c74-48c0-9f4d-6da31ec3df7f", "comment": "Malware payload (RemcosRAT)", "value": "51bc9d99e4564ec89ab65380e08db3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692590665, "uuid": "f0b638a6-8115-4564-a5fa-646ae8bf7e0f", "comment": "Malware payload (RemcosRAT)", "value": "51328203fdc519d456202189112621a225491d5acd9af162cf51fa98e898ba00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692590665, "uuid": "85b8f5a5-5b00-4de0-b0e0-85a21a9d436c", "comment": "Malware payload (RemcosRAT)", "value": "469effe3db41db6425eb6ae8280216ae9f1a6457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692590665, "uuid": "8d0b8537-0e58-4262-b797-9a21c424ad86", "comment": "Malware payload (RemcosRAT)", "value": "091a0bc5500762b9421cdc11db8fbf1eca960ce23bf243140a33c5423d13297074f5de300ad9e9447c9ac08c16905a58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692590665, "uuid": "71e1f1c7-9e26-42d4-a4e3-b3081c968508", "value": "T1B7A4BF02BAC1C072D57651300D2AF775DAF9BD20193A457BB3DA1D9BFD30190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692590665, "uuid": "dc4d67c3-8167-4045-90bf-17b969163cd9", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692590665, "uuid": "54dfdd14-3ef2-411f-a97e-8009be60f40f", "value": "12288:yRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZiK2DU:yx7cyF2eSsewS8W47eZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692590665, "uuid": "ba94961f-5f93-4c1c-8e73-5fd0cc7e3613", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692590665, "uuid": "ac9dbb11-5736-4419-91ed-9a0c25dd5472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692590665, "uuid": "66dc0adb-7dc2-4c17-a7da-3ba5c54be2fe", "value": "xkfsSUHtpmbw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407fc767-4030-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692628647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628647, "uuid": "fecce225-83cd-41d0-8007-18fd8927f17d", "comment": "Malware payload (AgentTesla)", "value": "854de49345ef9ea31add64f80e3f7e6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628647, "uuid": "26086bb4-d399-4107-8d9b-4f509e1a2370", "comment": "Malware payload (AgentTesla)", "value": "524ed20611d14e1ace66e1b6661bc4518496e375c928238f9c9b9156fc8cebc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628647, "uuid": "9570cbeb-fcad-47f2-948d-142d052839a3", "comment": "Malware payload (AgentTesla)", "value": "ab7fc3b8b54915e75631f4c8c64cd6ace6cb0fbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628647, "uuid": "bb411591-816b-46bf-841f-4fd6ade35694", "comment": "Malware payload (AgentTesla)", "value": "d72d9edc892f0822605c9273ee576497779d0663bc14d06ba17f1f65c4384d5049a7711af1bc56913b159037f5429d7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628647, "uuid": "761c6967-d8ad-467e-81d5-131a0d8b4f10", "value": "T1DD820948AB8DC037C6BD467D9897074913B2E667F853E30F8E8CE2663D173C06581AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628647, "uuid": "38a08666-5fb5-480b-85c9-cd904f00f1e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628647, "uuid": "52b0f351-ec0e-46c7-a9f7-b709a378ef0b", "value": "384:CRxClkRJehmfeCrwZfnQT4e1edzFuRmk/caPs0VqvZTV:SGhmfe2/T0MMOqRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628647, "uuid": "3d3af810-4e7c-4f6d-bdf9-f8f8317e9285", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628647, "uuid": "d6f5d809-eec8-4ed6-af66-6914568d2fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628647, "uuid": "dd0d05a8-9e01-4f4c-b55f-0e425df17562", "value": "080523-FM 06-01 WSF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5536f2-4072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692657314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657314, "uuid": "799c961b-5251-4d79-aefb-6e30c9740e4e", "comment": "Malware payload (RedLineStealer)", "value": "2987e8fc538c441c73e73b99ecdc7238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657314, "uuid": "fb4b770e-0045-4123-a752-b0f59e5ea8ae", "comment": "Malware payload (RedLineStealer)", "value": "529d95f398f264a13cb8a0d72e5c6fd6e1c467d7c360c19d75eba956fa4fbe17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657314, "uuid": "0cf662f8-32f0-4462-8009-a31e1802884e", "comment": "Malware payload (RedLineStealer)", "value": "6a4b3edc0f04f198b39622895e9ff398fc28c1f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657314, "uuid": "0eefd10a-21c2-4bee-8150-efbd622c03b3", "comment": "Malware payload (RedLineStealer)", "value": "1b091202911d1bb78fbf71aa0f4c7c23f5b3650bba3c1dadceb9e8633b9c4ac68d10f65b1d7d60750b89a7e307a57de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657314, "uuid": "9477d538-fc31-4ce0-bfe1-503728f4a1ef", "value": "T1FF743BC0338865CDCC8F89F1612177788A70D442A157BB5B7C8BAEF73C5AB58AE451E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657314, "uuid": "606ad60c-aa65-4f9a-9254-18b772541161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657314, "uuid": "a0d45575-e278-4823-aade-a4d78675e6d0", "value": "6144:SCsqj/reRqW4s27Tv53zVRcurCYbBlKFN1aXTi:QqWV4dXCYbBlKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692657314, "uuid": "f431832a-a8cb-4636-b7c3-d528d85d35de", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692657314, "uuid": "2a1369c4-b604-40c3-bdc7-ab3c4ae4c1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657314, "uuid": "7b770f7d-8155-43f0-98e2-72188a110678", "value": "2987e8fc538c441c73e73b99ecdc7238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80174cce-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692610286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610286, "uuid": "b18def3c-1a19-4e67-90f2-0934eeefb341", "comment": "Malware payload (AgentTesla)", "value": "3973104058c66a17a48710f91ddd1b61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610286, "uuid": "afa311ae-a349-4fc3-9f9d-c6e0997f20bb", "comment": "Malware payload (AgentTesla)", "value": "54a5be7cfb6c0e4eb1673fc7d158b93094378a55f403afa84b82604bf06a9d5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610286, "uuid": "b286f032-cff4-47cd-965d-66793dd8e60d", "comment": "Malware payload (AgentTesla)", "value": "2fc05ed15b56c7fe41c018279bdc191ea12418ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610286, "uuid": "9c5815e6-d7ad-40d3-9857-bc9e89110a28", "comment": "Malware payload (AgentTesla)", "value": "704c762df6496e9e2c853af8a9f95ce6eef3e1d278d80f6af13c6d322375ad5faefa297cc582170ecb099b240ce7a23d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610286, "uuid": "7454d8ae-af6c-4c0f-9c04-862cf42054f9", "value": "T16D05DFDA2835682EC9BC52FD3319AC0D638D8D749913F497B2B04D72E43AF5D6B36281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610286, "uuid": "011ffa22-a67a-4f5c-aa07-885e5141040d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610286, "uuid": "a52f47a7-a6c0-49ce-a6a0-00353bdb6db1", "value": "12288:SiaGR8FC3MwkHQS3ZGsy++cMGNuGAJboeP0GIMDyO5vzw8xy+zlDhyfjA:ig7kHQwZw++cMGFwfP3Dyacr+zthys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610286, "uuid": "61796981-225f-4799-a9ef-c3709d9bd5d4", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610286, "uuid": "15f19106-fc70-4432-a8cb-a95e6d178650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610286, "uuid": "3628a811-aa30-4b85-9205-3f6e6e162fc1", "value": "SecuriteInfo.com.Trojan.PackedNET.2289.22780.12057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa84ae91-3fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692588453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588453, "uuid": "329ddf74-9949-454f-82de-c607c5864939", "comment": "Malware payload", "value": "5a233fbc0ab2fcb67139ab1828967419", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588453, "uuid": "aff84614-fbc1-4ccc-a686-12ac3dfd91bc", "comment": "Malware payload", "value": "55a47edd6151a899b5556d73dc8f2a891792f70c595c4193887f2e18fb32980d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588453, "uuid": "97752075-52fe-403b-8605-7d0803435620", "comment": "Malware payload", "value": "81ebd2b1cddc41ca7864daf11f14ae3e9856d73c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588453, "uuid": "c04c3665-2aa0-4501-990e-440f819ba328", "comment": "Malware payload", "value": "e7475aac9cbd42670a592101a8d40a0af92e0803cc8ff58b57bbb52e8ab51028675d58e21e623f8668c7040b47349691", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588453, "uuid": "2c03ba24-1c39-416b-a7cc-3eda13fcd8b9", "value": "T171E63331369AC936D66E46B02DACD36F422D7E714B7508EBB3D81E7924F08C25730A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588453, "uuid": "f6a37820-5c61-48ee-a102-05979ea9482e", "value": "151f64cac2decb47637532bf6d009463", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588453, "uuid": "96039350-565b-4737-b51f-11afbf2b591a", "value": "393216:A2ajq5X3pHvX5Njc+p/w3/D4tmrzeOwExxAzT:DGaXdLcww3Vrzen3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692588453, "uuid": "4cde5785-c0bb-458d-ae28-2fd5ef29836c", "value": 14373888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692588453, "uuid": "b95e97bc-07f1-406d-8bc2-f679050eadcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588453, "uuid": "1c7dafac-cbf3-4051-8b8e-397cd5e4bc4c", "value": "SecuriteInfo.com.Trojan.TR.Redcap.ziyfg.23640.31383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08768589-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602784, "uuid": "98daa279-a8f7-4af7-a467-b02f1bdad11a", "comment": "Malware payload (AgentTesla)", "value": "473b5df4460b5046d788f16b2fe79dd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602784, "uuid": "8fba384f-9689-4134-8aa8-0bb0cdaf6663", "comment": "Malware payload (AgentTesla)", "value": "55afe787b99bebe36f3901d43bd558663ec74b1cfbd41cfdaaf2d1bc37eb9d68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602784, "uuid": "bdefc32b-b6cc-44dd-b374-4d0a2589a9bf", "comment": "Malware payload (AgentTesla)", "value": "9264b04f0bfc822eebc4447860bdd9e599d0c26b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602784, "uuid": "888c1ed3-4285-41d2-8c4b-029d0a32015d", "comment": "Malware payload (AgentTesla)", "value": "dcc8abacc16861b0562ef3ae86d5d4fbdc5d41dcae4527eb8aa1b1c7cd1682dff37378ccade18856e16d9aa319e70351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602784, "uuid": "2ae02e11-4ec0-4bad-8fcf-d1b498060fc8", "value": "T107C402A072B95B1ED8BD93FA081481C403B17A7F75B2E70C9D92A4EA252DF444BC1F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602784, "uuid": "0c34f059-c360-451e-a09e-88638f27c9a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602784, "uuid": "9ef3a177-f3eb-4535-9510-3d2a49e99d47", "value": "12288:ylFtH4Dl+CUcOWWYLujGkJHsiEsQaqtMQFj+UZKAvNTlVpJm4:NAcOuT9fsdqtV+W1vXBm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602784, "uuid": "6a48b20d-2ced-45c8-ae06-b9f62c040bcc", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602784, "uuid": "058930d8-9296-4bd3-b584-88fb12972b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602784, "uuid": "6e48cab1-f8ad-42f6-a7ed-db09044da46a", "value": "paymentjuly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d949d7a4-3ffb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1692606140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606140, "uuid": "766605a7-49dc-40c6-9f1f-2ff2ca638875", "comment": "Malware payload (DarkGate)", "value": "96f273de5cbe4df4e0dc37ae76307930", "object_relation": "md5", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606140, "uuid": "352f9f71-0651-4bc7-80f8-eef3619bb5e5", "comment": "Malware payload (DarkGate)", "value": "573d3e739227f741344484f94d246c23318ac5329bf739d4ec396e0d5acf2ffa", "object_relation": "sha256", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606140, "uuid": "82c01244-c162-4c19-8e29-94b2fa3e4cfb", "comment": "Malware payload (DarkGate)", "value": "76c4dfedd119860104e748f5722208ed7c16399b", "object_relation": "sha1", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606140, "uuid": "0c20ede5-2ad9-4c00-8735-238dbec803a0", "comment": "Malware payload (DarkGate)", "value": "260b9266996a5399f7f72f205e4472ec04bebce212c5247541342a597974235ecdd95b190d562d58f91685acc3bb8649", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606140, "uuid": "f007be28-78b4-4680-bb67-542d03169330", "value": "T1D43733A236E99F3BF45C247D9461CAB8B0A75C1467B1C0EF338677145A760A0AB7730E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606140, "uuid": "f9903d48-7e8f-4751-92bd-e2b115952a61", "value": "393216:ACNptYoynoKXCzVsUdBz+fdpdvkh8QdJt/OwMHk3eyU/3O1WCN2+eNNLONpuBGio:ACNpino2ovd0/vkNt/Owne3/O18T3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692606140, "uuid": "72018843-3824-41ee-9d00-bc8b81e6ced4", "value": 23085056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692606140, "uuid": "1ca1e08e-f20d-42ef-a9ef-7defa5a94352", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606140, "uuid": "638e0ade-d71c-4d3d-a6ef-b6a0e95e7773", "value": "ipscan.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f5fb91-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596258, "uuid": "31ed8abe-1a50-4592-9444-d53a2f694c56", "comment": "Malware payload (Mirai)", "value": "97a4ad1be87b9bd3cd8543a55fa19bf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596258, "uuid": "1787b710-1e22-472c-b0d1-a3b81c27ca63", "comment": "Malware payload (Mirai)", "value": "57665201cae5f536bd0355b2810eff048b50a185799e12eed5188cd99a238b08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596258, "uuid": "39c8f6df-10bc-4de7-a61d-437bd41094a9", "comment": "Malware payload (Mirai)", "value": "9b1e546c8fb7f552b1531d3e18aa7decb35d6383", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596258, "uuid": "cae34919-bede-4cdd-ac02-5e2c4d1765c4", "comment": "Malware payload (Mirai)", "value": "8fc723e391402b3e498d953510d57e096c1a5b407d0bee311015b01bab88b1a277d3d952c158f2d1e6397ad0022ea905", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596258, "uuid": "30642c99-807b-4a67-8771-9e864b3d0a62", "value": "T19E534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E374999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596258, "uuid": "c9ccfe53-9806-4e48-ad1f-e1f4e655a521", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/vSBbsVf:2KbpuqJlzk5xGpJgbDOZ/vSuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596258, "uuid": "7da3a704-bd13-4875-b0c3-d3d2db99a495", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596258, "uuid": "6f2a9201-1efe-4bf9-bbc7-68930f1dc1b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596258, "uuid": "79fa557c-866f-43f4-b59c-9d5995964941", "value": "97a4ad1be87b9bd3cd8543a55fa19bf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dd92c0-3ff8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692604769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604769, "uuid": "06bf31c2-d0ae-492c-b3fb-e931c36fc720", "comment": "Malware payload (RedLineStealer)", "value": "2c79be71b6ea9a6c779e8cc2c4a98f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604769, "uuid": "34912c8c-25c8-4cfc-af5f-9fbb53a6f546", "comment": "Malware payload (RedLineStealer)", "value": "577e25a072c7f933832e4d9b73bd806bf77fa56207f3c12384d4bebd03de3d7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604769, "uuid": "5931029d-bc20-49ea-b459-5359d790a666", "comment": "Malware payload (RedLineStealer)", "value": "7790de567649e48b23b400942444c29ccdbcedb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604769, "uuid": "e8a77673-4cf7-40f6-92aa-84c909379fd4", "comment": "Malware payload (RedLineStealer)", "value": "60ccf031db3275c12063b98a01c5393c9cf2eecd6aff922333f68ac10b806212ea4948f7c25c83bd7017e843ecccc8ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604769, "uuid": "215df5b8-ab02-4199-b66a-b248fa120175", "value": "T1C3358D2039909975EDE610B74AEDF839926DB0B0172B49CB92C84FEFF6685D13B31253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604769, "uuid": "967cf0b0-29ce-41bb-86b7-13e80720ba61", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604769, "uuid": "689e88f1-eea1-42b9-acbc-4aee7d2c9bce", "value": "12288:/k7VqU/1/jovUc7PvqoPXaq3Kt/VCzpG5XM+mJI/3eD5+1uYdHp3I6YrNBsPfxLw:/kd1/jg7PvqovaBlM+EIPeEAxihwpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692604769, "uuid": "773dd1c4-c18b-4ff7-be78-cd94d2106bf9", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692604769, "uuid": "76043412-7ca8-4d59-a7a4-32a985de16a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604769, "uuid": "35ec07ec-080e-43bc-8be5-a92d1c0784d4", "value": "2c79be71b6ea9a6c779e8cc2c4a98f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a84bb30-3fe9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692598063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598063, "uuid": "96bb07a9-3c78-4bc7-b38f-1b2e6d10a39c", "comment": "Malware payload (njrat)", "value": "5a7c6112d7a5b57754c4a7356363e4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598063, "uuid": "2b3811ef-3c28-41ab-8874-ff8a5c4dccb9", "comment": "Malware payload (njrat)", "value": "57ff04bbef6df7f5c65fdad2dd633ff532abde0f209b425fcf24c642c0ec899a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598063, "uuid": "2f4b17bd-70ff-4532-8587-dd50b33eba69", "comment": "Malware payload (njrat)", "value": "09aa3118bfec7c9ad065ca78bf4d124c28823dc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598063, "uuid": "2bde8f39-4729-4786-89e0-c2422d231773", "comment": "Malware payload (njrat)", "value": "95ae650aca3e4a3a4de981a06648ba99489772b7d54ef5801be6f7104e1ddab83ff77cdd0b1181a4fcdc51ed6135ca63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598063, "uuid": "d2c840ef-2cbc-4e81-9d3a-bc727ecfee15", "value": "T151E207067BE94215C2BC1AFC8CB313114772E3838172EB6F5CDC98CA4B676D40656EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598063, "uuid": "489f78e8-a30a-45b2-8e1d-65d121f1d484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598063, "uuid": "21ce7a49-9102-46f9-b10f-57e5185c1332", "value": "384:o0bUe5XB4e0XGOnjHdqlzkB8N/uWTHtTUFQqzFbqObb3f:dT9BuVrdKTgbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692598063, "uuid": "bd01811c-4e20-4c79-9d09-a8babd984a36", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692598063, "uuid": "06041037-ee19-4238-a3f1-f8c2cfbef2e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598063, "uuid": "dfeda8e7-7185-454f-9717-9fe7d631ad01", "value": "bPbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebd9851-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692629960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629960, "uuid": "28ca3e2a-d218-4499-a8c8-56b6062ba89d", "comment": "Malware payload (Amadey)", "value": "4020d8fb466b63f9015e67812a3ffc84", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629960, "uuid": "9fc08b37-da78-4d41-a223-403c2b4ec5d5", "comment": "Malware payload (Amadey)", "value": "5891b75cbd95202a3fb0f13c8db03ed77954597f35298fc89e04a70714717768", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629960, "uuid": "722deb5a-5363-4820-aab1-5e5a0c43949e", "comment": "Malware payload (Amadey)", "value": "c25329740c43c0435cc2628e8fba73d4c8ea3996", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629960, "uuid": "e9b255ca-ad4a-480d-9166-a38276166ef7", "comment": "Malware payload (Amadey)", "value": "424418328002812d76fc12825bca76343bc0754cadad4714abe9f9fa5da481f8143318476bf67bd899d9145956b44be5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629960, "uuid": "56c7395f-bc71-43a4-bd0f-cd0da19ed0b2", "value": "T120F41202BAE88523D9742B7024F702C32F36BDA18DF9939B334E9A1B4D72691553177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629960, "uuid": "998781f5-dd5b-4a18-928f-20748971e520", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629960, "uuid": "d7cad56d-96ba-4b19-ac11-229d231c233a", "value": "12288:sMrfy90sOeLR6JSrk1RC9BU5WDEXI9RV5dWnmCUSz5ChFC5:7y3p6M4ABUED8KRVemCb+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629960, "uuid": "d8c549e7-e87a-42e5-829f-f0bbd495c75f", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629960, "uuid": "3451e448-eac9-4b90-bae6-e28d06d5ab81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629960, "uuid": "18baff5a-c894-4393-9215-84e48348962a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec70ad18-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "a8885c7d-0840-4eec-8487-727e1f691500", "comment": "Malware payload (Mirai)", "value": "1575b19fde675173fb1f611bdc364cd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "edf4eca6-c6ca-4751-b49f-408c213950f1", "comment": "Malware payload (Mirai)", "value": "58ba1f5374c40d8ed83983c46a4d5dfc03274b0fd57e26b3a2b3291d17ae4c81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "0049ef1a-16ae-4796-808f-b3c61089d829", "comment": "Malware payload (Mirai)", "value": "c721b46ca94cc9c1c42ade3bc16097cb17723078", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "2dbb160b-9e01-4454-9d52-70efb3bff72c", "comment": "Malware payload (Mirai)", "value": "de137538f78a4de4ec9e3d7404e13a67ad2aecea4908b6be9ce988648eff895ded5166923e6611aa136c1cdc15242edc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "a237cdb5-3357-469a-95e9-41e9809b3fab", "value": "T164D2F1CC6D478C4ADD7A50314C6520B772B8F6339F99ABB982A51C02237B89DC261FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "85bbcedf-ee2f-4ea1-9fb3-fdbcc66fdeb3", "value": "768:SgLKkAsT+abWiUqUUnzi3/kgaXVWlkWxrFCG3G0BGo2n:6kFrRUqXUdOCTxrp3Jko2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647404, "uuid": "f09ab539-8859-4bbe-a792-b9b83ab3df61", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647404, "uuid": "5bdaf87b-e21c-4d95-8196-0056336851ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "7323127b-de5a-471e-a9f3-2454217f8ddb", "value": "devx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95d0b81-400e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692614221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614221, "uuid": "051f173b-8b69-4687-8068-58dd2d27b97a", "comment": "Malware payload (RedLineStealer)", "value": "8ef99b7b22cd9da6c37bc5bb56d94b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614221, "uuid": "de7a39a4-a4ab-423d-b8d5-ba33b5d5c5e4", "comment": "Malware payload (RedLineStealer)", "value": "59835a3f4ca0edc1491196024e33c0e0c0a0d399527a9d00f3cb9aec4f1e6a6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614221, "uuid": "ec6a2153-030f-45b1-890f-94b8e89af88d", "comment": "Malware payload (RedLineStealer)", "value": "732337136385e20e58f4c89f8cbe274e63c76463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614221, "uuid": "36228f0d-f07e-48b3-8414-df18087f8941", "comment": "Malware payload (RedLineStealer)", "value": "f9e76de1d6eb1eaf4a6dce9e249fe0116d314dd959c20ad6963a21b19d7171278f65e13fabe0a897d8b6aeb6ca026222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614221, "uuid": "65fe0553-b91a-4af8-99e7-1c7652913faa", "value": "T1C9356C213A84D562EDEA2CF647EFBD2445ADACA007150DDB53E817EECB10EE13A31587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614221, "uuid": "cf660661-ef7f-4ae9-bfdf-0e3ae3c40ae0", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614221, "uuid": "ba3f01e1-19d5-4bcf-b049-a45cbf9bedf0", "value": "24576:lvv1/j4b9vK4PeFlM+EIPugGW8xDu2wpz:lvqb9vK4EMYFGvCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692614221, "uuid": "a000eed5-5c83-4d85-96af-23f9a8cd0f03", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692614221, "uuid": "844a4033-4227-4a61-845a-98dcc459549a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614221, "uuid": "a61c19fb-05b6-447b-ad22-cdd7ede21e8c", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.4777.6702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4f2144-3fe8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692598044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598044, "uuid": "0765cf5b-08f1-4b08-b527-3b4177ed1799", "comment": "Malware payload (AsyncRAT)", "value": "ed5fffedbd9f4d1992eb4b0f4946adc1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598044, "uuid": "3b81f651-20ec-48dd-9d81-c5f7af812404", "comment": "Malware payload (AsyncRAT)", "value": "5a9ec62bfda4c828f3f5a2af58432a51282c0a9b88a6129a66d5f129e82ea265", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598044, "uuid": "73568252-f847-4db4-a1c8-5c4c309ab83d", "comment": "Malware payload (AsyncRAT)", "value": "368ca02c6ceab1064a0950cb412a33032910fc87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692598044, "uuid": "37ccf72e-5dfd-484f-82f1-83d241efc7c2", "comment": "Malware payload (AsyncRAT)", "value": "e0cddb905321f6c3d136bd8c2355bafd73615d91e813a2e0a6e187bb84c25df718e57754d3c8f8c5b538fe707affa4d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598044, "uuid": "d97e86df-077f-4ad7-b58a-fdc1af50467c", "value": "T15C431B003BD9C127F17E4B7898F2D165467AAD633603D94E2CC4399B7633BC689426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598044, "uuid": "5bf9259e-c354-401d-930e-6b40ef0e9f4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598044, "uuid": "f5f487c1-2913-436c-9244-8535e349814b", "value": "768:/u/6ZTgoiziWUUM9rmo2qrLwqRKkPISzjbFgX3i7DDb8z2CaFOnHCJmEYQ9BDZwr:/u/6ZTgle2jS3bCXS7Tr5AWznTdwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692598044, "uuid": "5f226c30-a457-46b5-9fc8-78083a5f6439", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692598044, "uuid": "a87737d2-f8ea-4732-a100-1ac863d273c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692598044, "uuid": "53fa523d-b636-4ed7-9a7d-a847d032d444", "value": "bPbj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca086e2-401a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692619380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619380, "uuid": "21d6d7bb-4019-4010-9650-3fc7f8f89f09", "comment": "Malware payload (RedLineStealer)", "value": "264b75563e766a78bf692057c0a3fa82", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619380, "uuid": "a4464a76-7f82-46a1-96b9-560e7c7bb4f9", "comment": "Malware payload (RedLineStealer)", "value": "5af28ea239e16016b2c476d233d21d74f2fd3df7132f390ce30e8cb7679818f4", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619380, "uuid": "6fabf747-e8da-4255-982c-173358463fc1", "comment": "Malware payload (RedLineStealer)", "value": "2f67003795e08bd24b78db16d00ad5a265b6b50e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619380, "uuid": "a17d514b-38b5-4e66-b8ed-5e6e7692c60c", "comment": "Malware payload (RedLineStealer)", "value": "c8b923e993096f43bc5cbbadbd336a1b7be16ab7293e1c61952566eea46e26de5b041928ec34aa67bc6e48c5c836471c", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692619380, "uuid": "1f86037b-6bcc-4d1c-8ead-408d90f31f90", "value": "T17E25DE25F8593762E80CC9B009B02EB403F26D7913BB5BC03275752FD6ABE6D8B64935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692619380, "uuid": "ff86892a-abad-4e8f-9e87-94efd44cb24b", "value": "1536:aSSqdPAiCLQs8Jstfp6Fz0rW4wd4xTr1xzF9Ee6DCpewZzFxIW9N7V:aFF2s8WtfQl0rW4wdsThJoFCgwpNJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692619380, "uuid": "f25c2452-d5f1-415a-991d-7d4193b89a57", "value": 971871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692619380, "uuid": "4267c951-1a7a-40e5-bbca-20b354ca5194", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692619380, "uuid": "c4643330-06a4-4527-8039-327d5b26d27a", "value": "infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816c297c-3ffb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692605993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605993, "uuid": "f26df3a6-956a-4706-8ce1-d00f3962ae92", "comment": "Malware payload (AgentTesla)", "value": "17786b7e9aaa29e434168264eba0d96c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605993, "uuid": "5504ea2a-1b00-42f1-985d-0d324a9fb742", "comment": "Malware payload (AgentTesla)", "value": "5ba116932773c64fcb4634f28abe32facfe164e302824b45b972346185a2ee28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605993, "uuid": "f80c97f4-e5ff-4555-af95-685e70e2c8c8", "comment": "Malware payload (AgentTesla)", "value": "8ccb926de989400a9b617145c7d65c20d2370d09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605993, "uuid": "c3666acc-97ec-4016-98c9-c50b4ae34dd1", "comment": "Malware payload (AgentTesla)", "value": "5b6a7d08f8d6437c58578de0c3e5d159605edd6671a61fd119f08c5cc1e1528e91ba6a72256353b4b9321963ca34ee99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605993, "uuid": "383826e4-7622-4bc2-b1ca-2be7be59c9c7", "value": "T197B422042FAAC8A3DDC60A714D2D6B60FE6A9AA43C1589C71B709F9C5CB5310CF075BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605993, "uuid": "40e70066-da1b-4f35-9859-91c7611f546b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605993, "uuid": "c9682d43-6c0f-4cd3-b125-ce2d4cbddcc7", "value": "12288:B/+v6WtmirT9RsKPAO37JmAFySuKPinBKlj4f403h8:B/ymi/9bPAIJmAFySuKPcMjDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605993, "uuid": "4b56e0e8-2d32-46cc-a026-de6f890e8631", "value": 539472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605993, "uuid": "192393be-6b35-40c7-b8f8-23692bf0cf88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605993, "uuid": "343e6ae4-8c7a-4373-91c1-ef56bd4d0887", "value": "arctically revyers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52dc4ab-3ff5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692603610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603610, "uuid": "33f657e5-3c1c-4a4a-9a6c-626ed89fb9cb", "comment": "Malware payload (Formbook)", "value": "535a08e6ca7f821d5342271a54bc7fc2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603610, "uuid": "651c0ace-57bd-493b-a403-30ab38f4ad92", "comment": "Malware payload (Formbook)", "value": "5d15d4ab4f0bdb0c1f3850700d8fca35658445cbe1f1db6cb55653d7f30cf04a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603610, "uuid": "b05f0e05-67ea-44ea-9ffc-6bff2b6faba4", "comment": "Malware payload (Formbook)", "value": "c3ced6ee91d40ebd5d8cc7c2a9ea07446986605b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603610, "uuid": "d2a26fec-6475-41de-9b31-55260f2b5be9", "comment": "Malware payload (Formbook)", "value": "38882041af8fa704f4040c5fdd021b435751473515eef819c7084a01eb5d73690395bef8158290231065ef152a5e645b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "oliwas-xyz", "colour": "#98795D", "exportable": true, "hide_tag": false }, { "name": "sy22", "colour": "#ED541A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603610, "uuid": "b3b12102-ef5c-4af3-a437-08cc044da967", "value": "T13C75F10398009F87D41D87F87E630EE94F1B7F19A99579DB04623FAB3B317A2185A21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603610, "uuid": "121adb6b-c4c7-4dab-99f6-5ddf2b402bb7", "value": "49152:crev6VZjKjOzD36VIjKjOzxd0F/37OsT:crAmZPLmuPxdI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692603610, "uuid": "1c8376ac-244e-4e28-bb7e-c8ea8e2c6539", "value": 1580544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692603610, "uuid": "fd216143-1e97-4356-8b79-40c3e4ee9f5c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603610, "uuid": "857149d6-56e9-4f5d-8aa5-92eba956398f", "value": "order #P23043-WT05.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e035fad0-3feb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692599280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599280, "uuid": "c190f9b6-d787-40c6-a1a2-d619bd5207d9", "comment": "Malware payload", "value": "c621cd3c14b71a0dc1c1345da0679814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599280, "uuid": "f03274f3-652f-46b2-ad32-59e65e9da8cb", "comment": "Malware payload", "value": "5d2a927a41ab514591ce343a88a8bebb3faeb0039b856eaccc954ad0c4d43cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599280, "uuid": "ad73301f-223b-4d31-b722-1ad64c985133", "comment": "Malware payload", "value": "2cf3e8544a80ded43543bbaf35a6d3aad5df3a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599280, "uuid": "341fc3ec-f485-4fe1-b49b-6121937f1c9e", "comment": "Malware payload", "value": "4791e21b362f9134c8fc0ea6e5b9cf9835a9072155c14ca528cae9354144ed4ff8a9bf25f7044a8cf60969a8c134034b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599280, "uuid": "2e394085-a593-4fe3-b71a-721bc3016aa6", "value": "T198F41250636A5B17D23B8BF98171310063F669021573E7AD9EC564EA2EF37809F26B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599280, "uuid": "ff766a35-a1a6-47de-bb9b-10e88cc3436b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599280, "uuid": "d6d00277-4054-453c-97a1-bcdabdd79344", "value": "12288:1rSh+xGb/8W1iGZm6pLiaWYrcDAYF18Kod0Tp6z08FozcCT0TFur6lqz1VQ:Ah18W10MMIcTSKFlgozcCGFuM8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692599280, "uuid": "f22dcafb-bcd0-4fbd-85f7-394100e7b4d4", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692599280, "uuid": "344a36f8-3ccd-4186-9ccc-00d6358f2762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599280, "uuid": "6741f54f-4d3c-4630-b30c-1b51842df35a", "value": "SecuriteInfo.com.Win32.PWSX-gen.10354.14549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7be0c5-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "f1ee8afd-2d8c-4348-b651-6f1d526c1959", "comment": "Malware payload (Mirai)", "value": "b8f4b37110c7eac9b31e3a3709aa2bda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "2a2cdbee-a308-4a5b-9da7-fd5671016a28", "comment": "Malware payload (Mirai)", "value": "5da906f8b049ed885d4bf61ed9af6bac90e1672e38268ffc0260ba1c500744d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "7915ccae-41df-411d-9809-44dd83fa188c", "comment": "Malware payload (Mirai)", "value": "98df8edf2b41b0f0811ed4f7e62b00ce1ee569a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "a31c7558-ff79-4d57-ac9d-fb81b780cfd9", "comment": "Malware payload (Mirai)", "value": "41cc391be42d758f819e303cfc458151c5c1651a951fdfd33da4d5e5383b19168f098e637d3c89ec02ab9a4660a2631d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "d1bac334-c5c2-4bcd-8215-cb19d0b6533c", "value": "T11923F121E4D855A5C5F47C30E9FC9B4522E92FA0A24CF5606332C2D6D9C79C272BA4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "ade05094-fdb7-4958-a856-5f97557365f2", "value": "768:gqPb4YOTeTx9krjuxxu0BszWd2FFq2oKeWojuHq3UIaT2UemnahFIS0BWOPW9+t:CTeNCCxjBjd2FA2Fe/6obhU8t085e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647404, "uuid": "f4bfb2f7-2db5-4d3e-a83b-ea3ffb0c1190", "value": 48540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647404, "uuid": "d5be4548-776d-4263-80e6-714e57c165a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "1773eccc-9496-4b4b-b831-984efce283ad", "value": "c0r0n4x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b127fb-3fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692595719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595719, "uuid": "0e2fe990-962d-4b71-afc7-b19d43c66606", "comment": "Malware payload", "value": "7147f5a82ce4e5d4c0ac9ef31a61e685", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595719, "uuid": "27c546c2-e119-4260-985e-98eaeeaea1bf", "comment": "Malware payload", "value": "5e1e79b104e41442160e3e95286e66e5bc60eb04a297cff540c28de26a4d7e7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595719, "uuid": "ced0954e-be6b-4f03-a573-64a61469c483", "comment": "Malware payload", "value": "20a630132308c935238826f98cbebc7754ff6474", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595719, "uuid": "b7ce1adb-ed4e-489b-a8c1-c144faa39a13", "comment": "Malware payload", "value": "0e5f4deb4f49bd5d88e4ace18eae60bd23b7ab0fc9baeb5fd0736fc9fc84c38d52e5a77e3f7971a30f1cde284ec9e131", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595719, "uuid": "a9dec629-e996-4a41-b4cd-7b57aac75f94", "value": "T15E237B447761C0B3D6DB163469B986210B7F7D839EF4949B3FE9020D4EB16C07A2A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595719, "uuid": "80b62137-0d28-4cf5-a6b4-d8925acfbe4a", "value": "07ed6970d80772ff905788fa3e1463f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595719, "uuid": "a1f84ca7-34dd-42c6-8eab-a70f5f5b94f9", "value": "768:dhTxc0Je3ufiM9T6pf+zU4bY50EcQISWYNKGIPsQyddjdFkUrXUb:dhTxTyIkf3ISjIPQfdezb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692595719, "uuid": "69a85bc9-4e73-4802-a11c-d45217efc16f", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692595719, "uuid": "b51048a6-b390-4df9-b90a-0dc1dbc30244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595719, "uuid": "e0c8b7d4-3bd9-4346-a834-30ea3abb232e", "value": "SecuriteInfo.com.Win32.PWSX-gen.21.1015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff35df04-4046-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692638416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638416, "uuid": "9a73c01f-b673-4e9a-a95f-b94bd05ac2cd", "comment": "Malware payload (DCRat)", "value": "18397ba48576ad2456729c000b13f211", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638416, "uuid": "41ef3af0-3d22-4efa-9743-23c734a23005", "comment": "Malware payload (DCRat)", "value": "5ebf567e06a8ae2e62c5a2780db96e9ed0f958868d7cce7b7e0eef9079e065e4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638416, "uuid": "c730efa6-562b-4f05-a9df-e67fb7979c27", "comment": "Malware payload (DCRat)", "value": "d71581d4962f074722b325902c3f4e8092e320b8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638416, "uuid": "77a29b37-f36f-485d-a292-2002e7ef7e42", "comment": "Malware payload (DCRat)", "value": "0ea13626507f67dfbd83ae3dd5b31e20810ad747e58eda42d7eec28c46779a65ddb13a784488d681601006f9edfafd00", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692638416, "uuid": "bfedf1e6-dbe6-42c2-9b02-2e4d4c9c897a", "value": "T1A4D5D001BE40CA11F0991933D3EF46444BB4AD116BA6E72B7EB9376D56123937C2CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692638416, "uuid": "03763514-8ec2-4ea5-9371-737516dace49", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692638416, "uuid": "8bf79e8b-b305-48aa-a9f0-1c5577d9f11f", "value": "49152:UbA3079rKgtTFZQEYEzA06kiobmY7jL2y6XiRrkHVjqJ:Ub39VxFmEzAnkVbrL6XiRrk1mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692638416, "uuid": "11efd123-72fa-4e4e-b44a-a378b41ad832", "value": 2852994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692638416, "uuid": "b1b5c0ce-640d-4387-9d78-fb216f3c5eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692638416, "uuid": "39a698e6-956f-4209-95a1-9485fe7a0312", "value": "18397ba48576ad2456729c000b13f211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c217c0-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596221, "uuid": "1fd34bd4-78b4-429c-aaa9-8f1a9ce4c196", "comment": "Malware payload (Mirai)", "value": "04a0b70114cb785c419f68b066331363", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596221, "uuid": "d6d22577-5a1a-425f-8509-e02d031dc8bc", "comment": "Malware payload (Mirai)", "value": "5f37f729699ad5598ff497d6670f393e57ee903f8f5989cb08a4048592ad6fad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596221, "uuid": "54fd7722-6827-4e97-abec-35199fdfd58c", "comment": "Malware payload (Mirai)", "value": "4bc94cb416cbce0601384772e826a5086cc990be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596221, "uuid": "f0e6173b-8137-4791-a40b-d6b0af69fd17", "comment": "Malware payload (Mirai)", "value": "1c540f21c82375856f559eb98b67b701b7ce1f43cebaee9d83a1f514f53cbc30c9cbbafde874e86133c118fc74cb69d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596221, "uuid": "55325f47-0659-429c-a44f-ae06d53556e5", "value": "T1CF539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596221, "uuid": "69c80e19-ed9b-4a5a-ab36-96899f049c75", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596221, "uuid": "8a0d0afe-0660-413e-bd6e-7861adf13092", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596221, "uuid": "30519aa5-a477-4484-adbe-c42b5b2776df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596221, "uuid": "66319c93-5d70-4c2e-8f3f-0d685dffe4d8", "value": "04a0b70114cb785c419f68b066331363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baefc725-4039-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692632718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632718, "uuid": "4ee873e7-fddb-474c-87cd-f7a166fc7cdd", "comment": "Malware payload (Stealc)", "value": "27cc1c459ca1a9ab97c61a9c5a0f9a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632718, "uuid": "e1c1f82c-6dc8-4761-b2e0-1bcc71618fe8", "comment": "Malware payload (Stealc)", "value": "6321cb7ca4e2ed3b0a5d3472556bfbe959343e0f7a971896189a8a1e7a467370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632718, "uuid": "69aa18ea-466e-4405-910d-3202eb2c328b", "comment": "Malware payload (Stealc)", "value": "286c4bef9f563b3d99ae5067c9ed7b42a1836bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632718, "uuid": "c8fe9fc4-ee02-4586-9101-02b66ec93966", "comment": "Malware payload (Stealc)", "value": "5f49677d3cd256f871a381244246913d4101fe884ebc4bef725dd5937f51a7c6da5744a8751b9568cae4c1676e9ec272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632718, "uuid": "60e37ad6-59f8-4174-920c-97a63bdf5f65", "value": "T18844AF237790E8F1F5574671CD29CEA47AEEB8608A69574A33D81BBB39303B1D227305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632718, "uuid": "2b046056-e0a9-4ef6-a19d-e94dcf518e98", "value": "dd524e0314968bf576181253b87644dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632718, "uuid": "05be937c-6012-4144-a102-56adc428d577", "value": "3072:skKhaxGL8ZTlFU7RrGxyPq1oA36QWSCuwb53gtZ:6haxGLsTl6GxoAoQ6fSvwhgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692632718, "uuid": "bf098152-482a-4992-a1ea-6eb5887b3f1e", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692632718, "uuid": "f296e742-2ad4-40c7-b04e-a2041bbc7203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632718, "uuid": "c4ee4be1-547a-4cf0-8df3-706d2d202772", "value": "27cc1c459ca1a9ab97c61a9c5a0f9a37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86a8731-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692627533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627533, "uuid": "8f1c336e-1c09-48c2-bb32-ce2d1c8f54ca", "comment": "Malware payload (Mirai)", "value": "34d1474e54e0cb20cacf6666ff01d484", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627533, "uuid": "3d9a648e-f4d3-4472-ab36-e455d5e256c6", "comment": "Malware payload (Mirai)", "value": "63e6f88d17d0a87667dc044dd357ceb1888e95fac275541f1c8627f456a7d6cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627533, "uuid": "ca1f4686-2520-42cc-819e-9287bcd634a9", "comment": "Malware payload (Mirai)", "value": "499d5f7d97ce7d85ff3774d81d1bda18d0781fea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627533, "uuid": "6f376ec8-b85e-4a86-8fc6-2a14658e0f81", "comment": "Malware payload (Mirai)", "value": "f7dd36df23ed603b233d74e3e9c1b59789b690054b75a8518b4f4c9f93e7392840049c5c1e4f419ef92decba60f46c87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627533, "uuid": "d01ab002-d0cf-42c7-a406-636727c76815", "value": "T10E330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627533, "uuid": "dfb49b32-6066-48d5-ba56-9bb5800a3431", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGZ:r/hqaJMDg9eqK806MHdkfQX6HuCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627533, "uuid": "e907d7ea-6e13-4065-b4bd-a1b001e616fc", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627533, "uuid": "db3cc574-f851-4967-825f-223ea8eea9b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627533, "uuid": "e76fc6a1-4304-4d7a-85ae-13275c77d073", "value": "34d1474e54e0cb20cacf6666ff01d484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5aa7f0b-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610349, "uuid": "3e167013-96c9-4d70-8ea4-9cbd0e3d263b", "comment": "Malware payload", "value": "499f55b966d61f29f74befddef15c996", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610349, "uuid": "fc9b5a21-fe61-4cfd-8280-fb747fc85a49", "comment": "Malware payload", "value": "63e8b5d09367fe20e502390f79e23207695666d2b2ceadf93aae4284b041bb9e", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610349, "uuid": "8209abb3-a35d-4e9a-995c-ed73f43d0d65", "comment": "Malware payload", "value": "ba12333bdd7ccf52b6c4b41c6bb83bbddcf68ddf", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610349, "uuid": "f1c53c07-f092-46e2-8843-90df24880779", "comment": "Malware payload", "value": "cef529faad933049db2e95cf5c4905e61774074c8c111d2df1d070f33315f548d0620e238c587f05ca7f658e356fa662", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610349, "uuid": "9a15daa9-0eda-4252-951f-29d51c344e41", "value": "T1A531B5331522804C9EF24C5D537EA77C67B3C4183BA4D79EA79449A85C01A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610349, "uuid": "5da37fc1-a55b-48f6-b06a-984794f63d7d", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlEItakK:4oyeP9YeYaMImCmoItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610349, "uuid": "89aa72fa-69ff-490e-a9ea-0199c065070b", "value": 1790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610349, "uuid": "400bd6f5-fc6d-4c50-b4e3-19cd86049c34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610349, "uuid": "a29dff99-c088-44fa-9c9a-6deed7b67895", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b498440-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692627511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627511, "uuid": "98522abb-0a23-49d7-9475-46b1589c0893", "comment": "Malware payload (Mirai)", "value": "1cf924e60fc38b883d1f98fc62e60146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627511, "uuid": "1c168f4f-ccd8-4fb9-b100-ee04d830acfb", "comment": "Malware payload (Mirai)", "value": "63ebe37e053d1cba3821b1717398503b2afaaa4d334e5186fd31a1e8c331adbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627511, "uuid": "de33667e-a009-4e26-987b-be4f760eb164", "comment": "Malware payload (Mirai)", "value": "abbc0089605daae72c4c13e175cdafc60b5aa601", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627511, "uuid": "e2b31bb6-cbbb-43a2-b2f6-fc21a9873fb4", "comment": "Malware payload (Mirai)", "value": "4c292e4eb618a283c73dd902f6b1633f003ab08c4d492f13c8959076533207c4596771ab26b73bcdbe2b0970ae68be6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627511, "uuid": "0403b351-a29a-4d79-9f6d-94f02855a187", "value": "T129432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627511, "uuid": "f518addc-dd95-40a4-8adb-7ec4e7465717", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwt:RqtmZPuutfbltZFBSJsBcfDSTFI+BEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627511, "uuid": "d5e71b01-8b14-4c88-81f3-ba7dab3c4221", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627511, "uuid": "25e242f6-698e-4995-937d-68b48c888a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627511, "uuid": "25e8a616-029d-4bc5-9cf7-afd6c6f45535", "value": "1cf924e60fc38b883d1f98fc62e60146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e860230-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610310, "uuid": "bf69687a-9072-41a4-8573-49fbaba05c08", "comment": "Malware payload", "value": "f0d419c8a13662117c428cc1eab235f0", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610310, "uuid": "a7fed8b6-cd78-43a1-9c18-95cc54fbc9b8", "comment": "Malware payload", "value": "640ee1cefe6f7e222ed17fb10a49fd82212dd7b3e7c25c2d2ba9ef0779c2d28c", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610310, "uuid": "4c6b6d40-9d72-4803-9144-384aefd71a88", "comment": "Malware payload", "value": "d4aa84cc145ae08f266c4930ca83c4ad66d7db9e", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610310, "uuid": "93d6ad62-ef3a-49d3-a056-aa7ef69e9008", "comment": "Malware payload", "value": "67488be25cf4299d101ced9d891b64e1ba890360d24db83c2e937aeec1936e271c1de427c89fb8b859ff7a49922dbfeb", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610310, "uuid": "3ae1e9c7-d797-490c-ac61-30662d4670cf", "value": "T13531D2331522804C9EF24C5D637EA77C67B3C4183BA4D7EEA79809A85C02A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610310, "uuid": "df5c013a-9d5b-4cfa-8cbe-b1e99db1e3c9", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlHItakK:4oyeP9YeYaMImCmbItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610310, "uuid": "03ed5c0b-a156-40b0-a377-1ad834c55c12", "value": 1790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610310, "uuid": "1d4335d9-09c2-461a-b271-f42f9a4bb0a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610310, "uuid": "998f0172-6986-44ea-bbab-0527058ef5f7", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0402d746-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692602776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602776, "uuid": "098f0e13-7f70-4dee-973a-f443e7d3d5cd", "comment": "Malware payload (Formbook)", "value": "0e2159397288f21642263788b1f71af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602776, "uuid": "7124254c-a0f5-4c3d-908d-4b65aefae9f8", "comment": "Malware payload (Formbook)", "value": "64414bcde682d419e1b429c0ceafaefb3dbc8764c019bf0d770d8c0eee907692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602776, "uuid": "3e7e5dc9-cc74-44c2-b897-ed70ea2d78d3", "comment": "Malware payload (Formbook)", "value": "6d2254324ab799fbd904341897a40aa7566557d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602776, "uuid": "0d7d4b3e-4bc8-4768-9cf3-8ab54f548f22", "comment": "Malware payload (Formbook)", "value": "cb930b152168c2299a429fbef5a56fb9dd6ff84d26753904df8fd9c381d5cd6dd4175b69dc602b721f8ccf7a6dd8af11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602776, "uuid": "91901bd0-7b02-411b-877e-be63f0ef0686", "value": "T1B9F3C55FFA9689B1C3995736C2D6052C5375F48276A3DB097A4E23E90B033B6EC0960F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602776, "uuid": "3dc67226-5b84-4499-b20c-f0e9786b32ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602776, "uuid": "06870615-189c-400c-ad1c-dfe3ef37013d", "value": "3072:bqO/BCbH6oVAJtoAfNr9BM7Zg01urVeWq3:OiUb/qxVr9qle4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602776, "uuid": "ba531a0f-91a4-4ab5-9d76-a70ca865a87b", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602776, "uuid": "fd34d603-b994-479e-803f-80322cf17253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602776, "uuid": "b7fec2e7-12f1-461a-b151-468e588a4da9", "value": "MVS Engineering Pvt. Ltd Purchase Order 17th August 2023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5440bd3a-3fff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692607635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607635, "uuid": "e01352fe-b540-402b-b1fa-ddac9d8ac9ad", "comment": "Malware payload (Formbook)", "value": "02a3420fffc0285ca90ab96cbe234d75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607635, "uuid": "00942ca8-4e4f-4f53-a0d3-b343bf994a4d", "comment": "Malware payload (Formbook)", "value": "65fac76f4e603b4f0142ee6e2ca0f950a5b927487040612f76368d9321d280ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607635, "uuid": "6739d25f-fe28-4c29-8cf9-727493b30c51", "comment": "Malware payload (Formbook)", "value": "4af27ddf735258ca202cf2b56b9f3560c4573dc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692607635, "uuid": "67a0c609-b8ee-4fcf-8886-1e08beb4c7c3", "comment": "Malware payload (Formbook)", "value": "3ead334c07fd028e159333b273b96ddf7b2512aff6c3c0516619226dd74fbc956ffe9e06a0c23bef16c3682edd9e3475", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692607635, "uuid": "69f1c3bb-d5ed-415f-96ec-73bc8c23bc1c", "value": "T191250126B1B5EF01C6BCC3F550502B44A3A755CE2179F1784C8AB4D6A2E6BC64F826F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692607635, "uuid": "e1339e9c-d055-45e5-b80b-c3fd2674d3b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692607635, "uuid": "05040832-3e53-44a5-9e01-206120b70248", "value": "12288:zSpoMC+zMBYyMHMIMSMsjYoxWbJjDvBeas4hq3rXa4PoP7afpWvLzoh8cXFeb/dO:zSylCe9qhJtYtvSMmaeoPO0vnW83d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692607635, "uuid": "5ee88712-45be-45ba-bec0-70074e49769a", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692607635, "uuid": "698c6c5b-dff3-4a2e-9134-0b0825dd88bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692607635, "uuid": "f55835d3-ccce-4610-92e8-0eb414b47286", "value": "02a3420fffc0285ca90ab96cbe234d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62866ef-401f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692621624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621624, "uuid": "1f995222-6c03-46a0-b801-3930046e2e25", "comment": "Malware payload (RedLineStealer)", "value": "a1726bf066aabd7f6a69a0cf33bbc080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621624, "uuid": "b385d539-40da-4395-8e62-3f9b7c75fd0c", "comment": "Malware payload (RedLineStealer)", "value": "680b9f5fe758d33fe29491c3b071d5b0cce2bc8d941382a58670b632a8f51eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621624, "uuid": "19f22535-a520-41c8-9dfa-7c22ff4acbab", "comment": "Malware payload (RedLineStealer)", "value": "20044880fc0cad5e99da865c560d690c255a66fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621624, "uuid": "2b32bf3d-5c20-4e63-96ef-d35098dea70c", "comment": "Malware payload (RedLineStealer)", "value": "7b22f5de0bcec97154cdc306250d882dfe52bf3b82500be1fefc312843fbfee86c0bef0061bc8987b4f962dc0f11987a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621624, "uuid": "c97d958c-a7b2-4297-ac98-0ab4580e0c5c", "value": "T1D2354A2138805271EDE71F7786EEB825C22DB0BCC77D76CB518456EECE205E26A31687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621624, "uuid": "6a8c1374-820e-41b9-b86b-64307af87fa7", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621624, "uuid": "0d809fbf-9e83-4646-8799-534b691862dc", "value": "24576:skd1/jg7PvqovaBlM+EIPeEUJqbamPCwwpz:skM7PvqoEM4prnC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692621624, "uuid": "1884e3ca-56f5-437b-88be-d17912afd7a7", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692621624, "uuid": "d980292b-2aac-4f5d-94c9-683d71fa7e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621624, "uuid": "fc2247cc-2b2e-4b86-8e24-442e2b09a1c6", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.19291.11472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b630cf6e-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610377, "uuid": "723f74d1-cf3e-470c-b7c6-4926da518230", "comment": "Malware payload", "value": "76436f0b4b115237bbfd83616db0d30a", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610377, "uuid": "a3f96969-8af8-4042-bd59-98b8322bf41e", "comment": "Malware payload", "value": "68a58a68e6b9cda53f5b688a206584d387b4daa887db0f73d086917771893f14", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610377, "uuid": "3c9fda25-6551-4b4b-ab70-43e419072c38", "comment": "Malware payload", "value": "78a39e2917a943d5839eb0cc79c58d6a2e3eb0c8", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610377, "uuid": "9f936542-e0bb-4e08-bba1-164b02bdb4db", "comment": "Malware payload", "value": "e1996682dbca060b154e34a87cea36912850e4cc4e3fab11b772f32f65d9030c8139bee6d873a83e9d5cbea656a79d92", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610377, "uuid": "28acd14d-c436-4b85-912c-6a2df3bb06d7", "value": "T18631B2331522804C9EF24C5D637EA77C67B3C4183BA4D7AEA79849A85C02A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610377, "uuid": "9e4a20a2-e371-454f-b95e-81ea083432ee", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlHItakK:4oyeP9YeYaMImCmjItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610377, "uuid": "ddc98c4a-c4c1-46ed-8799-2c572dfc95b6", "value": 1789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610377, "uuid": "606cf15c-c9ea-47f8-a43f-57e64c4f9ccf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610377, "uuid": "5e7528d9-7e28-4942-abcb-5befd144f022", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7a39b9-4027-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MassLogger)", "timestamp": 1692624886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624886, "uuid": "e6b91eba-7529-4b01-8749-eb987eb95b75", "comment": "Malware payload (MassLogger)", "value": "68ad59128d4415c8782304dca63a2c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624886, "uuid": "7b1e694e-45b4-415c-aceb-4a170564afe1", "comment": "Malware payload (MassLogger)", "value": "68ee65bb45de4a1519929a82d16dd46954cd01e96b3e42d3bc42e146c8395d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624886, "uuid": "becac3d8-6e2b-4365-bfb3-30ad45369818", "comment": "Malware payload (MassLogger)", "value": "0dd3ba0c6688b90499a5a85ed4b4e5ef4fa7c02d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624886, "uuid": "d595fccf-5667-42ae-afb8-0afda3739d36", "comment": "Malware payload (MassLogger)", "value": "60bf62d04f8f53e0c149139b4b7a15343a7169f66401b6259805c578a3bc1213e136892014318adc139767ca5574f79e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624886, "uuid": "6bb3545c-4c03-42e5-8ae4-0fca042d1798", "value": "T11B94020A2B7F020EE8603A73C478FB8A75D8564B9028E719D760BD4F1F29F5A0D6B4C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624886, "uuid": "90531dda-c853-4a49-b157-47ff9b4585e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624886, "uuid": "f63077ad-03a6-42bf-a826-f4cef4d71ff0", "value": "12288:3kvVRtBhzy7HTwzMLgs2hf+b/GiZUfbL/:3k3tjIHUzM6hf+beBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692624886, "uuid": "c3fca8a5-1cfa-4b9a-9c40-8d6f229f1e10", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692624886, "uuid": "85d82762-a521-4a41-a5e7-4edbbb8f45ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624886, "uuid": "9c0bfaa3-ee07-4d1a-93df-54a67c448acc", "value": "payment_copy_gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32c54ed-4073-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1692657616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657616, "uuid": "07df7472-2870-45eb-8acb-4efeca6525b8", "comment": "Malware payload (AveMariaRAT)", "value": "24d37ca5499591f7ec6f0e8d3861ce10", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657616, "uuid": "58ab62df-69f1-4ab7-8a10-68f20fd405ff", "comment": "Malware payload (AveMariaRAT)", "value": "6954548b5da8aaf8acbb65595e8e4bcba34ea699b6de4f66b13c21d7cdbb8cc7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657616, "uuid": "1addf38d-2d55-4934-aa00-db4c3ae5e8b5", "comment": "Malware payload (AveMariaRAT)", "value": "708d7c289a8fd9ad66047ae95a4fe9bfb0d17b2f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657616, "uuid": "530bd9bb-945d-45ab-9091-b2b28a7f2c59", "comment": "Malware payload (AveMariaRAT)", "value": "328e4a03ce2028a514a7811fa1b615987bf18b5b9b273ae22e70f06cd40b6a7ea512742529dce53fee1bff836db4acf0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657616, "uuid": "b4849386-d8ad-4835-8f4e-414496247a60", "value": "T136B3AE13F7E54835F3B201B01ABD7E79CBEDF9700668C49FA394858A2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657616, "uuid": "63a6abe0-5ff0-4da6-9718-0473056f2065", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657616, "uuid": "be251392-a054-426f-b956-0e9af1e470bd", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxW8IB4u0OVE01:K1VmhaH8EFvW50OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692657616, "uuid": "e31b48c6-87fe-43f1-bdc8-25d35ca3902d", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692657616, "uuid": "3cb72aa7-b1a8-4c44-a523-118573b72c63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657616, "uuid": "ec824b12-a0db-4bc4-a914-1e6ba1113130", "value": "24d37ca5499591f7ec6f0e8d3861ce10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d5a1a5-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692629910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629910, "uuid": "b002e88e-fa0a-412a-a955-ad5a45872daf", "comment": "Malware payload (RedLineStealer)", "value": "ea574dde100b38b040b422c37ef6814b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629910, "uuid": "d75def1e-dc2d-4ffa-adba-d2facb4cae79", "comment": "Malware payload (RedLineStealer)", "value": "696b6607853c35bf80ba50b4784cf28234686f6152750c5ed42c6596ea3f8775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629910, "uuid": "9548a1f8-e83d-48f9-8fe7-1a43e9bdf975", "comment": "Malware payload (RedLineStealer)", "value": "e29a978f7c4c225d37ddc87a2a0ba82d23eb99ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629910, "uuid": "6e08e4fd-4b0d-4bbd-807b-390b966b43b9", "comment": "Malware payload (RedLineStealer)", "value": "8c25c2c6434eddc091d27a2d43d4a447219dcdc6ab13d9357c19fdc52144c3e66eccc86e0e99fbfb86174104e35ca447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629910, "uuid": "8e4c4fab-6214-40b1-946c-45a51ac70fea", "value": "T12D74AF1363E97C60E52BCA329E3FC6E4362EF5214E5D7B562338AA3F04B19A1C163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629910, "uuid": "c8d3cd57-bfec-4bee-826d-73ffb19c8ff3", "value": "1ce217138c8d71ee8a89ab6f1921ee72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629910, "uuid": "12cd9722-22a5-4d55-b154-a2dc1457529c", "value": "6144:37enmv0Vl/GA0cegen5xpLdP8D9zJLx9o1FXOFHBCi:37Ck0VVGAHQ5fd8DPl9EFqHBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629910, "uuid": "832b56d9-c1cb-4574-b22b-af9f35c98700", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629910, "uuid": "1298d5de-03a7-4cee-9f75-90b3a9b023be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629910, "uuid": "9af8c8cc-f119-417d-8ba2-6d1851c4f959", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecac1bec-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692647405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647405, "uuid": "3cee446a-67c8-4fc6-ada4-71be6f739628", "comment": "Malware payload", "value": "70689fcb460794c34c469199a1f6c85c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647405, "uuid": "219fae9b-7073-49d7-b9b8-f4e3d47668e4", "comment": "Malware payload", "value": "6bda88b582f3649abcd1b99b9bd8138b24c76124fbdc60e3bc80488b2f29eb80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647405, "uuid": "0088a445-4a45-48bf-a834-d7604506c72b", "comment": "Malware payload", "value": "447ada592907b4783f2f01f3d191069326bd7a72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647405, "uuid": "2776abe4-2aa8-445a-82e3-de2edba3c0fc", "comment": "Malware payload", "value": "688310280297a7bbd059c9ad3af6502a0a1c50681c8f87a45c63b75be1255da310707ac6d56ba06e61f7dddca7f22269", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647405, "uuid": "0239249f-f0bd-45c7-8ea4-7a76e323b97c", "value": "T18DC2CFAEE9183E86C9CD0878846523917D9BF2C2404F5ECD9B324C944F6285BB89F8B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647405, "uuid": "44b6f89c-7118-46fe-aa09-392ed8a05e01", "value": "384:7qjQb+w72R3cjMaRzI0o/DGri026tQKcD9Uhap5vUs+NP6Zu4PdRWGVCzhMhHIlF:WMfCuj1RtaD4i026VuRPvCN4u4PrWMaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647405, "uuid": "e1fa3f73-94c4-442f-8542-4dc66057559c", "value": 27040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647405, "uuid": "339b5931-e872-4be5-9b9a-d6b8d95de723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647405, "uuid": "475f0061-86e3-445f-a6b1-88b97aaa6d09", "value": "70689fcb460794c34c469199a1f6c85c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac08c67-3fc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692584722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584722, "uuid": "91d085c7-ccc9-49cf-84f2-2418133e2bdf", "comment": "Malware payload (RemcosRAT)", "value": "746a4fdb32aa91017dea599b08ed54f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584722, "uuid": "e2c13455-9a8b-44b3-b046-acced08c45e8", "comment": "Malware payload (RemcosRAT)", "value": "6c22a71e2d8cc768a03a878df38e2e0ad7719e1e90ce288b59f3e50131aa4853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584722, "uuid": "ca96176e-af85-4dfe-973e-c45ea3be206d", "comment": "Malware payload (RemcosRAT)", "value": "9703ebccfa75b65bb9b020d2a4fab0651977b767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584722, "uuid": "4689af3a-f210-4ee5-9f4c-fa950651c1f8", "comment": "Malware payload (RemcosRAT)", "value": "6abf4c7c569b2b0ae145fe1ff51ee6862598eb759117032f67d0138e4c66e995c8ce6df4da5c82da96546fa595830493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584722, "uuid": "99c474d2-bf4a-4fad-b179-6bbb1ace018a", "value": "T176659D0739C065CBC21D823E406D59A896ED963D317FDE26305C92A3B1FF2886E4DF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584722, "uuid": "ebda6f8a-1fd9-41fd-a650-fa15b085c0e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584722, "uuid": "16a9dc13-197e-4369-b063-52db48079305", "value": "24576:8rHGoiwG4UhrubvPiW43Of8Sgzme6pFgz7yx4L:eHZiqsuWWi7SPiz7yx4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692584722, "uuid": "5d5f1d06-39d1-4632-8ec7-6d34a4c97ea1", "value": 1431040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692584722, "uuid": "8546f5bd-1723-420d-a897-0b3b3a74def1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584722, "uuid": "c1a5a2f3-3c95-42c0-b7da-db99d5f8af80", "value": "vANbvdl8BV6NzL3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bda9ea-3ffc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692606480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606480, "uuid": "00a140c2-bf1f-4e02-bc19-b4d1daf98f15", "comment": "Malware payload", "value": "cc82a7a17283931d1750f3d46441edb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606480, "uuid": "969e10cc-d6a1-411a-ad25-5bb7ac3bae7f", "comment": "Malware payload", "value": "6dec8ddbcbb266b7d575e319a48d32286091e6a73a1c1b41454883a421c4b8f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606480, "uuid": "4a1c2297-c61e-4f63-8059-bb96418431d2", "comment": "Malware payload", "value": "922147ea68a96ee9fe680887de510563fc1a5236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606480, "uuid": "396e29b2-1cbd-4526-87dc-87cb65fb1f55", "comment": "Malware payload", "value": "a291f0d8530fd0930bc263326d05112293fdbb80a9fa911e6fc74e7b40dcf1fc0442782bb9fd748ed9fb50711b0741ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606480, "uuid": "7775e30a-914f-4c72-9c94-d2ededc08cfc", "value": "T1283733527740D81BD2590AF186B5D3B65322BCA696D3458B3DC9FFA73A30787EC6808C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606480, "uuid": "d5e44466-9e72-4d49-a442-ee383a465977", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606480, "uuid": "9c7c2bc1-e09a-4e0e-a316-acc99a482e30", "value": "393216:4qontkN/S7+F4rxu30jgoM4EQQq2GJJvawfEWEjlSmZFY1ewMg16SNKltxSpmOd:4qotkJ++uW0jvMSDJJ1fdg9HK7MCbNKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692606480, "uuid": "b4358370-4b76-467c-a3ac-3541019e64cd", "value": 23740376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692606480, "uuid": "8a5295db-8988-4fca-859b-a2ba4ca71fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606480, "uuid": "86adfb5b-73f9-4352-9fb1-82139bb91a82", "value": "openconnect-gui-1.5.3-win32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8b0bd3-4012-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692615679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615679, "uuid": "c378cc79-1860-4bf3-a087-1defb50334ab", "comment": "Malware payload", "value": "afc0b2fd2703a474da53d77281939d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615679, "uuid": "f5d34b6c-23c9-452c-ae29-bac4906d4b03", "comment": "Malware payload", "value": "6e9ea172fac738e880fd00c48370c128e0cac9d1ed6f2be2ea1162c9e972b5fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615679, "uuid": "30b63e49-5a7c-440d-86a3-5c2b0025f044", "comment": "Malware payload", "value": "df5b6932d5977738819762e259f753a0d60a4567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615679, "uuid": "d4662b8e-0f2d-4a56-9ef8-18d503bf567f", "comment": "Malware payload", "value": "4f48df230dd48431dd6c162cacb656926b529cd8f96b3e1232014a28d48964af45718ebe422c553bddc3e56dea9e9ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615679, "uuid": "bd622eaa-e181-4b9f-afd0-0b465080f633", "value": "T118E48EB2592275B3C450103512971FE786F8BEB01BACF8CFA2CC3B3CD56A55199A3B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615679, "uuid": "02ff8b70-b3b1-4bd4-8e3d-f23409888c96", "value": "8775200f9e4535104121eba613785cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615679, "uuid": "2a17b12a-3013-41a8-b586-5da1d228d9d1", "value": "6144:nwluJyri4dFer1KtYEXIEbnIE8RG/jDXxG1QdLMRG/bsDEPJ:wlBbdF0cI/ELtCmLMEjqEPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692615679, "uuid": "3b8a9674-873f-4f82-aef4-83db933b1edf", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692615679, "uuid": "fff91458-12db-49ea-9c34-d5065972c931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615679, "uuid": "8664a3bd-9b68-4374-84a7-eb94c1f80520", "value": "OBDTEST2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ee1655-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1692627529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627529, "uuid": "aff1a841-277b-4ed4-a6b3-c1e470037c36", "comment": "Malware payload (DarkTortilla)", "value": "59d87693d6d2331e75665972353331bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627529, "uuid": "6d3c18d8-b906-4c57-8330-cdf92a22bd64", "comment": "Malware payload (DarkTortilla)", "value": "7177acd8a2b07f743dffb49442833163846c0f6e3f41056aef83a89185f0b743", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627529, "uuid": "66718724-abcc-440f-8ae9-4eea02661ff8", "comment": "Malware payload (DarkTortilla)", "value": "1d386ea5a83d96528071a667d96ca2deba87802f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627529, "uuid": "72ed448c-561a-44ce-aba7-5e879a0dae11", "comment": "Malware payload (DarkTortilla)", "value": "357d138a19344308c75272e5e19c15a9d03b80e732c78c8669f53948cdb3217b718b42ef40c5fd0ce03c5d6ec6f8d9dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627529, "uuid": "399c831d-8e24-488a-9971-f157752ea614", "value": "T1D944F14EAFC665A6C93E4B35C63A70AC32B592378107FB6B44C470F9AF6379E1441683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627529, "uuid": "d8ca6e96-946a-4856-96c5-39c96a79704b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627529, "uuid": "55b21a75-cefb-4667-8257-1f9d39bd44ba", "value": "6144:/A2ZQ0dDxUQePwXiGZ3E8UUNIfUt+B8UTR/XMFKT0T:/A+NePwXiGZ3EzE0dGsRPMFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627529, "uuid": "ea5e9840-a5b0-468d-a563-83f5e932753e", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627529, "uuid": "6d4b56dc-803a-48ea-ba31-c7e5996bd2b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627529, "uuid": "44eb9ee6-e833-4f6b-b301-c1059a081745", "value": "59d87693d6d2331e75665972353331bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d25282-4048-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692638934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638934, "uuid": "e01de7e0-606b-46e3-980c-84291061e811", "comment": "Malware payload", "value": "873022c9b96cc23af24246e96e9b82cd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638934, "uuid": "ee7539d6-87a2-45a2-b2b8-56c6deb2ca07", "comment": "Malware payload", "value": "72461853ff5181bc2f91d8b142e4f8da46edb81ed23c4a077c806b76e73e0a80", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638934, "uuid": "73040334-e877-4262-91b9-ecb82ff05f41", "comment": "Malware payload", "value": "4ced8384a125239ade93fdcef158d472d88a29e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692638934, "uuid": "c0c0bb4f-4c47-47c9-9462-053360a359c5", "comment": "Malware payload", "value": "4eab4b4d46d546b5b1750965182cb843a4c49dbfe256d0fde11d541ccb518f3d30fa59db5ddaffd82c7e957191a51ef5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692638934, "uuid": "f2ea727f-c748-45c7-9431-c8e35606c465", "value": "T13445BFF875047DE6266F576BDA96ACDC03B62B638A8BA4CD806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692638934, "uuid": "2c6be5d3-ec32-4f6b-8733-8c10f9eadb28", "value": "24576:W9gsNbh6dyaGeDMurNteoGvxvtK8no7bIpQo86FEGdvT12jazgmzv5zWnMs14q+P:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692638934, "uuid": "f06257c5-e043-4ddd-bf1b-b6862a969a48", "value": 1217118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692638934, "uuid": "5356a96c-1fa0-4ff4-9d42-a1fe932e477d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692638934, "uuid": "6de7d3c0-6fa1-43b4-ab2a-470ab55fd717", "value": "RFQ Annex I - IV.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7149e5-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692610285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610285, "uuid": "c06fa9d9-5595-42ec-8cd0-79b978a90565", "comment": "Malware payload (RedLineStealer)", "value": "2559713d1069ceb511056cb5cc01a2c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610285, "uuid": "91742ec7-c43e-4a79-b66a-0af0474d6ce9", "comment": "Malware payload (RedLineStealer)", "value": "736ce6b7e36b2bf8e9fa7c438b5382635b400fd38dda3e775d3514699491c5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610285, "uuid": "feee3e26-747f-4eb8-bfa7-81c13e9c0035", "comment": "Malware payload (RedLineStealer)", "value": "bc8a6baddc9bf92f9e3b9c17dfc045f1ceec760e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610285, "uuid": "95229bc8-260f-4466-91ef-86523cd75780", "comment": "Malware payload (RedLineStealer)", "value": "b3ec860805e366aaaf137fb72bc5c80d2cb5ec08a9b79b1b940fa49732fa208d7249e666750613d490c26c68341223b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610285, "uuid": "b596205c-36bb-40a0-b388-0aaa6e7145fd", "value": "T1F6356B2D7C819132DDF210B64EEDBB6B465DA0B007E589CB52C50EEFC62C7E16A71287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610285, "uuid": "50e8c135-eb87-4f4f-8cb6-4440c4cffa5f", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610285, "uuid": "6d4603fe-2cae-4fd1-a7b3-26a853bd7e14", "value": "12288:Rk7VqU/1/jovUc7PvqoPXaS3Kt/VCzpG5XM+mJI/3eD5+1uYdHp3LqpdCgxIwmm9:Rkd1/jg7PvqovaJlM+EIPeEiBYwpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610285, "uuid": "f9d82be6-5bb7-4246-a0f1-609904adc8ad", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610285, "uuid": "5064467b-8ad6-412f-9f17-18f2a08d51e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610285, "uuid": "73f6d52e-4225-4045-b309-ca7ea0e5048a", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.15514.25543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0765680a-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602782, "uuid": "b6cfaf4b-d2be-4669-a0b4-621626085997", "comment": "Malware payload (AgentTesla)", "value": "23577993f0b04bc14dcc4ab618ccf390", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602782, "uuid": "87b280a6-59f5-4c55-b5d4-f4745084c093", "comment": "Malware payload (AgentTesla)", "value": "7450bd753c6072a9262368cc84b099d84bb21c65504efe08281304a7742ac500", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602782, "uuid": "050e2dfc-661f-4e59-b568-88fb128678f1", "comment": "Malware payload (AgentTesla)", "value": "51a3dce364fc1c175af47acf555d67413f9b2955", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602782, "uuid": "5d33f669-f60a-48d7-93c5-a6e15108fd55", "comment": "Malware payload (AgentTesla)", "value": "9c74971bffd9c741f3d1f1c96229d192119088d4f90707454d289a78b58e556f3229e6cc244f3dc07ec8ae887a66b768", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602782, "uuid": "2550ac05-37d4-4a80-976e-53ee72200a6e", "value": "T187D423003F611B29C0EF2BF824767A4643F46A126632DF1C3BAE16DD17B77841A52B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602782, "uuid": "ecedcaed-2cab-4c5d-aca9-755e43cfada8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602782, "uuid": "3ceb3417-de95-4ba2-a9e9-32ff6a6530e8", "value": "12288:u0Dl+C42xjW0Atv+v+8isDoSUNuZxFJn32gtYRcQejEUAtkQJFyENA:TUtmJDox81cIuTtkCwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602782, "uuid": "4ae8568a-8d70-4e33-9347-a634ad138362", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602782, "uuid": "6e6efa4a-adc6-4b61-914c-d781f7cd1607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602782, "uuid": "b9a1cca2-7fef-4702-ad84-8aa6ca938314", "value": "Payment Certificate for Euro 174,853.61.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db016353-402f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692628477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628477, "uuid": "347f0b71-5485-4da8-aec0-d782fd6ce62d", "comment": "Malware payload (AgentTesla)", "value": "fd8138705213146a718b2a702be25773", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628477, "uuid": "dc094376-4d40-49f7-baf5-423235234866", "comment": "Malware payload (AgentTesla)", "value": "74ff17aae3f0515ff88a92b8ec843696b7b5c2d5048994ec9f627a5b5391d761", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628477, "uuid": "0139ce72-0218-425e-a1d8-435b9e669339", "comment": "Malware payload (AgentTesla)", "value": "f64aecaf706fc0e8b6819dabf82ee3718e58cfc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628477, "uuid": "fa814469-46e7-459f-926e-5c8827d3e7df", "comment": "Malware payload (AgentTesla)", "value": "d5c19ca48a3c2252b2b67e0129d5a13289738dbbe7cc4a4ba330a970e69d7c71a44f12418a8a4a16702ff2205b25d87f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628477, "uuid": "5434686b-cc66-4128-9a2a-4170964ffcd5", "value": "T187350227B1AAEF05C6BCC3F590512B5493AB06CD2176E17C0D8B64E6B2D67C60E426F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628477, "uuid": "eef68f35-e113-4662-9ea8-dff92624e596", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628477, "uuid": "970d7633-e142-4d1f-918b-aa53af6dc41b", "value": "24576:7SelCe9qhJJ6wPXyBGWXveRl9n79Y+O7k7r3nrEL8uiR5K:zlCe9qhJgK5YmRn93N3rEL8tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628477, "uuid": "213bcc92-9158-4ead-8d46-88f8fc32eacd", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628477, "uuid": "efeac0e1-0479-42ea-87ef-83052937bbfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628477, "uuid": "d5d12dca-7db3-480f-a8e5-aec241551129", "value": "SecuriteInfo.com.Trojan.PackedNET.2290.18406.25496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57b0f2a-401f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692621623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621623, "uuid": "efc59192-e177-4853-a260-e35185ebc339", "comment": "Malware payload", "value": "b5de9124d3887b830cc696127cd7cd6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621623, "uuid": "6fdf89ff-6861-4aea-b12c-6f22b8d67669", "comment": "Malware payload", "value": "771d39099e357ea35408336ec1d082d31fd4d70c0889cfd549c1dd520c92ed3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621623, "uuid": "ac42ba42-b4ec-410f-89b0-c69a6ea05fd7", "comment": "Malware payload", "value": "5a917bafb0b237b99d621ee8912af0afc59131c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621623, "uuid": "700c9ffd-53e0-48b3-ab7d-bd6ee80e6b3f", "comment": "Malware payload", "value": "65d4216d8b3982419d29ccf7df35549d8cf5a2448c65d01bfc499ad3988d03e1fc3da80195f52de7f61eba0189dc760f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621623, "uuid": "8f78006d-c482-451e-a0df-49bfec2faa52", "value": "T147F312EBB60B9DA5FBF369B1F4BB91D651043009EDFEEC4CE6449E227E08325640502E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621623, "uuid": "0b32010f-960f-45a3-914d-e4e9d66f81a6", "value": "3cd7e5161b5d271e760d285d9fa837bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621623, "uuid": "42dfd0c1-c009-4acd-bc15-3a0c1bafb959", "value": "3072:eNFwdmspaPg9g9oOavAQBNrPkVdc88GjU+vF6nuxRocX5GOOUleo+c:e8d1/w5KA81IJ8GpF6nuTmOOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692621623, "uuid": "3769a11a-8d33-4779-a71b-bd6516420b24", "value": 165340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692621623, "uuid": "6c445164-d12f-4cc9-9612-b46a9c3295cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621623, "uuid": "45f89246-675e-4612-995a-a4a1a2667a64", "value": "SecuriteInfo.com.W32.VBKrypt.BIU.gen.Eldorado.13535.9984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c9c492-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610356, "uuid": "bfee93d7-a031-4a58-88c0-73d075469296", "comment": "Malware payload", "value": "9e4b2b599fb57ad12cae8b54c3130785", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610356, "uuid": "47e098b0-069f-44e6-a63d-8d687a948cec", "comment": "Malware payload", "value": "77439d3f755179303ef75791d2111fe26b7a8f3f3f4c6be5788feca4d8f0ea32", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610356, "uuid": "ec3d3765-933c-495a-a47e-5897ac520a50", "comment": "Malware payload", "value": "c8ea99c9e10d286e73993e7874ff8935399603d7", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610356, "uuid": "d1b3c104-b834-49b6-be06-c7107cc66e45", "comment": "Malware payload", "value": "7dc0de01127c3909e1575118ea4c50b140a12718615ed59d1548f3a2fc529e864be448af3b2c929683a77bd824be74ab", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610356, "uuid": "23ba6b51-a273-42f9-b2d3-77c9c61b7a39", "value": "T12931D2331522804C9EF24C5D637EA77C67B3C4183BA4D7AEA79809A85C02A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610356, "uuid": "1953aee0-4a27-4e37-92f2-927f7908409e", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0Yl0laItakK:4oyeP9YeYaMImCmQwItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610356, "uuid": "222c755f-d627-4c39-9476-fe1e53908391", "value": 1795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610356, "uuid": "048cc7be-158a-41cc-87c6-abb46f0cc700", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610356, "uuid": "db9035e9-bf6c-487b-b4b8-b4b7567d54f2", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b28301-401a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692619237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619237, "uuid": "9f535029-3089-4621-9c23-54480160d125", "comment": "Malware payload (AgentTesla)", "value": "d6eb3e6db09a1477dd402372d76f3c71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619237, "uuid": "f10a5b15-854f-4c1b-a0fd-962921c87165", "comment": "Malware payload (AgentTesla)", "value": "78589730c5ebfb1b95ff5a9351a22f312fcf5087523f4ef38b93be6fbfa64655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619237, "uuid": "92704c1d-88c2-4a22-bc5b-9e51e06e7442", "comment": "Malware payload (AgentTesla)", "value": "79331853d7167b47cc64aea34e51ca9bf5fa1f6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692619237, "uuid": "e681c98c-5b77-47c0-88ae-d3a83c888099", "comment": "Malware payload (AgentTesla)", "value": "d92c059e7ee933955c90f6591a77bef630a2b8be30a340cc6b50a763c139748793ee0069a45865877e64771164b26628", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692619237, "uuid": "0c248d80-a7f8-45a6-93ab-fe2a5801717e", "value": "T1A8350127B1AAEF05C67C93F160902F84A36756CD1135F2384D87A4C6B2E6BC64E526F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692619237, "uuid": "fa0237cd-c7a6-4e3e-b443-6ceeb5a19944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692619237, "uuid": "d0a9d5d6-6fe1-4cf9-b674-5ba22f97b3a1", "value": "24576:7SnlCe9qhJlwUurWyuJoVvGDLZVqoQfNUg:mlCe9qhJlXDJYvGXZVJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692619237, "uuid": "3bb23e54-a250-4b4d-ae90-fd960183bdb9", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692619237, "uuid": "9df25e7d-75e5-4578-b941-3c4303f6fcfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692619237, "uuid": "8150b70a-22ae-4a22-bd21-40d1e22d92ca", "value": "INVOICE_933736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cd4274-4012-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692615924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615924, "uuid": "f66c4b7e-5735-415d-bc3a-bbd9df461500", "comment": "Malware payload (RedLineStealer)", "value": "147d85307d31af1ab76424814004b401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615924, "uuid": "8c75da86-e28e-4742-874c-c5349087e0c1", "comment": "Malware payload (RedLineStealer)", "value": "79039f6afc98e7200b02000f9bfca78bbb332d19034734ee89b2dd3ece87fa17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615924, "uuid": "62dd6ff4-3281-421b-b132-317ee8d0a6b2", "comment": "Malware payload (RedLineStealer)", "value": "64c40f5f83f50bc7a78cf2ac8628b3c8423a85c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615924, "uuid": "67804584-ad87-492f-8e4f-0bcf2eaa2833", "comment": "Malware payload (RedLineStealer)", "value": "80179b91759d7a509344b97cd4967e0542cafb06835c048fcb634845bc9b0cb66623edd998ff08c4fbaa6777499c0d96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615924, "uuid": "ede49d86-ff51-4c69-a00f-05eec85c49d6", "value": "T17625239297E48633CCB167B42CF5A387073ABDB449B887671714589A1DB3280E935B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615924, "uuid": "46493467-634f-4ee9-9034-b223748df640", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615924, "uuid": "d7d941e6-e080-4360-ac25-06df6082ac23", "value": "24576:Iy5r2tjIYdm38bI4TFA50hqogS+dR0wyeSq15c:P0XPbI4G50cS+fSq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692615924, "uuid": "ddf05ab8-7402-4a1a-8b47-0d413346d55d", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692615924, "uuid": "48deac32-52c8-4ade-832d-bcb474067bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615924, "uuid": "83bbe982-3836-463b-b365-845df5387900", "value": "147d85307d31af1ab76424814004b401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2b2e11-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692627541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627541, "uuid": "50f54aa4-fc4b-4417-8b5b-25e4157e7ec1", "comment": "Malware payload (Mirai)", "value": "34671e6d8d2bc724d6cfe63d3560ca26", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627541, "uuid": "4e3419af-30a6-42b5-94a9-cd72948a8462", "comment": "Malware payload (Mirai)", "value": "7a429ad204e8a109822f52f929bf2fcb8187e23e5f473f618cc133ce72f6fa91", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627541, "uuid": "9afadd89-2ffe-45cc-b9ab-fa0cf18c6af3", "comment": "Malware payload (Mirai)", "value": "90fc7bbd8519cb87ed7f54d95d6ffb7dad2c8b50", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627541, "uuid": "0d6524a5-83fe-430d-8572-d4721d0bcea8", "comment": "Malware payload (Mirai)", "value": "dd0c4c64648077577a3b56a3e62b8f686c42452fc2086ccacf393a33f14c1ee5930ea7f84ec11f42197db77f08ac975f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627541, "uuid": "22c23521-b206-40b6-93db-001aba0f801d", "value": "T10BA2E17EFB20C18CF046847E1997257B456FE8A657A4530FAE15D0C700C7ACEE49AEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627541, "uuid": "f2db1835-de12-4372-85cb-c5293114b1a1", "value": "384:qDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chiM4HhBJhpExUC03uhHB3QJmRxfGcX:qDZ5Dw7RjFjcU+O24sDS4HhrhpEguX3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627541, "uuid": "15b69648-c2c6-4479-bcbd-18d390d38aac", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627541, "uuid": "072d5386-5797-42cf-b36a-9bf73dbdcce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627541, "uuid": "dc714fdc-6cdb-4387-a048-cb068560e287", "value": "34671e6d8d2bc724d6cfe63d3560ca26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb323813-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596212, "uuid": "9096a176-db4b-4f62-bc20-9af5715aa2ae", "comment": "Malware payload (Mirai)", "value": "4d4f1c722b03138fceaf06791b933f1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596212, "uuid": "3d088a1f-df59-47e7-a5d2-7a1730f98875", "comment": "Malware payload (Mirai)", "value": "7a76de26ee814a22eb23dc15379c264c86a508c77bdb8d78e8958ff090ef68a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596212, "uuid": "e526a59e-e915-45c8-8e90-3cddbaba62cb", "comment": "Malware payload (Mirai)", "value": "45a59de98423b193a67e050dd1a2aad4a20528fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596212, "uuid": "a3ff9e4f-6305-43e0-8b62-4e23aab8a0fe", "comment": "Malware payload (Mirai)", "value": "54c8eb663936400aa510067f6e0339bc98da0c1d82d3f74ee08e25d6ebef34c6098ded3b29e3caa662289c689dd287be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596212, "uuid": "a42dce27-8065-4980-a487-cc4514d9e487", "value": "T174C2D130A7FA2CB1C7500572E6B85BC6BE530F7DEAFE3890214147BB784190629F99C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596212, "uuid": "4f409af6-d900-4df9-8aa5-c181ba6c61a5", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEcuv6hymdGUop5h9:A7soTAZ3alkXLvFh8nNEnis3Uoz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596212, "uuid": "f3eedf6a-915b-46dd-b38d-38f27e603389", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596212, "uuid": "5b4f98ab-9d81-4361-9a69-f5a452c632dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596212, "uuid": "99a8e039-bdff-45a8-b685-283eb45a7124", "value": "4d4f1c722b03138fceaf06791b933f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbad98d-4073-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692657339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657339, "uuid": "2d51fa1d-5cae-453f-9618-fa4a2905d633", "comment": "Malware payload (Mirai)", "value": "8c36e194794b6121143973adb3e42a3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657339, "uuid": "457f3ded-0700-4f80-b023-be60ddf9685e", "comment": "Malware payload (Mirai)", "value": "7ba3a9fc3f6789dc458c2bc1dbf540efca1e340b4be7dc5038acf01450521e4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657339, "uuid": "0463c880-a8ed-42c7-a5c4-79d92146b502", "comment": "Malware payload (Mirai)", "value": "b3b17b30fb94796d0f46fba749eb550972755ec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692657339, "uuid": "ab8dc880-06f2-43dc-816a-0565b6235549", "comment": "Malware payload (Mirai)", "value": "d5208f795bf5123b03d0a052a57e65e0c84b3286f966c1d8875fb2917d318743e2e4c62d4a1aa410d18e87871046c93a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657339, "uuid": "e7851a27-afcc-4ad5-8c75-a1795aabb85b", "value": "T168F2F124B602EA7DAFA07C39E9F146C3B36A6E11AD816531A41506BDE4371403FBF953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657339, "uuid": "e75bdd7e-37c6-4fa4-894f-6ef07c55e859", "value": "768:93mZVjmNiMXuLs9a6/cKGgKR9QYk13H4gpwSxZO6Zbq3UIxv:AZght9Vc39QYkpYKxZDZsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692657339, "uuid": "76382de0-f106-4410-b990-f94d1af33d09", "value": 35792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692657339, "uuid": "af58d46b-b7c9-469d-9790-6d2e0aed4178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692657339, "uuid": "f6e01c67-d822-4a29-b915-040b28278661", "value": "SecuriteInfo.com.Linux.Siggen.9999.152.24258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf90d975-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596246, "uuid": "5f67ef10-7e95-4dc4-92dd-a5bc6f75f9b8", "comment": "Malware payload (Mirai)", "value": "91dc455a666159367255098099fcf553", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596246, "uuid": "9b7129f4-5f51-4754-a05d-60bc54ce3304", "comment": "Malware payload (Mirai)", "value": "7d568758f1abffba9418d894747533df121828e726e5e1524364e0c112a5b915", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596246, "uuid": "1a93aaf1-0b8a-4258-bf1f-654a95c00256", "comment": "Malware payload (Mirai)", "value": "943611bac842fb46cae6061e0bcc72368112a434", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596246, "uuid": "38ca0d1f-eac6-4cb6-8727-967ee643578c", "comment": "Malware payload (Mirai)", "value": "e1bb2353b76f81d17f4b64383d8e01039ddd929a6c64ef199ffe2d062f638606cdbd5a2f5f2f0047a3aa6a8e85be314d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596246, "uuid": "5031f848-0015-4d3c-a9b9-83fdebfa417e", "value": "T108831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596246, "uuid": "1621a0f7-93dc-4fb0-b266-225480a7206e", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8Jye:gJTyHknWt/+L4qjmugd9mrsplDKZUlQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596246, "uuid": "e1c35809-7c38-4167-b793-be1ff18a2a5e", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596246, "uuid": "5a288231-20ea-4028-9321-cbff4c9c44d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596246, "uuid": "74c9c7e1-c896-4045-9913-0f057f2c23ee", "value": "91dc455a666159367255098099fcf553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea2ee6c-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692647408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "03bcdd2c-7597-4c7c-8da0-a37c4c09a4d7", "comment": "Malware payload", "value": "7d4e3526c561985e437247193b805fc6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "0116fca0-8fc4-46f8-b08e-96b481a121b0", "comment": "Malware payload", "value": "7dbb9c53b237a8c42939bcbf3c8293fd0db872eb3adecac8c47ea06b51a1402f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "6f99fe99-7fb7-47a9-9d51-443e307fdb01", "comment": "Malware payload", "value": "fc2df57df3c6b48273eb38fc8bea10c6e2e22b3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "0942cc8f-2c15-4dbf-b258-aa4466848680", "comment": "Malware payload", "value": "e15bbe71e214cded1c2e399b8467a5fc1cf3b80affbd1ca8636479f04c354e1609d499437072e7cf80d2edaab8543194", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "6b701bae-ad60-421f-a377-e4b7a73a8fbb", "value": "T1C5B2CFE16ADD21F0F1E0AD7BF6FC49C9739A16A0C08E7360272806FCEF9649195F5099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "8caeb39a-dae8-4d7b-86b2-457824e65a12", "value": "768:kwwgSUT279k8X3MvHKMdcWvQTE5LlptU+RrH3Uf:hHOWW3MvH3c4BptvRra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647408, "uuid": "517b408b-dbc2-44b2-ae20-40b24a6aa3f7", "value": 24696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647408, "uuid": "1ce0bc85-3ebd-4934-9a33-820b02324b9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "0a7bf803-7115-489c-b454-11481ce06a7e", "value": "c0r0n4x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6aaa85-3fc2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692581720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581720, "uuid": "6b0291c1-02c3-49ab-bfc8-9aa24a29725f", "comment": "Malware payload (DCRat)", "value": "29d5e86bc6efb7fafd461d66a8643605", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581720, "uuid": "ec508224-07ca-473e-a390-e1a505fcde48", "comment": "Malware payload (DCRat)", "value": "814b3f2a4f992d01913f6db12748e0174fec68e2d1d6f1c8482cb7ae188dd37b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581720, "uuid": "81e4e4e0-485f-4ec7-857a-1513d0a50a21", "comment": "Malware payload (DCRat)", "value": "c50cbc0bf460191bdf18f43574f5b975964cc43a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581720, "uuid": "db02048a-442b-4117-bb37-ee45cfe769a1", "comment": "Malware payload (DCRat)", "value": "30860e33e59c175c3bd7978cba78f9c8968d49e1935f15b8ff052aadccee5be6be1ae25144b5d41fee58e7d167433c77", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692581720, "uuid": "bd0d82e1-dd28-48a0-858a-0859a235298d", "value": "T16B658C027E44CA12F40D1633C6FF456847B0A9456AA6E32B7DBA377E55223A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692581720, "uuid": "845e9281-3790-4099-a32b-24bd0859f975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692581720, "uuid": "07bd2f0d-c40b-461b-9830-887b5f4fe13c", "value": "24576:+gCN42HAt53b/6YDhb4oAH39ElD08CURJAGFEgDgXJZ7MBaczTM:+/NrAt5x4TX9ER08FJ1FD2nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692581720, "uuid": "703beef8-88fc-41fd-9773-1b02c397f0e8", "value": 1527296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692581720, "uuid": "ae977fe7-2dcc-43af-b09b-1f0c565610f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692581720, "uuid": "3163e1a8-24a5-4615-bc95-85284cde3cbe", "value": "29d5e86bc6efb7fafd461d66a8643605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8faf10-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647433, "uuid": "b83c1b12-dd48-4805-b807-ff5632bb7c0a", "comment": "Malware payload (Mirai)", "value": "d082ed09f03e06478500d52bdfa2ac59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647433, "uuid": "a5762838-beca-4aac-98b7-b6e4480b3050", "comment": "Malware payload (Mirai)", "value": "82185272d6f3e07c6b2923239b960a51b9aab0b11b84164912f0860637a3f133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647433, "uuid": "590f3f22-ee14-4b2e-ac86-7a407f85eb87", "comment": "Malware payload (Mirai)", "value": "56ea5c495c524652ba5415fe37ccaf034b07bb4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647433, "uuid": "9d1ede70-f23f-4038-a249-c7934ca5cc49", "comment": "Malware payload (Mirai)", "value": "86002baf1f00172229c6e586ba3597daf3897af77f964634552ba758941fa3532b4d5e064623947e50ddf9aff50cb979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647433, "uuid": "b832b9c7-fdd3-4922-bc51-bd0d4e0f30a0", "value": "T16BD2E170A285E59CF6F7A9F288EA5F407F602F444B39C7D6716CF60940A2275501DDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647433, "uuid": "7694c74e-02aa-44c6-8154-0c8f0bc93178", "value": "768:yJT+LSBUz7vyUpm82+skFCYAG+W7fWMicS4uVcqgw0RTWX6:ylwSBUzbyUAasqz+Uf5icS4u+qgw01Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647433, "uuid": "a06950f9-1d0d-47c0-abda-43e381854ff2", "value": 30264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647433, "uuid": "3e232fba-677f-4644-ad67-8dc3ae4716a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647433, "uuid": "7ca29c05-d0a6-4af9-8925-2e25b0029d19", "value": "d082ed09f03e06478500d52bdfa2ac59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a005ee5f-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692627519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627519, "uuid": "09f78c5e-d918-484f-80c9-977ff5bb9e35", "comment": "Malware payload (Mirai)", "value": "37965f1fbb818c021360880d8cd0ce4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627519, "uuid": "b6dd5e95-2579-4671-be5a-f2a63881f1b1", "comment": "Malware payload (Mirai)", "value": "822561d2024fa81f5a9d3701bdbde4bfc3996c958cfd1940ce7e055e89865f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627519, "uuid": "fad34b86-f08d-4cfe-ae4b-d65c72dd789e", "comment": "Malware payload (Mirai)", "value": "1cf50ce8af9770920ee2569d5b488a8ae220c66d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627519, "uuid": "0884e43f-aae8-46f1-b8cf-5e6f3bc1ea2f", "comment": "Malware payload (Mirai)", "value": "43e1448c5d232787987110d33f59f484ccad965c33776693af0843e76213f555d22df1b67d60f47f7240ad8f66f166bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627519, "uuid": "9ca4e9cd-e56e-46ee-beb5-17dfbb53a59d", "value": "T151A2D1BFE496099BDDA5E03B014D14DA44AB5C5413A783C13E6575B38DBB8E8F836680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627519, "uuid": "d2efc3be-78f1-486b-a918-4090276d200e", "value": "384:MtcDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr/hTDu+v1Rpp:8MkKJFH39CBVQey7qsZoMT/pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627519, "uuid": "346e9f49-dd0c-4a2e-867b-754c1109c691", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627519, "uuid": "013dc790-016c-4493-8ce9-2970158d1488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627519, "uuid": "0a07d90d-b9b6-410d-816a-00f5caf053f1", "value": "37965f1fbb818c021360880d8cd0ce4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee935f37-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "9dddd3e2-39d1-49d2-958e-89a21c7d47fb", "comment": "Malware payload (Mirai)", "value": "8a26dbdc9ed03fa79fa1b4097c3c4395", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "f2826c53-e5d2-40a7-bde9-8d278ca0ea9f", "comment": "Malware payload (Mirai)", "value": "8434b0deeadebab2be860881f85aed997a5eaf8fe3440ee7b2c30c0ab9f59c1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "77b71664-5a24-4b4d-b702-47b7a4080f48", "comment": "Malware payload (Mirai)", "value": "f4e0462c9f8277efb634d318e9d48600ba6ab19b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647408, "uuid": "c0f5c1aa-5f0d-4ca7-ae67-023117783ba5", "comment": "Malware payload (Mirai)", "value": "d542a31092832e6dfd51651fee6c1e02e32174620868e2c91a055c9b7c0fcacf92c7d95f05c28f651bbedd515f4671de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "16f5885d-f5ad-4c7e-9b57-3b673c87cba2", "value": "T1C4C2D171D54AB0B3C9F40CF3EDE84A46934907ECDFADB21AB505036CBA65E41A7F5144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "b5d7c800-9592-4a5f-86ec-05541092a9ab", "value": "768:5Jv8B2MLOb/kMKXPljVBX5sKqPTZ43Ucg:bvk2bkJpVBpPqbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647408, "uuid": "c7432c7e-3b56-4361-9de4-0561ef238fd5", "value": 27768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647408, "uuid": "64651c6b-c06a-44e4-bda3-03a52c27bea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647408, "uuid": "b82ded0b-ecb0-4591-b31e-8ec9f0901fec", "value": "devx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d040c4-4048-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692639234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639234, "uuid": "d888fc6b-b888-401a-9919-bc6997f2222a", "comment": "Malware payload (Loki)", "value": "9dc051b26d684d037da57093e9ebcbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639234, "uuid": "7938cf95-9c15-4be5-aeb2-760b0173e5fe", "comment": "Malware payload (Loki)", "value": "845f1c62ee0c2b270a8de69bdb4709e1dd9615d6f1f7dc955607f95efc4a1056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639234, "uuid": "c3db5571-8916-449d-a44e-fd595c62bea2", "comment": "Malware payload (Loki)", "value": "95cb475f546748287b5322ef88db7f5869a879fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639234, "uuid": "4c7ae8cf-a474-4a1c-9426-fa828477da4b", "comment": "Malware payload (Loki)", "value": "19078cd0c8fdadd8cabfb6605a7d6364470f335b8f2eb594da40a476e349b63e832f462f2f8325c38b722c3e25794fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639234, "uuid": "d53f7210-e741-433f-b672-6f400eea95f3", "value": "T16F820708BE5DD033C6AD067E58E6134A52B2EB37B4A3E30F4DCDE66669173C089C19D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639234, "uuid": "7e8ba5f6-1b1b-485b-b20c-09f60a7e0c29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639234, "uuid": "10b9f5a8-cec0-4bdd-af04-f150c8314c00", "value": "384:pxClkRGiki8cWAYKtihn2EfGeO/UOxpk/QawsOwVe:LIF1KtCmetVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692639234, "uuid": "10173623-091e-4db6-9dc0-5dc3efdfa715", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692639234, "uuid": "4e7340e3-bbe2-4b68-b57a-cf538b56d997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639234, "uuid": "0b363fe2-ce2e-4252-b213-c914f7068e43", "value": "SecuriteInfo.com.Win32.DropperX-gen.8729.3836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda24dd1-3ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692602765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602765, "uuid": "5c4ed0d5-faf5-43f6-8937-7f5730eb2b93", "comment": "Malware payload", "value": "3ee9ff85b1902d61aa1c72b730825db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602765, "uuid": "6593b5fd-a5d5-4815-9dbd-db7e42b06534", "comment": "Malware payload", "value": "84f77fcf0877791f1406776a7dfe52c473a391058f97c300668e5f6c5edf6e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602765, "uuid": "aadf9bfd-005b-40c4-bdcb-2a61569ac03a", "comment": "Malware payload", "value": "df66240c5966dae72e37a5b1a92bde4e6c54e2c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602765, "uuid": "7f35b8cd-50b4-4eb4-831a-66fbae1d0537", "comment": "Malware payload", "value": "0f31770a9eed36cf8cd95e6d6a180323174f434d8c6a550fcf6f7aea227618ea18dea1d4433c2cdaf20729effc1d58d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602765, "uuid": "410db07f-df1c-4e48-9df7-99c910d7b9ed", "value": "T10C347E63A193DDA6C585493D4674F7AC422CCF620E5BA28A61793222FE73D072F0CDD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602765, "uuid": "cf3c1066-0dc0-4992-b373-e1a70bd6e811", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602765, "uuid": "caa74cc1-5483-4f94-9353-571b66deb5cc", "value": "6144:3YaibmJxRHHE6mRsc9gC8NLhPtDqeqbufJomGK03ReLTOqU:3Y9mJxRHHE6mRsc9gC8NLhPtD/fJomIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602765, "uuid": "135f95b8-ba32-421b-8c9d-30661cd9f9d3", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602765, "uuid": "49a58c80-b6a4-466f-85bb-98d9ccc1b283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602765, "uuid": "bd26aacf-2fa2-4553-81db-9451dc41e452", "value": "84f77fcf0877791f1406776a7dfe52c473a391058f97c300668e5f6c5edf6e1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38e1225-3ffb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692606185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606185, "uuid": "88078ad0-61a2-4418-bde2-d5e947fe9747", "comment": "Malware payload (AgentTesla)", "value": "9a94f61d3ab25d2df935390bccc28ab9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606185, "uuid": "c4cf3149-7b5b-4d6f-a0e7-790856eb2497", "comment": "Malware payload (AgentTesla)", "value": "851bf60fa8b5f3adbdcbfb8d3b87bf0220af6c94c681fdc57bb58def8587d6d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606185, "uuid": "fdbb4899-4332-4751-85e7-a75c0e016576", "comment": "Malware payload (AgentTesla)", "value": "33b9b70981409400bb0c59cefcdf52ccdf8ed94b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606185, "uuid": "b8ec2d88-655a-488a-997f-7fcc6aa0f0fc", "comment": "Malware payload (AgentTesla)", "value": "0306a91f7442f69140e909e82e1c11aff3294988a74e427e31a0de83d36bd2c290b141bfbc015f5af55d4d679db19795", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606185, "uuid": "c4ae479f-696a-4a38-8364-348372aa7438", "value": "T1CF95AFB876047DD62A6F176BDA96ACDC13B6276399CBA4CC80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606185, "uuid": "9bc05caf-7581-4291-a8cf-c170dc6599a9", "value": "24576:bSK06Wyv2+nzyGgpbHIftFXMES948KIMfK9z2d3ol8ExKY/YWqws6R85lmn3dZG+:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692606185, "uuid": "3b4bd88b-54b7-4bc2-a4c3-0a34a1dc9d69", "value": 1886764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692606185, "uuid": "10a18c55-47aa-4ba0-b89c-045dcb59ea80", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606185, "uuid": "d625f342-e732-432c-89ba-8a5bd8faf765", "value": "INVACO-RFQ3300019988.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1d7882-3ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602768, "uuid": "b479d038-bebd-4319-8480-0dae5419b569", "comment": "Malware payload (AgentTesla)", "value": "2d4ac81e278952d7492f9edfd1d79038", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602768, "uuid": "a936d273-d108-4e68-a7c1-7f1505fb3602", "comment": "Malware payload (AgentTesla)", "value": "8542efe5fa194446c815fb12416a8abbae52612574c1b3bb1f29adbb17676c0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602768, "uuid": "35f4741c-b9c9-43b9-9342-aa00cb69728d", "comment": "Malware payload (AgentTesla)", "value": "b28d323999a1aeb0b3b56e0b77fb0786e06105ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602768, "uuid": "97bc043a-55b8-4049-bcd6-b625b5d44fcd", "comment": "Malware payload (AgentTesla)", "value": "098ef3973a9b56100e0e960aa1e43e0b2577dbef25542b61ddb07370d235a2e7af5570734bfa797360647773eeeb2216", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602768, "uuid": "981fe9c6-c770-4a14-8898-10c75476f3f6", "value": "T1F1C2F6A63B1CE110C5718A3AC85391F20331AE67E693C61FB49A3F053773397DA167A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602768, "uuid": "f37c5afe-717e-4348-8cd9-8cc478f755a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602768, "uuid": "eb97b00c-07ac-4905-9034-0f804dc4d2ae", "value": "384:t3tooc5A5076PlwWevcFdubbkXqYo7eTJfY5SxFv5JQzKoX99RF+6:5R0769PevcFWkXV/TRTJQzKy99RE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602768, "uuid": "6cc7ce5c-2e1f-4742-ae94-51d229744dd1", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602768, "uuid": "ea42010e-8649-4cfa-8e36-24e89a002499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602768, "uuid": "df7384f8-2613-48b1-be14-0588b1276c84", "value": "AugustOrder21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cd0b85-3feb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692599281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599281, "uuid": "c04d8c3f-e824-4090-95bc-6fab4d0a569a", "comment": "Malware payload", "value": "1de7b93242778b37f0474d12726143e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599281, "uuid": "8d36b0ac-2ba6-4ede-9f73-fa17da3be2fc", "comment": "Malware payload", "value": "85cb1606cb7f1c064a0a75d53100dcae45183654a3600ac64a97f5e8d22583e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599281, "uuid": "3e12f287-65d2-4c98-b24d-a451a516d3fd", "comment": "Malware payload", "value": "68806bed1b1f3c20dfdb3e13f31cf97aad7ef26b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692599281, "uuid": "600df079-1320-4dc2-9aeb-d2ea92376551", "comment": "Malware payload", "value": "bd71de7f50f86c7d9777e8efc32e5e3ed8e07ded7eb6219bd4fbde4394a566ec96407346361cc5e0c9a9f4926aa24403", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599281, "uuid": "add6161b-5243-47bb-b3bd-d6fac508df4d", "value": "T191236C007652C0B3E69B163469B9CA510B7F7C936AF0A04B7FED070D9EB16C076297A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599281, "uuid": "427aa831-e07c-41ca-8b39-85053b0818c1", "value": "07ed6970d80772ff905788fa3e1463f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599281, "uuid": "3d9501ca-7285-4820-bdc0-279b2288ee6a", "value": "768:/hTxc0Je3ufiM9T6pf+zU4bY50EcQISWYNKGIPsQyddjWbb4BTxcw:/hTxTyIkf3ISjIPQfJBTxcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692599281, "uuid": "3ded2f07-9e1f-4437-bc88-6aee595fa188", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692599281, "uuid": "60ee92b8-0356-4b7e-b277-1e6ed60512be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692599281, "uuid": "1b044388-7086-49e5-afce-febfda6b7973", "value": "SecuriteInfo.com.Win32.PWSX-gen.30852.14630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e73dd46-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692602794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602794, "uuid": "12a5c1fd-bd23-44c6-835e-0aa88f3efa98", "comment": "Malware payload (Formbook)", "value": "1f788b0b1a81a2fc1dca82ac73f743fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602794, "uuid": "77754263-ce64-4000-ab81-7b1a6dabcc79", "comment": "Malware payload (Formbook)", "value": "860bda507891cdc32d478e52513a19e20f50bb104275c46fd1ce797d83acf908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602794, "uuid": "363254d4-ecea-43c3-a40b-f2d5d038ca87", "comment": "Malware payload (Formbook)", "value": "42a69d3ad4c00a48caf35d0128a0a233599f254f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602794, "uuid": "a6cbb140-7ac9-4317-9240-b422d7e22e96", "comment": "Malware payload (Formbook)", "value": "c8db139107ab0f03552d0cfd09b4ec5e671e723f6dc130daa5609a28ae62741512df7f8346bb9bf46f15761aedc7d5f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602794, "uuid": "8a28a1c9-3243-4fa0-9918-442e2d616c4b", "value": "T118F4D0A672FC46ABE06A80B652243103EF73A1B75166E5C5BCCE22E55FC6F811607F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602794, "uuid": "b025a423-a90f-4fc9-a287-4131a509bf04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602794, "uuid": "dd3456ff-9282-4e2b-a36c-5911c83d6c4d", "value": "12288:oZnDxtz91GdtGGEyT6JHellNeGCb9YDOb5SgsE91tpmrRaukYvtas7:o3tJsr/6J+DwRyO5SgF9TpmtaPYvtas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602794, "uuid": "0b06072f-515d-41f5-9695-ed638e6cf7de", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602794, "uuid": "4db90598-da24-46a4-9eff-6a4d38e52053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602794, "uuid": "cbcd1729-f2e4-437e-a840-31d52141be0c", "value": "SWIFT DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44e44bc-4017-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692618185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618185, "uuid": "fa39b01d-106d-43d1-9931-47bdcef61c1c", "comment": "Malware payload (GuLoader)", "value": "796a089c0f96b3c84f4673d50c0244f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618185, "uuid": "54a192ef-459a-4fdf-87ac-5ab6d578bc38", "comment": "Malware payload (GuLoader)", "value": "86265ce39126654f67a5c88d4fdef51bf504f2b72322b12bc73e1c00871305e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618185, "uuid": "9819b437-f4f7-4093-b6d6-804286c92be3", "comment": "Malware payload (GuLoader)", "value": "0d364744682ce1af05633b93f63e6e68144b8e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618185, "uuid": "37476196-46b9-4154-9b45-5990865ef2b2", "comment": "Malware payload (GuLoader)", "value": "a1456926368440658a6fd41e1edef993570e86f552ec4acb910cb394592113355844802ac78cf88267fdc46fd8508150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618185, "uuid": "3ec8143f-7278-425b-8edd-35cf3d4c19cb", "value": "T1E46412518651C18BC5B3A7B113F59A73EFB3D92420F60B430F90ADD97C6A3C5BA0D5A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618185, "uuid": "fe74c9ac-105f-4552-b35f-f20b36124d8d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618185, "uuid": "2d482806-9c37-4c56-88a4-96614f7fb821", "value": "6144:UQ606xi78U28gnnr3e9HUhkPJh68BcWowDkkh5/mV5BI/z+SWnexSHDWUviCd2Es:v7858gr3S0hkPJh68BswDkkhtmVcceAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692618185, "uuid": "1d5336e2-cb17-485c-aa12-55d7ef7d04b3", "value": 320904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692618185, "uuid": "7cc5c106-fd6b-4fbe-bf21-08f7ec4fb469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618185, "uuid": "1c034520-a035-48ea-8621-db353809f4d0", "value": "RFQ20230821_Commercial list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c5d363-3fc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692582321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582321, "uuid": "56667faa-2c5a-4605-a35d-43c26e297f6d", "comment": "Malware payload (RedLineStealer)", "value": "3036bc14ecf07dc6a55729919a07db3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582321, "uuid": "469e1deb-6937-4f62-bcf6-bf8bf5937b3f", "comment": "Malware payload (RedLineStealer)", "value": "890d69db366a4245cdb2a30c30f29726917914a79dcdfdc6e9c3f29545b1a990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582321, "uuid": "b5af8ee2-1023-451a-812c-bd41777fb187", "comment": "Malware payload (RedLineStealer)", "value": "10c6efd2ba87f4d79657f49324eab0c6c3a9253f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692582321, "uuid": "fa417dc5-c222-474c-a501-267169ceee0f", "comment": "Malware payload (RedLineStealer)", "value": "ac8d86affed93f38f94b0d6c6696a315152fb6fc7a612e3064178ae259095258c000e5816399f295a21427a053132afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582321, "uuid": "60b55229-b4b5-4e62-9503-c4ccf1bf9e98", "value": "T15F556C0EB2E5EF0BC3EA1A35C43A14718B77E60D1A73E30E2A3B15673C55A942B576C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582321, "uuid": "3df3900e-4b04-4a6b-ae81-48424709755e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582321, "uuid": "67aab698-1789-4815-b13b-c3a670207d63", "value": "24576:RV1kqTdYiI9uYh3SIwM5gjl2IJX8c6GaCrM6Ou+B5OAev7XX5Ae:qiwrSIwM5clQc6nCY6jKOHDXX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692582321, "uuid": "2d7333bf-8181-4da1-b87b-124aed8c45da", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692582321, "uuid": "511b8484-00f2-495d-8cb9-6af3c6627a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692582321, "uuid": "f9995acf-aea6-459a-b5c3-0a75836906f6", "value": "3036bc14ecf07dc6a55729919a07db3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21bbde7-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596250, "uuid": "142c12bf-fd63-4cb6-9c8a-70cc895af283", "comment": "Malware payload (Mirai)", "value": "53ecf257b6abc02092c58e97db318ea8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596250, "uuid": "61acd4b1-5857-4859-9395-f02feff67760", "comment": "Malware payload (Mirai)", "value": "8ab5e29aa59496485c04fd77f04895c3ba12a22ed368729bf492054a479f9206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596250, "uuid": "45022b95-e550-4b3a-baa7-187c7a5b0551", "comment": "Malware payload (Mirai)", "value": "22319ffbc363254f228f25b39f770256c1ad78be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596250, "uuid": "37ae08b8-0356-46b4-876a-37218bb8c1cd", "comment": "Malware payload (Mirai)", "value": "cb2baf76b994adb6232c442a409e2f50d5dcee2b1848ed249d66d320d5b5b7925670133b755b377e2a2c4bc9ebddc86b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596250, "uuid": "79e30fbb-9e31-4a42-acf1-a1fa6cad0893", "value": "T19093734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596250, "uuid": "6215d00e-9557-459e-ae4d-5da40ef46a4c", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiO93J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596250, "uuid": "9008a7a1-ff71-4385-8f77-6cb6b819dc81", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596250, "uuid": "2173e4f5-a85a-4eb8-bf96-98a8536e9ed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596250, "uuid": "2efd7cf5-095f-4fbd-8231-2a254f57de87", "value": "53ecf257b6abc02092c58e97db318ea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9070abd6-3ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692605159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605159, "uuid": "6e721652-8860-400d-bbe3-a1ca932936a9", "comment": "Malware payload", "value": "0185e0fc2f505312001e1a65e6783908", "object_relation": "md5", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605159, "uuid": "07f949d0-2cc8-4558-bca4-e8e38ca9ad46", "comment": "Malware payload", "value": "8b3162141ac545fa0ae63777748973b8ee88bb8234a917d5fb3238d2c2ca963d", "object_relation": "sha256", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605159, "uuid": "a3dd2a62-462e-4b03-a0af-950172c2c1f5", "comment": "Malware payload", "value": "8e4cf0397ba32d233a515a5aca02751f6f9344c6", "object_relation": "sha1", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605159, "uuid": "ec82bb0e-d46c-4310-a7e2-e7333a42f734", "comment": "Malware payload", "value": "be3e166f077f380644784c32a137ffebf5c13aad524f35435867c06a947a1488454fe9f1cd3173ce5d6cca1e2dc5db59", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605159, "uuid": "6df97dff-86d8-40ac-a978-99ff99bbc759", "value": "T1FB21AA3C25E95616C7E0053F4079631B8E3BB4D7E5B1DE2D02A092893906A01EC59F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605159, "uuid": "b6579f72-8e6e-43f9-aec0-db96b9191164", "value": "24:80N8NiJ/AESU9BJBq+/bnpqGUkzab/OD41ULw7mN:80N8NkjSOJpqGUGabOMiLCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605159, "uuid": "312655af-472c-4514-9355-754524970001", "value": 1282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605159, "uuid": "659a61d8-65a9-4bd5-a46e-b2b40fc63fb3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605159, "uuid": "ef7eee35-779d-476c-8d3b-750bdf68d431", "value": "book.pdf lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c62b24-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596226, "uuid": "5615b5cd-8bc3-4ecb-8c35-af5d7d296f18", "comment": "Malware payload (Mirai)", "value": "ffab0574794fd41e22c35dda6d89bf78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596226, "uuid": "caeff12d-199e-4b39-85bb-ff4fcde60fa4", "comment": "Malware payload (Mirai)", "value": "8c6799b3e5b4283bb11ebd474ee7dd3e1ac9638481d1e5c83f92cdac6ce967e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596226, "uuid": "d49427fd-a77d-4468-b159-e3fc4a16cc1f", "comment": "Malware payload (Mirai)", "value": "133792264df1eb0f6479f6790a7ac71f85d6b5e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596226, "uuid": "5898ab15-422e-414c-8056-68ca38c1c33a", "comment": "Malware payload (Mirai)", "value": "de8851020a2e62e93183bb084c94fbb7fd85673f2a574c816ce8a2db39e116d60aa67f3949103b556bfb70297999187e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596226, "uuid": "b260ed59-93a9-4181-ae58-a0901ae953e0", "value": "T176B2D0949B919606C170B475A27C8F935A3B15F4C6F23926272053FC9A8259633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596226, "uuid": "14c521b2-d32d-4d0e-9fcf-444662bb452a", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BiySMhymdGUop5hu74:4GHKQFH0rs3zWoDDRsjt7LB9U+Biyzsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596226, "uuid": "da3e3b59-17c3-4845-94f8-a9a5aba8725b", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596226, "uuid": "16e03d73-d433-40fd-aa74-5d7fde55d4d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596226, "uuid": "59b65143-8ce0-4489-a394-705022298528", "value": "ffab0574794fd41e22c35dda6d89bf78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4005ded-3ffc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692606588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606588, "uuid": "bae789e9-7ea9-49aa-ba0d-9bd841d628b1", "comment": "Malware payload (RedLineStealer)", "value": "8ca9ad596044d75d5e6fddd498c96ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606588, "uuid": "4d3edcfa-aaf1-4c6d-b430-6bacb7b5ab5c", "comment": "Malware payload (RedLineStealer)", "value": "8fa01247b623630a85d321f3c0a883d2a9d42feb5a0be42f2055487c0095fbfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606588, "uuid": "483f6c2d-3fc6-414a-a6e1-bb8dc7caec5c", "comment": "Malware payload (RedLineStealer)", "value": "402a401227f5847ba81f66cbe09adfec96b73f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692606588, "uuid": "ac1b9f39-5b2a-4d0c-b046-24d6a0887d8e", "comment": "Malware payload (RedLineStealer)", "value": "2465d46d9c462db661e1e3efbc6be5cd7875a78b7c9a0e93baf27b927c0982843080555a835eb3bb4d512d25c311240c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606588, "uuid": "818179a9-fb44-4b86-8cc2-3e2c6af9c52b", "value": "T1F1355B207B9D9535EDE2207A46ECB823C15CBCB0072646FB5DC406EECA506E17AF1AF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606588, "uuid": "3905aedf-759f-4cef-b680-f893e524bdcb", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606588, "uuid": "7cdf9707-fe86-4eae-9988-0143fe1bbf0a", "value": "24576:Rkd1/jg7PvqovaBlM+EIPeEXjTafIwpz:RkM7PvqoEM4pTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692606588, "uuid": "ddc2ecdd-c4f0-4aab-b127-44705489c496", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692606588, "uuid": "d226da44-4164-4afe-9bb7-a295b4c8f436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692606588, "uuid": "0e8aff31-acf9-448c-8856-7a3d532c8d58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b501259-4051-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692642893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642893, "uuid": "eae607b2-c16c-408f-83b7-747fb7dfea58", "comment": "Malware payload", "value": "ce1e8538199949c9d24aaacd6c9df788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642893, "uuid": "990c739b-e280-4f67-80c8-6e7513b90242", "comment": "Malware payload", "value": "912198abd1c9154bb2ba684b1664d2d1a84566350318259c7131331d4f02c28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642893, "uuid": "0ecc9263-6248-40ca-a16a-59d75aae5461", "comment": "Malware payload", "value": "4042a61e8bda4e2cc1a8e2d1a3a3ede3fcff3dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642893, "uuid": "a0fa6c99-c692-45ac-af48-82c5836d3486", "comment": "Malware payload", "value": "9d42ba14f5647762ff1e95ace0334f00fc4e89f17f2c3f9ef675459be4dbbd9974b74c03e444357fc638e4762ac2a8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642893, "uuid": "5d5c3a00-c168-41b5-8836-b1bb0da5acc7", "value": "T14EC4121E1767EF6AC27EC77C942A185107F8E299A325E79FBFC1A0C46D62F40C260E51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642893, "uuid": "99a87496-fbc8-4d88-8aaf-ad00d521b24a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642893, "uuid": "aa931ab4-0974-4a16-99e7-68ec2418d88f", "value": "12288:2jkFkYjt5Iv5cqE7TnzgKg/X0RJQQmhR8MrggswB+70pKXQl2FN:xxtQ27O/mOsgggb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692642893, "uuid": "9a3e46a7-e967-4694-8b59-adbdcdd2505a", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692642893, "uuid": "1629d662-30d4-459e-bdd0-b72d9f8b4f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642893, "uuid": "00413a7e-2e0b-4aff-887d-98f0582edded", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.11916.31052.13487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3b2cc3-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692629925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629925, "uuid": "41f9152c-1c78-4da5-a4e2-e9f3915f78bb", "comment": "Malware payload (LummaStealer)", "value": "ebac06e859dd555bbb5012fcdb9c6528", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629925, "uuid": "3f5c74e9-02ec-4ca6-894b-02e81fb2ff9d", "comment": "Malware payload (LummaStealer)", "value": "93015b567e5ba8266205fb1183a6a26a3b950b67fd1366639ae232206d972f77", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629925, "uuid": "256f199c-2277-48f9-b4f8-05cc057f8433", "comment": "Malware payload (LummaStealer)", "value": "282dd3d008f4b4272111c31d0089b595d3e5b7bb", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629925, "uuid": "66eb1ce6-466b-4ac1-a4be-605969f24113", "comment": "Malware payload (LummaStealer)", "value": "8367aa0f26c803dfc963c588e1708b1ec8eb082ad7feaaff8c96b215f195b68d92711cd3411eb9caaf949a25543c7cb1", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629925, "uuid": "babfa455-e285-493e-880f-7d4320189140", "value": "T199B501C2F971D7E3C42147B4655681280F363FD43869D28A2DA972E97AF0B043B9763E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629925, "uuid": "75e630b0-b01f-43d4-b68e-4f17a675cd09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629925, "uuid": "e8df1413-4ffb-47b0-97f3-2d82832e80f7", "value": "49152:6bz4lUZQ15onuIXhw/nrRNZL2d+Cs3AEQnEmodF7jyklBk6A:6bO5IuLR/CCQgmobjykv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629925, "uuid": "69e81923-4017-4f2d-9135-23a0e679eeb5", "value": 2483712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629925, "uuid": "a98ad93e-b581-4c75-8b02-f410eea9e8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629925, "uuid": "1aaa0e70-726c-4c8a-a1cf-59489572bdd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58004f3-4026-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1692624576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624576, "uuid": "b8daee63-333b-4024-b52d-d2d55afa11d8", "comment": "Malware payload (DarkCloud)", "value": "a6d3fecb6abbc38b19fda4959c715448", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624576, "uuid": "3adc0868-a444-4372-b4fa-022b0e76f60c", "comment": "Malware payload (DarkCloud)", "value": "9471ebf81af353bf00c68de327f04e3c68d90e69296a102873f5b570fc00ff6f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624576, "uuid": "e14500c9-1f05-4d18-92b5-ef620a706ea4", "comment": "Malware payload (DarkCloud)", "value": "d8fdbd8ab6a9e015f87390dfc52e2caa39ab63e3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624576, "uuid": "732cc6ea-2d13-403a-8b04-f261c1785b90", "comment": "Malware payload (DarkCloud)", "value": "39ddd50a58392a7b17c8b32e1da1cb36c56f2101967e12d3bb4c6b1a57851f4ce8bfd6ead335e1e6fcdf7a22395a78f9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624576, "uuid": "91ee3977-7d55-4142-bfd3-0f3b230c4b40", "value": "T13F354B3CF616DB2BD0CC8CF984A5192FB9F99CADD4F1B365C133C2A85BF981045A6462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624576, "uuid": "aee858c4-1bb8-4b4d-8999-085b6a92ed03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624576, "uuid": "c893a590-fb8e-473c-b01e-5bf4db3670e9", "value": "24576:n66ewe6afA2Tro75JdSmqhagvUm7KYjIjg:pafA2n05JdBqha6UmuY8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692624576, "uuid": "5be5995e-3c16-4d46-83c6-a51f38cf3373", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692624576, "uuid": "02b59bba-56e6-436d-aca4-210acd806c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624576, "uuid": "3fbdf0d8-63ad-44dd-809c-406244c6c80a", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a502db3-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602787, "uuid": "f52e0f2f-c855-4b9a-8c63-04081a91f5a2", "comment": "Malware payload (AgentTesla)", "value": "fd08f866413b85d533d0e2dbbcef7b2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602787, "uuid": "4a97a3b2-1af9-4869-b97e-4c019a9193e5", "comment": "Malware payload (AgentTesla)", "value": "9480cad3ede50dd7e5b7c1b957be45ee10c9bef77cc96750febaacf29cbe0f19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602787, "uuid": "948f7291-6606-4d77-9210-24dd78c6ee6b", "comment": "Malware payload (AgentTesla)", "value": "e380b20ae3b7790056b2811d694421aace5e9fa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602787, "uuid": "31fc4e97-fbab-447d-8e5f-b4e1c472e33d", "comment": "Malware payload (AgentTesla)", "value": "36c00094272c68c50fde9c1c604860ebff20e0df1e66bdabb4150bc5dd776c07467a972f597a675e9ef60031d66c5210", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602787, "uuid": "1f8f2bda-5c5c-4e5c-9513-fcffc1cda97c", "value": "T116257C88D0C22C64DDADBF70D136CA32603D7CE96A36562CA4DDBD573ABF9C61021C99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602787, "uuid": "d2b14247-8cd4-4f51-a2c3-2803dd9fce7a", "value": "24576:WCWiIbSjFWeVSuuuuuuluGuuS6uuLvLoHntuq5LoXdmxi1qA:YkXSuuuuuuluGuuS6uurw5LLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602787, "uuid": "ca0653fc-9aca-4648-af5d-1d22dce015e9", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602787, "uuid": "9e22c66f-d5be-4ef6-b4b6-c1d709b7f589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602787, "uuid": "85928fd3-bde7-4ab9-b22a-67f1c3279dbe", "value": "PO_Santana.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec757d8a-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692647404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "15f54569-aa1f-49c4-81c2-80d69fe93ce8", "comment": "Malware payload", "value": "724cba07e6addeb51676e6aefe902f7e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "3229f2bc-e66c-42cc-9ae6-43633fe8a021", "comment": "Malware payload", "value": "957cbbe19aa7613ae49ee9c4e0cf53abc2284f6b6e6f982fb55f81eed9520c4c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "830eae20-2c6b-43ae-b6b9-1899bba46e8e", "comment": "Malware payload", "value": "4646c574a32635939bd3370dfa3ed35a84a99a83", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "4891a689-cbee-4ed4-ab23-9136201311c2", "comment": "Malware payload", "value": "d1d0a642b60cc09af3e244f01e8463afc04cc8fe474146906c66a8e09f75cac17e335e1dd500c819fdbde5afafbb8a0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "a400b337-2962-4a08-9505-ee783985436f", "value": "T19AE2D04EC4606AC4C9EE0C3BC26F53E16D15FACF32156B8877249C56671A68BBE4943C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "cf7dfab3-a1bc-4e13-aab4-fb4bb98bc937", "value": "768:hvkaWery92gSc8OIzVLhdSi8kapkBdCts3PqYkYZx/8OWMA:hvkatyorcQVLhdSI8yJftER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647404, "uuid": "ba27e07c-c5bc-4286-bf87-eec193e07e61", "value": 34076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647404, "uuid": "ac01d11b-4e13-46a5-bdec-01d3db8a937d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "d9db3456-34c3-4d51-a463-b286dce19635", "value": "devx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaec6b62-3fc1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692581259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581259, "uuid": "fe22e312-d07b-412b-b92f-1c812c36773b", "comment": "Malware payload", "value": "9c9b2e6a9ae9f5a8d0e91574845c9a1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581259, "uuid": "51af2cfe-8c66-4824-a210-03fb85e921c7", "comment": "Malware payload", "value": "95a89ef24d1c0a3fb0b783a3b4d8bf352d833e58e53898174dfd07c1ab1e46da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581259, "uuid": "0ecdeacc-2966-49be-a426-e569e7417ca5", "comment": "Malware payload", "value": "f91854e182c2cd3955d28f55b2365304497c5695", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692581259, "uuid": "cd4351ac-8d06-44e1-844d-db1cfa73cdd7", "comment": "Malware payload", "value": "878525c33daf406c76aac33326f6ee79a537f0594872507d8c397d5adb1300901136fe450dbef20e85d3e438cdbb4126", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692581259, "uuid": "8cc499dd-2bab-49fb-b87b-50902493eed4", "value": "T184A2D13501CCBD96C9508970FAE5C20827520AB5F26FB06937814F7ADFA12D9E7315AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692581259, "uuid": "d302aca7-a42f-4445-8dc7-e79304a10a79", "value": "384:tWdWyZ1lp0E/Z6uy1AEZZBTCU9HT5SExCDtEFL88lKOsl00EtIehymdGUopl:tWdWCp0E/oZ1zZBT31TYsCcL8zXZResF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692581259, "uuid": "809c66db-5f4b-4086-a0aa-777eb0bc5be1", "value": 23288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692581259, "uuid": "0927c2fa-5835-49c4-ad95-6b2217d5fd57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692581259, "uuid": "ca5a8e46-116e-4b03-ac65-60079b4e957b", "value": "SecuriteInfo.com.Linux.Siggen.9999.22728.44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb284091-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692610385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610385, "uuid": "02d14dcf-8889-4b50-a47f-ed0ad1d0d6ee", "comment": "Malware payload (AgentTesla)", "value": "8a85ff177bf68f376936e23909361d15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610385, "uuid": "9b769db5-fcda-4335-8eaa-14fe61bead9d", "comment": "Malware payload (AgentTesla)", "value": "95b6d7f8ddb6eec2fbc9588fd85b1248da7f1429a6a266d95df5493bab5e7eb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610385, "uuid": "1565a0af-3675-48e4-8004-7af225e7cbbf", "comment": "Malware payload (AgentTesla)", "value": "5d0227f79af19e3f5bf7dc110275b3681e3cf056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610385, "uuid": "b29a3d74-f19a-4055-ac95-d35709df580e", "comment": "Malware payload (AgentTesla)", "value": "1958b75e0804e1dbe54ce19561326077f962e87a88106304da71cacff8c4d07b3450a7a4ef8ab99265cc265c8b00b7c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610385, "uuid": "cc3b07a1-cc64-431d-8da2-7d8c6abddba8", "value": "T1BDE4235895C980EDC255201238244EED3337AE2DE605664BBE04F7EB5FFB7E21E61983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610385, "uuid": "8635fd7d-2181-431b-b7c7-fd25fdd7a3b2", "value": "12288:ri4nWRcKYjsZtD1sFytKYycd6gOqLblhHgUFQy2UGAdLWSx28ZZa7DuW4OIfTX:+4bsZtYc7y7gRh6UG+LWg2K87y1OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610385, "uuid": "d971f04f-1500-491b-9c82-ede857923026", "value": 680032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610385, "uuid": "6f5d1cab-8af3-4f44-b51a-ac3ac28118fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610385, "uuid": "e0502605-626d-4a0a-b4cd-e86b637e8873", "value": "PI. 2100002 (BT-INC).xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fc7327-4038-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692632361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632361, "uuid": "4776d803-8a60-44db-a27e-b9cf6555ab0f", "comment": "Malware payload (RedLineStealer)", "value": "b9354b705b43d6df721ad99268a5481e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632361, "uuid": "33351a67-5d53-4387-b75c-942f78f0d7ca", "comment": "Malware payload (RedLineStealer)", "value": "96dd07bd64cbe4630378e1fedf380db4acce8e0fad4a3f650126fda5e4b8fe2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632361, "uuid": "1dc72d65-6d9f-4a6b-bdd7-6e123c9246c2", "comment": "Malware payload (RedLineStealer)", "value": "4e241c11bdd1d492c59c8c600bcfa99b01274ad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692632361, "uuid": "ba342027-30f1-42a6-92dc-59f5317fcc23", "comment": "Malware payload (RedLineStealer)", "value": "9c0039209587e1031d0698c67d962c05735d5f12b83c41895dd070d31e7df4f1e598628fb971e04b655fb6152401f807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632361, "uuid": "fb23ec41-344a-49f8-ad29-52cd7e655925", "value": "T19E3549137F8C976ADEA210B64EBCB928861CE4BC13D645DB55E703FECE145E32A31246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632361, "uuid": "fac19e16-2512-4e4f-b149-a9a9c0c95494", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632361, "uuid": "6159c779-b379-4d0f-b203-3947ba5c4dd0", "value": "12288:wk7VqU/1/jovUc7PvqoPXaS3Kt/VCzpG5XM+mJI/3eD5+1uYdHp3jX6d9GNnwpzF:wkd1/jg7PvqovaJlM+EIPeEXUCwpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692632361, "uuid": "9ab82f4c-9f89-4064-ae4e-adb9d8f6071a", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692632361, "uuid": "7409d288-9247-4c01-8deb-a5d154dfe588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692632361, "uuid": "0279f330-5475-466e-912b-5a43ec02a80b", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.19072.26198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ca8bb4-403f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1692635020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635020, "uuid": "4010d309-ea45-4778-81a2-cc331f7147f5", "comment": "Malware payload (CoinMiner)", "value": "ed1da88dca5699f9e01a7e4fa08be78c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635020, "uuid": "7f05d082-2656-46c4-9515-ec1b170f6785", "comment": "Malware payload (CoinMiner)", "value": "9773bcd1383410649884abe2985277f4d51e839f6f49446d13ab67e0bd18f413", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635020, "uuid": "d18d72ae-1973-4684-9b19-3a515f33e35e", "comment": "Malware payload (CoinMiner)", "value": "1cc67cbe8cf95217bd7f22a1e30702bf9d45e806", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635020, "uuid": "180735c5-72e9-4d6e-9899-c46caf0688af", "comment": "Malware payload (CoinMiner)", "value": "c3194fca543bab492e89f9e2ac47c336d1dbc2db92de8e5fe09c4a63212c83bac94fa283602a9e9056d232de37c061c0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635020, "uuid": "1d2d35ff-43f5-4ef9-b0c5-a84aec7c9431", "value": "T1B9B6C057F5262E81B852E36F975B27230D392DBCE4629CCCF0C03D5E1B9B3326AA1558", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635020, "uuid": "88399af6-df4e-4f71-8155-f7f648ff38c1", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635020, "uuid": "02034404-67fd-49cf-b656-5123c4d3df6a", "value": "98304:S0BBtfCIB45NkGHBYL8ue/G0w+13bqUbY78fxLjm0lVITfd58awFhYkORmpHVh5p:SQqIBkNduyBK8fvhV+p6e768ER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692635020, "uuid": "4a14d168-f826-44f2-8592-3122b70a9c32", "value": 10424320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692635020, "uuid": "9cd54594-a96a-4aa1-9871-0266df26e5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635020, "uuid": "e86e8f7c-1661-45bd-b2b8-e93417c02d01", "value": "MS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ca26a2-402b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692626405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "63a80563-1e04-4c94-9870-0736292488d5", "comment": "Malware payload (Mirai)", "value": "ab7c40dcaa6063e49a501cac954410db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "97c3bb39-cc4c-45c9-863d-9a577e86c193", "comment": "Malware payload (Mirai)", "value": "99347f7b63d3f2c28a522b14ee04d588aa032b2787256f64c4c6442987142c04", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "482c1497-322f-412f-8810-756af6fa4856", "comment": "Malware payload (Mirai)", "value": "884a10a89338f572809ec66ca6ea12ca45988408", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "6613b368-03a5-4071-9037-b1595ec64065", "comment": "Malware payload (Mirai)", "value": "6296ed0c17ea912288e01341249add38dab34bb6014e201568a55f415c55f51d50a4aea9c5e02e90d39e8a1be7592327", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "a5ca4a02-b94a-489d-8e51-052abc2caf98", "value": "T1F882D03051AB34E5DBF14431FAEDCEC697560BF8D1FC36922748AB78894210651F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "d407705b-e750-47d1-abe1-cbd31d87f60f", "value": "384:MjUzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaBXhymdGUop5h5l6:6wV0P6+kom0tVAoNvm+to1Rs3Uoznl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692626405, "uuid": "aaa85498-cf07-4b9e-89a3-76f8fb4f0961", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692626405, "uuid": "54752f2d-8242-4acf-bf2c-9d5e8bc9b460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "5fd479dd-c549-4f1a-af4e-edcb6f87c662", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd55f6bb-4076-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692659029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692659029, "uuid": "83eb35cd-1cdf-45c8-bb4f-aec6e319752c", "comment": "Malware payload", "value": "b2d5a1369b5b88c18e5123b948683ba8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692659029, "uuid": "f01db348-3bf4-4044-9604-ad08c7421336", "comment": "Malware payload", "value": "9a7db0204847d26515ed249f9ed577220326f63a724a2e0fb6bb1d8cd33508a3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692659029, "uuid": "01689896-ba6d-4906-bab8-e5b6a84db487", "comment": "Malware payload", "value": "7f537f5045e5e4b77ccb8dcfbd04555b85b11821", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692659029, "uuid": "d3dd1ec1-3a00-42ca-8db6-373ba3594f68", "comment": "Malware payload", "value": "00c3aad50611117b0a9d1985faaea5c7a7567a7947e7ab65c388719dd200adb73e28b71383a7833d00f33b12256be0d8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692659029, "uuid": "65ea7b89-287c-4fbb-9192-6482f2e90e80", "value": "T1DC95AE033F95816EFE5BF6335B2AA2D501B86E2C0332E55F16C439A9A9701615EFD323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692659029, "uuid": "fc5cb2f0-e80e-49b5-a299-b84d4184cab9", "value": "24576:otncpVGPAs9FsEsyt8l+E+s1tB7parWM0Sy6MQYBXjhi0iCq+otd9s:hpUPd9FBJZEH1X1arF0sMQYBTsJdd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692659029, "uuid": "a2c84fa6-a90b-4762-aa06-4e07e850f601", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692659029, "uuid": "a160800f-6b60-4a94-901a-09e4294f7334", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692659029, "uuid": "a38a578c-eddd-4d1c-bb32-22a726645798", "value": "9a7db0204847d26515ed249f9ed577220326f63a724a2e0fb6bb1d8cd33508a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe68783c-3ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602767, "uuid": "2dfa205b-ae21-46b8-b14d-b81d170dd3c6", "comment": "Malware payload (AgentTesla)", "value": "ebba88584bb051d300db66d6af883ded", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602767, "uuid": "9f501438-e8e0-4281-b4be-f64ebcaf2f1c", "comment": "Malware payload (AgentTesla)", "value": "9a9022c2741141541b5e634dfac69e41e75887584b51424f044b525416e8e676", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602767, "uuid": "a75228d8-c8d0-4ebe-87bb-7ded6dc70cb1", "comment": "Malware payload (AgentTesla)", "value": "f8e52b3f3312c26d59fa76364c31fed51a0de774", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602767, "uuid": "1ec53887-ee3f-49dd-a401-9b2c0c227e56", "comment": "Malware payload (AgentTesla)", "value": "adf01e579c4ae00b6d48d5e6a067e1c01dc30b7e0ed5775b43875ec3fd0bbd3cffebadd6d5b4481bbbe448b04b4d899a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602767, "uuid": "b07745fe-502b-4b5f-aa31-3a3da36fc1ab", "value": "T19ED42362B5990B2CD86F5BFC9516E107A3B87B1A2413D87D6AB238CC07777902311F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602767, "uuid": "30d01873-c489-484c-b5b4-3d09985a8164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602767, "uuid": "22e28f2c-338e-4abb-bc27-ed018ced032a", "value": "12288:y0Dl+C42xjWeZed1V8klpaiR3dxyUrkyERzBlHbhLCvrkLgE:3RZYk236NJDHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602767, "uuid": "31c838d6-0b21-40e5-b019-5ea6d61c0ddf", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602767, "uuid": "9e3829f2-7c5b-47fe-b1a5-67f20dc334fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602767, "uuid": "cf2f2cbc-28c2-4b42-85d8-af01fabdf13c", "value": "9a9022c2741141541b5e634dfac69e41e75887584b51424f044b525416e8e676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44516468-4028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (EternityStealer)", "timestamp": 1692625218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625218, "uuid": "30ecfed8-04d8-4118-8858-e9c71a6831fb", "comment": "Malware payload (EternityStealer)", "value": "a76c1125dacfbc3915da530751b42959", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625218, "uuid": "64f23e3d-3194-4eac-bb8d-8c68ff72497e", "comment": "Malware payload (EternityStealer)", "value": "9ab7986388ed985549037d1aa7663f59281f7babdaf9a5312e9653eefc88f7c0", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625218, "uuid": "df3d2c1f-c96b-4f47-8181-a3fd7aed505a", "comment": "Malware payload (EternityStealer)", "value": "5d7e45a1e91f30f69c585b85676c30969f7227de", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625218, "uuid": "f6358e93-388d-4abf-bdcc-5cf860976994", "comment": "Malware payload (EternityStealer)", "value": "da042e1390b472a99fb01fb47d8f02821adcc0e1d6a397c9461c71855dcc39627a8164a99b730a2606ea7c1bc4598e53", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625218, "uuid": "5f350b72-580b-43ff-8841-ebc348e3c1cf", "value": "T16A637E173E90C032C6C15A70A67EC2D36A1FBD414EB5C18F77A96B7A8E711906E36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625218, "uuid": "7f186e19-8eec-4bf4-be59-2b22800fccd9", "value": "b1141867ae472c2bfcfa281c505949ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625218, "uuid": "c7ab2118-4f48-4b27-831d-84f1c2ac5c2e", "value": "768:GI8h1BxX3dkIoBQ+0fc246aVKyFVKR27z3mO9RQvrEa7xAy4C3XMcS+WRnK4w:f8vdkiCKy+u9RQvTA9rcS+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692625218, "uuid": "00872a8b-5eee-420e-a707-d3f60212eba4", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692625218, "uuid": "01461e2f-2dc9-4326-97c3-49d2c73dcf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625218, "uuid": "0e94065e-2c7b-4121-8827-00ca197a8f24", "value": "a76c1125dacfbc3915da530751b42959.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1c484e-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647429, "uuid": "21670e70-139a-4814-b0e5-c9057435d100", "comment": "Malware payload (Mirai)", "value": "38674342ed5582fbcd82096bc5075dbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647429, "uuid": "2538c6bc-6555-4fae-b416-6c800ecfb8dd", "comment": "Malware payload (Mirai)", "value": "9e4ebe0313bc9be73ce9ef8c9523ac022270fdb3553480369bc168d1cd89a5ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647429, "uuid": "523fe347-2b8f-411e-9cc6-0ddc95c142f2", "comment": "Malware payload (Mirai)", "value": "2e51abba7cbcfdc53d7bea9d2e0aee1912e88717", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647429, "uuid": "099490f4-6b24-4824-bde4-85fdcc4f7ede", "comment": "Malware payload (Mirai)", "value": "843d01467f967bad248e2ba764e24ae9c952441c250020f004c614fa27a263fb98294fca975c7f5485c0352c51766309", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647429, "uuid": "3179da5f-88ad-4299-a141-7a040905da9b", "value": "T11E532B89B401AE3CF84BE6BE94314E09FA35725425A30F277AA7FDC36D311684E46F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647429, "uuid": "d75e1547-3426-49ce-a8ea-9aba416057b9", "value": "768:65eBvsiTAPTLwOcvebpqwe8f+YCPBPhuS8uKv537adqH7bwGP6ssZ9yfXO:65JTLwOcWlk8kpPwS8uwBadqH3wGzf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647429, "uuid": "d4d78a9b-003b-4214-ba2b-6fac10927009", "value": 60888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647429, "uuid": "6c48322d-201b-4a75-8de0-778c2b415423", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647429, "uuid": "36a6e0a9-b3e6-46f6-925a-c2d5c7450c1f", "value": "38674342ed5582fbcd82096bc5075dbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2875408-3ffa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692605753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605753, "uuid": "012e8734-1112-4bcc-9949-197e1cc263bc", "comment": "Malware payload", "value": "b30d2f920b5c64b457d8f599ef8c93a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605753, "uuid": "d3fb4aab-eeb9-4590-9299-40d055cb147f", "comment": "Malware payload", "value": "a3cda611600e3afdc08f900ae59d6229c4e6631d90f30d72e4a5daab9c4666a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605753, "uuid": "d456b01e-60a1-4bfc-bf64-00e695ba6040", "comment": "Malware payload", "value": "bf4fafbcf2d5f8b0c2893373ffa57dc5042e5e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605753, "uuid": "ccab9610-6c40-48f6-bd0f-b14f9cb798cd", "comment": "Malware payload", "value": "027a10f73bfd5b2bf78b0ea290f7a008f102932091274b26ef9dd38c8b1ed48b4d129cb1304d6373026eaac1253ed725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605753, "uuid": "474416c1-c732-4d35-a8bf-e1bd73090209", "value": "T184F40253755E4F1ED23B87FAA5B1640053F86D032462E3ADBDC0B4DE1AB6B804E25AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605753, "uuid": "8251b570-62ca-4eba-b194-be0f89a59c16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605753, "uuid": "0a97265d-c72c-4ee1-9d8a-9565decbc0f6", "value": "12288:srIh+xGb/8ssWEu0GpAeTLp5RqUlacZ8h1sWz6nL0zc5XNR4DH:Hh18sP10GpXPqUlNoem6fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605753, "uuid": "8914d344-1d5f-4cc4-af57-cf43997cc412", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605753, "uuid": "9cd478d1-9063-4b6d-8ce4-b00295ef4029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605753, "uuid": "89ce7208-3448-4da5-9b77-3ed4d97a7c7c", "value": "XbXb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4db68b6-401f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692621622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621622, "uuid": "da63a72b-b72a-4a5a-9c30-cba0f83bfaa1", "comment": "Malware payload", "value": "95839767506c9ba29794634e1ce14267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621622, "uuid": "af43b50b-426c-42ae-a81c-85c730d2db2b", "comment": "Malware payload", "value": "a473c7996229381e6b005fd88a304af1e33b33e00268d03296ec74989151079f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621622, "uuid": "31e44325-52fb-480c-808b-19f9349e7254", "comment": "Malware payload", "value": "f8e92d29036108850dea2f6eeeb458910840bfbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621622, "uuid": "3c7c9155-3951-42d5-805a-16ed6c4ca505", "comment": "Malware payload", "value": "8c1d8391394fe4a361a81d16af9f3c29c3f2830059914a21f01f586df7bbaa2287c3f3bc04687c7f8cc7bd33bdc5836f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621622, "uuid": "0aa5b00a-0c2f-457c-83a7-cd7d44f40a59", "value": "T12B06BF11B99ACD72EAAF4975A968D737237A7EE00B3144CB5BC43D9B1D708C10A71F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621622, "uuid": "d68c53a7-9055-4350-9d6c-510f5111a643", "value": "43b6aad63215aa6e4674d5e2172b7a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621622, "uuid": "2c1a5a95-0ad3-40c4-9cb4-40efa1eeb1de", "value": "98304:r+uKTFHA+XWBflMPzidUtybVkw0KAKnZelHS:vYIBfMEbqw6KnAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692621622, "uuid": "853c9995-0c76-414e-8235-f6347652d666", "value": 3809280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692621622, "uuid": "d060304b-e70b-4419-aa89-b4e78ddbd31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621622, "uuid": "7c487735-c71d-4ee1-9772-c2b4caf8bc18", "value": "SecuriteInfo.com.Win32.DangerousSig.28731.23395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1527cf37-3fca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692584766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584766, "uuid": "cc0dced3-429b-4211-8185-bdf06ba2f55e", "comment": "Malware payload", "value": "376502c5567a003dbe48fdb503a6ad45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584766, "uuid": "215d609f-e1c3-4315-a9d0-0a0f589b2f9a", "comment": "Malware payload", "value": "a5f26cafc43f2daa5bf28e7ec72cdbfaf276e820e5df87854cade65a83f618fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584766, "uuid": "1a7a5268-c542-4710-b0da-961b43562fcc", "comment": "Malware payload", "value": "d4404ddc4e7646388c228d109ad1560ea5ee9e7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584766, "uuid": "bfe3fbd9-3aa9-41fc-94f4-10c2f9231e8b", "comment": "Malware payload", "value": "7b970e793a68ee934cbd9cff401bab39e5739b0cd28d153b68fdf84442637b749badc4d1e4143989d8b1a8bc60222f0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584766, "uuid": "13c19384-1dff-4c91-a3b5-4deee57f8c96", "value": "T16B449E00B490C036DCBF15361AB99A6D5E7CB96107A8D8EF63D84DBE4F316C1BA3056B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584766, "uuid": "1e53c0e8-1863-4c36-9627-9dacac0012ba", "value": "1c27fd93d9c50e3fb4592acc4cf754a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584766, "uuid": "a25ce4ac-a9c6-4603-858d-a212d7b88e05", "value": "3072:fkapiChVJLAXJOxqM2I1eLnp6OvOc/gpFfu6k6Eta2hyDyCBPsRD5twuAg0Fuj0g:M6r0oupgcsFfPq32y3jAOl6gPlPrPoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692584766, "uuid": "9abcd022-b052-4e6e-bcbb-78645065d0db", "value": 265544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692584766, "uuid": "ab4cac19-ed2c-439b-878e-8e6b65c85791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584766, "uuid": "d8b9cf31-fd97-42d1-9a56-f3ac9e5c01ca", "value": "376502c5567a003dbe48fdb503a6ad45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4378d7-4012-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692615779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615779, "uuid": "bfb3828a-1bb0-4604-8848-258016bb00e7", "comment": "Malware payload", "value": "8ff4fde4516237540144fb03ef8d3993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615779, "uuid": "d631657b-c76e-44d7-9408-b38a1e35e208", "comment": "Malware payload", "value": "a6564f8ce9eaea25a8bec2b680c441f1dd1658052ec8ef99b64c989e10ce955a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615779, "uuid": "51d275d1-2f07-4f2c-a3a9-fe793c504961", "comment": "Malware payload", "value": "6f0cf988c35c6dbdbe62411a1c193f64e26662e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692615779, "uuid": "9c37b326-1b6a-4a8b-9c04-34d2d35cd759", "comment": "Malware payload", "value": "aa52b36805c993e4375bcb0c881541c6c8391fd1929b588f0cd19e8eb1b609fa3736d71f99092df4783fe5ac40a3a542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615779, "uuid": "06cf7997-9eaa-4563-87c8-6663dbd66f38", "value": "T1D6F41210A16D8B2FD67A97F69170A28493F554123C33F79C8DC970EA26B33818F66E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615779, "uuid": "953da40c-c3f2-4165-80d4-db8b315bcff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615779, "uuid": "5b6602ec-fa8c-4595-aa7a-0dbca14e0ea3", "value": "12288:0rlh+xGb/8+31MWQXe6yMKE00NXgBi3nYbXtSnLd32rgveSD/c:2h18+31ZiK3OQBi49SnLd7GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692615779, "uuid": "ad068e2b-2660-4b99-95c5-c1e314b294fe", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692615779, "uuid": "5340efd5-b809-4fa8-a85d-4f33fa5b09b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692615779, "uuid": "82bdf617-235a-4ed1-b8f6-ef1982f1cac2", "value": "QtQy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174972c2-4040-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692635450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635450, "uuid": "ae1f6927-bbc5-43ab-8453-e3b58e49023a", "comment": "Malware payload", "value": "2f1b494814807d3344b483d97ad497fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635450, "uuid": "f8010ed0-8941-44ad-b28a-74665c9cfb66", "comment": "Malware payload", "value": "add7a7439801a0dab2dcbc0262c1e0de5c014cd48093b8b725316cd1600f2ee5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635450, "uuid": "92ad89ed-4ed3-4ad1-b0a4-cf5fe1819f74", "comment": "Malware payload", "value": "b5046e9db94167ab34bd929f677a7761e0d72f3b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635450, "uuid": "783d6e2a-f5ce-412f-a090-80c250c3ca9a", "comment": "Malware payload", "value": "c2b5c8091303c43b3c2f6359ecca41498d2ffb1201481763853275fffad71159d9e0889e9e0424db8391e7fa7dec5b6d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635450, "uuid": "ef514387-a908-46ef-a1d9-0989d9041e99", "value": "T1BFC38E03B19581F6D55C003C546FBB3AEF3BA9A4DB495F8B6705CDAC4CA3124FE6224A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635450, "uuid": "e9e4f20e-4bc2-48df-9895-ae246722ef8f", "value": "2dfb11bf17577d3f17e5262f42b9376e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635450, "uuid": "8718dfd3-2e1c-4ecd-b8a8-0f4555ae7210", "value": "3072:EeLh9AGJ0RS15uhnUrdt88UeJ8LXdZBLsqSp:HLhrFrqUrHvlYd/Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692635450, "uuid": "c0c77fee-7c28-4571-97ed-c862f711dfab", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692635450, "uuid": "dfc2ca3e-8165-4119-beba-e25f009aa8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635450, "uuid": "0336d31b-bca5-4d91-96f2-8811026b3ca0", "value": "svchost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b18ec6-3ff5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1692603291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603291, "uuid": "ac8480c4-ba3b-4a1b-87f7-3329ea141068", "comment": "Malware payload (StrelaStealer)", "value": "2d74335bae5224625d0bd345417eb0bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603291, "uuid": "3ac00a24-c581-49a0-b63b-bf4d7d10be0c", "comment": "Malware payload (StrelaStealer)", "value": "aed827b9a14e63b021b0ac4536fb352699f09ec8add4bce006b89d721380cf92", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603291, "uuid": "651f6adb-6c9e-481d-9f08-39b14ef39339", "comment": "Malware payload (StrelaStealer)", "value": "965b83dbec2601bf0674b65977bc8d189679695c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603291, "uuid": "1d13bf57-4896-4e1f-b7cd-54694fc702c5", "comment": "Malware payload (StrelaStealer)", "value": "c65cac1780b05b1884ec24bfed576ad98020cabcbb298abe0beec5eeacecaa7b6e61212484db5c5a7b2d5c780820c5ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603291, "uuid": "69cc42c9-40a7-49a9-b35c-ad20d6bb7e90", "value": "T1F966D7F4B291BEE60F745A1DF38F40B22C27B86AF07E5E8A22951D5DC5C4244D9E6CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603291, "uuid": "1296ab5c-bd19-4a46-b6ee-d649162345d5", "value": "49152:2wwGxzIAKGmETZxgHmzDrMP0tv+0q0hMCHUbUg:pc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692603291, "uuid": "7c55799c-12db-4abf-9768-f776dd814d35", "value": 6609687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692603291, "uuid": "459d6391-5a69-4a2b-9087-553603afe63f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603291, "uuid": "e8e511f5-cbf0-420a-b716-e2b797746074", "value": "17582947525093.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47768d8-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596254, "uuid": "77b506c3-464e-43bf-a218-072fd225dd19", "comment": "Malware payload (Mirai)", "value": "4607cfd57cd4149d74d383274f8ccedd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596254, "uuid": "00de448b-06c0-47ff-8ca9-ab79dbd37211", "comment": "Malware payload (Mirai)", "value": "af9b75144c29483be19ec34ebc55a7953a6afa7ecfe1cf0113b65a516d0f4647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596254, "uuid": "09331e5e-1066-4947-b0e7-edd2f249ef12", "comment": "Malware payload (Mirai)", "value": "a311226255c8cd139f699a902121e3aefd5ca352", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596254, "uuid": "d49f0483-b93c-4c2d-96d9-92e05f5581d0", "comment": "Malware payload (Mirai)", "value": "3fbc06216e415c5afd0e7edb754daedd6bb5a881b269ba442c1d6b0bc03a825484c1c297175ffe593c8af4215c7c3b08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596254, "uuid": "33c72838-ea4f-4d28-8e15-a3e84a545f4f", "value": "T157E2F2A7A372A452DD7C7BF1F5A982CB2BBD4E6CD17B30A21601562C2D960435F3C493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596254, "uuid": "cb5a210c-325b-49c4-921a-34a61cafc85b", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9Xh5s9q3UEL5I6A:1orm1vpALgUJh51LE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596254, "uuid": "a9264b50-4449-4728-9266-3401c23d049f", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596254, "uuid": "1744d7af-ef08-49b4-ba90-917339e760a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596254, "uuid": "6041eaa9-ab76-4513-8e0e-7387d2c76729", "value": "4607cfd57cd4149d74d383274f8ccedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b82acf-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692595914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595914, "uuid": "e71d982a-d6cd-4931-9c80-c112f2db7684", "comment": "Malware payload (Mirai)", "value": "0d5303cade9ff0dc98e18a4195d5f6c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595914, "uuid": "8b48f780-31be-441c-a699-3a3eea36a52c", "comment": "Malware payload (Mirai)", "value": "b08b0d061e921975f5f40a542b7c32f5ef7c3db63509d5645362c95e203563c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595914, "uuid": "38ea1384-fa2b-4259-8d86-4b51437710e1", "comment": "Malware payload (Mirai)", "value": "1eb0026f357906a61e2bcc706b9508cecc8b81c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595914, "uuid": "1b0f2772-7590-43f1-b34a-cf320b2484b0", "comment": "Malware payload (Mirai)", "value": "8a079e84b7a2cc8119a5436f8f7742b03714d10fcc8373e446568e9167a599419400cc8d31cd78da2e90e9401dcc6f9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595914, "uuid": "8452760a-95f4-4431-b9d2-45ca1b0b0941", "value": "T12B539DA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656845FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595914, "uuid": "6278d356-4497-40ed-a155-0714c933ed14", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCXAi:KGejAGyZyuhxaU/Sjf+iYdtPlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692595914, "uuid": "2648c8e5-3869-4f85-b1bc-f9869decdb1f", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692595914, "uuid": "3ada4ce9-ce14-456d-955d-b7639512d9f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595914, "uuid": "9ce1b0f1-cfce-43b6-8ddc-987734c5eeba", "value": "0d5303cade9ff0dc98e18a4195d5f6c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1245a497-4007-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610961, "uuid": "d9d3c4b3-d923-4b01-adb0-f50ee95252dd", "comment": "Malware payload", "value": "7709939f8d37cfcf136a7b3703e3ee95", "object_relation": "md5", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "jpg stego", "colour": "#A77EB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610961, "uuid": "5b3444df-9484-4754-9205-6f3f36321297", "comment": "Malware payload", "value": "b0c79c0f087b28e30cf4126ad4766ac21723ef5c41cb3aba8e04eb4c68e88558", "object_relation": "sha256", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "jpg stego", "colour": "#A77EB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610961, "uuid": "32f87741-44a7-4a63-82c2-99ff7c773db9", "comment": "Malware payload", "value": "6bef66174de302f80f1986929fc01f31fcdf28b2", "object_relation": "sha1", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "jpg stego", "colour": "#A77EB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610961, "uuid": "b8d89cb5-da22-4728-a1f1-b9a9e3863d0f", "comment": "Malware payload", "value": "a5d4a5e0da5c15b74d2f61594548a8e4466f042503099169defdc6dccedf7980b4892773e53466918c10da66a143c176", "object_relation": "sha3-384", "Tag": [ { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "jpg stego", "colour": "#A77EB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610961, "uuid": "be554133-8828-4b83-ac4d-fd8a3497bab7", "value": "T15746D0B262C6FECE773F0EC8900837865D1C746B87149158BA851777B3EAA24DE24DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610961, "uuid": "1d928331-730c-43b7-a25f-1fcd3baf1810", "value": "49152:1YW/tphzY4YqzgJMrw7kYahLAfkNulADMEsztqBOrBRK0W5oZ:1YgtphzYx+3rS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610961, "uuid": "a65a290e-da81-459a-9261-6b08916f1589", "value": 5427280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610961, "uuid": "5e5d2061-ce4d-41e0-b4fd-79dac4fe1df1", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610961, "uuid": "e83cf1bd-7d3d-4564-b623-bcc57dcb183d", "value": "universo_vbs jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd9eb2e-3fc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692583439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583439, "uuid": "6f6725da-f8ad-4572-93de-af83803c28fe", "comment": "Malware payload (RedLineStealer)", "value": "7fee772359eebfc7325fc47595ba585f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583439, "uuid": "0be08d69-e76c-4232-9d56-598931876cfb", "comment": "Malware payload (RedLineStealer)", "value": "b106a69dc034910468926bd1e55f030a60cafdc2bf1af8f1cd5d683c110eb8ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583439, "uuid": "0cf62864-a143-47ca-975c-15fa9d6dd6e5", "comment": "Malware payload (RedLineStealer)", "value": "9d078b8928a927ea394f72d205aaf88b7bb0ee82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583439, "uuid": "8ed48f36-e3e1-4884-8d1f-a10d03afeaa2", "comment": "Malware payload (RedLineStealer)", "value": "3a8e4ec964451d7ccb292659595266df51a4be844cd197308fd9f578c82aa3ac28042175dbf8b1bbae247f501ff4ba46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583439, "uuid": "497bff51-941c-4832-adf6-de4d853320dd", "value": "T113059C3278C48037D77315B2052DB2784BAFB4B02B5A56CB17BD0ABE5F285E15B3361A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583439, "uuid": "9ec54846-d3e6-4f0f-943e-c7fee3c2f44d", "value": "9da2703540f07e47dbb67cb946c427fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583439, "uuid": "c1acbe45-c453-4f8b-a010-585c23adf834", "value": "24576:b756pE2VWHv6xRRZyPg2mRkH1xnfN4dUjL8lKaj:b7KVWHv6xJyPBxnFaUjL8lKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692583439, "uuid": "77661d5a-4723-4c0a-b4e6-4a57592fa1a1", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692583439, "uuid": "779df820-76a2-4b7b-84b7-61119b4fa182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583439, "uuid": "3eaad7d3-7b99-4579-9fc9-13d723e4d0f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7752bfd6-3ff8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692604688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604688, "uuid": "6637ef5e-f466-4dc2-9336-90949841c994", "comment": "Malware payload (RedLineStealer)", "value": "67445af34314a6aba1f685885a3e2aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604688, "uuid": "ea109279-ceff-480c-abfe-3c7e75d248b6", "comment": "Malware payload (RedLineStealer)", "value": "b154c3d8a7d71c3fd64fb2a3c41e72ad9289dc9b7c905512dc928893a31086b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604688, "uuid": "68825b39-b40e-4fa6-9a4f-ed109c925062", "comment": "Malware payload (RedLineStealer)", "value": "1a7cec4106a837a9d31edf92c90ebc3cb2ccd27d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692604688, "uuid": "368e734c-0d95-4306-b81e-f42664dc1717", "comment": "Malware payload (RedLineStealer)", "value": "25ab58581b3ce2c430214c9bbbe5497a18baa05cc8df4efae7d200d79cd28916d5f3bbbe72e4b3cad18b0e3a9315565b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604688, "uuid": "04f5426e-261b-45e4-9b1f-9ce70c0f2203", "value": "T15E059D21F5E2803AEABB243201B6A775CD7EF0621B1412DF17ADBDBD5FE42806721167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604688, "uuid": "7e6e5d3e-f896-4683-8ac7-2cf8c1762724", "value": "9da2703540f07e47dbb67cb946c427fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604688, "uuid": "98a72a4d-99e4-424c-b88e-6fd42afeaa33", "value": "12288:h472Og6pEAt2NxW7t5dEuPDP1/mUIg7SVxzMAriXujoo/mutndxRFI:O7s6pEAt2NxW7lLNmUIg7SVxotwxRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692604688, "uuid": "e3fbc301-009b-436f-9f37-efdf88f78db5", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692604688, "uuid": "9d66f8c0-5624-4568-aec9-6a447906541c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692604688, "uuid": "ba888ab4-7c86-4a5d-ac4d-21708f4e50d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8977b63b-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610302, "uuid": "d5eb783b-75ce-4dd9-be17-5009217cfece", "comment": "Malware payload", "value": "06291d6bab0507dc4b8554953008f965", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610302, "uuid": "8c1af94f-3027-4b66-8ec5-a826ac2b019d", "comment": "Malware payload", "value": "b24817782ffe9736e13af57d8a9a598e9220b4b14aa9bed789d99a94d420a8ad", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610302, "uuid": "27cbb820-a314-42e6-99b8-c5d58c82082a", "comment": "Malware payload", "value": "870aba2c0ca24f511d987b75d0388073ebc4c9db", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610302, "uuid": "07976ab4-1588-4e70-823a-b7ec75703303", "comment": "Malware payload", "value": "e16833f648e9670e3e452913573ab054abedee6e3c2db3edaa9108ebbcde140a4b38ea5efcd3970cfe6c263c876e5e9d", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610302, "uuid": "da9592af-80b0-4e79-ac64-b63802d812af", "value": "T13331D2331522804C9EF24C5D637EA77C67B3C4183BA4D7AEA79809A85C02A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610302, "uuid": "8005bfab-5705-4919-8bbb-a2b65344692c", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlEItakK:4oyeP9YeYaMImCmoItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610302, "uuid": "b31e730c-38e7-4e81-9633-ffb061fdf502", "value": 1794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610302, "uuid": "eeb4de5c-659e-4ac3-8b17-e7c6a9b3a749", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610302, "uuid": "54628d8d-9009-4028-a101-401ccfb9a60f", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c0ef4-3fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692588450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588450, "uuid": "6cd60bf5-27f9-4e1c-8425-49d380cc25f6", "comment": "Malware payload", "value": "a045c9df7ea13482def712a8d0ed1ee7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588450, "uuid": "e8cf895c-3696-4a12-a91a-711b2b0699d2", "comment": "Malware payload", "value": "b34ef16461be2e9d44e9f77a63c6d46b90dc091ee78ff28af045f1d3ec8fa1b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588450, "uuid": "243706e9-1d18-47f8-8908-52e22e81e25c", "comment": "Malware payload", "value": "3cf372ad7b704e888a74c572d173d876bce6c87b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692588450, "uuid": "d9a67643-8b4d-4a3a-a953-dd830aebce18", "comment": "Malware payload", "value": "42af4405b4c1d158b95313df35422ffce851f4e7acb2935550148e921eda0e3d43c3a84436865f88c6c69d6c2135b122", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588450, "uuid": "0e5f85a3-9776-4138-84bb-6ba3adde734f", "value": "T1552378D0179D8FA9F30A34BC44C46D315DE469B9732F90A9CBD7CC9AC419EC522A0E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588450, "uuid": "eca258f2-c4a8-47f2-9e81-a193ea89d371", "value": "d8ce9fc3542a0847823df385d3c8424f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588450, "uuid": "fabe4f93-9485-41a3-a594-009071f8d76c", "value": "768:/VLQDmPDEVplA3jQYubJyqzvDAONtOEJVNnHCd3So9OZR++zRhtiOz1vm+Ydj:/VsDmPDwAz/q70ONwEJVNASoEfhtiOJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692588450, "uuid": "b558acb2-bd09-445c-aa5a-3af0c9329f7e", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692588450, "uuid": "8b35e45a-be1c-470a-986f-4daefbdec896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692588450, "uuid": "9eb0508a-fe16-442e-acd2-4378a90d862c", "value": "SecuriteInfo.com.Trojan.Loader.1684.12295.4048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7443cc-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692629953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629953, "uuid": "39c4d46f-81d1-499c-a074-a94232831bfc", "comment": "Malware payload (Loki)", "value": "6f0cb4fc92654a60a89857ac06e76901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629953, "uuid": "ba76841b-5452-4780-b6b8-696cb60e4295", "comment": "Malware payload (Loki)", "value": "b3660d5b89325da2898e2ae7efe2b19c1f0442039f4ca76ad7b9876368b5fe99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629953, "uuid": "82b6f37e-3713-4dc5-b6af-e0d9e8f80fac", "comment": "Malware payload (Loki)", "value": "6096744dc29a7e1bbd72dc470559589e312c0b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629953, "uuid": "bcdb85e9-7808-4d12-972b-bf2752177bfa", "comment": "Malware payload (Loki)", "value": "aaa8c644b1c5d88f9c3e3a8c9f686b12b0350a5e98aca10302db3c1559cb3929892914b52c83443a2f0cea7528c2708b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629953, "uuid": "9ef21298-b1b9-4a9b-90f7-3347fab45f5f", "value": "T10F647D1393D17C31F52746328E2AC6E4AB1EF9618F557B9B2758AA2F09721E1C7F2301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629953, "uuid": "791fe192-0bdc-415b-b5b7-9b396f5aa3a9", "value": "ea5c91886d318a6fa141ca03c663eea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629953, "uuid": "e3b507b9-20b9-4cc7-80ca-c29e66104b42", "value": "6144:B8N7L5SJTzH370QxJ9N+HBc2868i/a8bPnSs:BK1qTzX4QVidHbPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629953, "uuid": "18380535-cfa8-46b8-bbc2-1a15dbbd3f7b", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629953, "uuid": "940d006b-9e6d-4b8a-8cd0-0e65c3fa634b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629953, "uuid": "0eb49791-3515-4151-a86a-11e42bf8cb5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729a397e-4075-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692658367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658367, "uuid": "3ad3fcf5-4690-4d9b-ae8e-3e20fba40679", "comment": "Malware payload", "value": "a41f96e758448283ba25e0c2db3e07f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658367, "uuid": "e457ae6e-26c3-421c-ba68-8c5b7bb0a30b", "comment": "Malware payload", "value": "b44f87ac8e73b8338f7f0c689f4782c7aff9ec9c569cd68b8c01c6b1ff65beb3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658367, "uuid": "a4ebd6e6-86a3-4f20-99a6-470543bdd3f9", "comment": "Malware payload", "value": "e57f811d752dcac7718e259624755edbf26477b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658367, "uuid": "1f2ec23b-c248-4609-ba1e-69fc3b10e3f4", "comment": "Malware payload", "value": "5dbed995cd1a94ee438b0fd773abdc4b7d7031ee85127a65f3a8b26c25fb01a5c2a736b591406d867a46fd52bd649cb3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692658367, "uuid": "61eaa0cb-067f-4e66-8ded-bf58021ecfa1", "value": "T1EDE4DE143BA4DC508B6C16E868DB97079B2356A7DEEFFF070AA291340A5B86347513CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692658367, "uuid": "f9c21833-7879-41fe-9c26-30ad971c616b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692658367, "uuid": "81c6c5d6-1ff1-4671-b5ef-7571b4a17fe8", "value": "12288:yzSzJpUTzucAp9dDONwdwRm5lyc9iJbXpf:Rpkg39KRmPsbXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692658367, "uuid": "af3b39ee-973b-4d72-bece-3722ee3d05f5", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692658367, "uuid": "820f58c2-d014-41e5-8bb2-752c54536b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692658367, "uuid": "361fabaa-4233-4813-b59b-c6b8f0607b05", "value": "LABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZPEwjVIODEQqXUZPKRVAUMUaE9kGQoXTetKGxWBJpAooXeTM3z0VhaHmZWr8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d092a546-401c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692620299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692620299, "uuid": "ac34c98d-d9de-47a9-b636-92500c2a0530", "comment": "Malware payload (AgentTesla)", "value": "5eac01eb48b833581db348bc8ab49932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692620299, "uuid": "3b99ada1-d1b8-4c14-98fe-fcd45c642eae", "comment": "Malware payload (AgentTesla)", "value": "b48a5ebf4d21ce938606b70952e053ff15581a50d96e1e2cec000a8173edade3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692620299, "uuid": "000a04d1-d27c-43d7-a807-a74e6fe7d012", "comment": "Malware payload (AgentTesla)", "value": "76adbcf9ffd7c737a513c61412c74a8acb9832d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692620299, "uuid": "48036699-ace0-45d2-bea4-c4b174ed8a08", "comment": "Malware payload (AgentTesla)", "value": "36dfff472c0bc3c17e262a84c6299445c69714a3bbb5a8c9b63956343d2551ca5334c90cfcde6a67f45f31fe85d4a943", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692620299, "uuid": "b0c1b18c-f1d5-4ac0-8474-c268db5859b7", "value": "T1AD742343B262D29BF25316B215B9AFB7CDB3AB4154585F421310AE4FACB63C4A11EBC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692620299, "uuid": "54e766bf-a6a2-49b3-9564-5db36a8832d4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692620299, "uuid": "c0d40ce0-63bb-4c97-b918-af52c36414b5", "value": "6144:kQ606xiZ8/J8UwuB58YjMo3LNkW0IqWNhPyXgeXyy4WUviQX2EMKedJje:fZ8/Sg8doLOWJd7DdevK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692620299, "uuid": "66a17761-2bec-4bc3-9a75-b28697a24e79", "value": 361760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692620299, "uuid": "eb80dd06-62f1-4fa2-9e8e-f30b1512d41e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692620299, "uuid": "caa36d1f-fe5b-4692-9ba9-c010bfcf3aac", "value": "Remesas Aceptadas_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5b7a2a-4017-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692618197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618197, "uuid": "03f041b5-08c5-4d35-9699-0d4c141cd102", "comment": "Malware payload (RedLineStealer)", "value": "f21817bf33d912ae479a99707e2b644b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618197, "uuid": "2836c308-c7cc-40d3-adfa-25e9b1bb7764", "comment": "Malware payload (RedLineStealer)", "value": "b593e204431e1579ec405a8e9428d08512466a2a6a108b44de48daf2841d5e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618197, "uuid": "df13a50c-5c1d-45db-b4f4-ca28666cfaa4", "comment": "Malware payload (RedLineStealer)", "value": "330d73bb316723b30b4d895552c36be5e6625375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692618197, "uuid": "11027c90-f9b7-452d-ba5b-1827932fc9df", "comment": "Malware payload (RedLineStealer)", "value": "adfc76a37d9bd66c5ad7501ef00ce39eae04ba9db80be0504cc5f78ad7e1bb630ac2d0f782316f0e6986fba1cb60187b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618197, "uuid": "ad54b4e6-9b42-459d-9db4-95141b9e4de0", "value": "T1A8356C207881B525EDEE23B687FDB82C839DE1A0071585EB75D81FEE86D03D23A35572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618197, "uuid": "5d63a296-74da-4506-b2ef-10ebdb9b0b2d", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618197, "uuid": "a0caee41-2834-431b-875d-1015ead97651", "value": "24576:Ivv1/j4b9vK4PetlM+EIPug1BeMoMwpz:Ivqb9vK40MYF1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692618197, "uuid": "32c0ab3f-b6ac-4a23-b3ee-2c165e85df77", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692618197, "uuid": "8ab653a1-1db3-45a5-87f0-1b79845e7468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692618197, "uuid": "a9f6e89a-55ff-4cea-b7d7-ae087fdb4b26", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.13183.2601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4695ad43-4022-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692622645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692622645, "uuid": "19da03e6-2b32-4a61-aea7-7ca1ce03b14b", "comment": "Malware payload (Stealc)", "value": "6a94e4586208511574df7aa42ed04d2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692622645, "uuid": "490eaacb-7dca-4579-b509-071a3db6a62a", "comment": "Malware payload (Stealc)", "value": "b88d2ce2e331027304421d38561f895aa675f70a17c5ea16eca91ca700148792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692622645, "uuid": "eb4e0ab7-cc23-4007-826e-2bd760a94409", "comment": "Malware payload (Stealc)", "value": "9ee9b9f134c5987f49e1f300335dcc402aa94362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692622645, "uuid": "2b251b6d-f985-4eb0-937b-ed436b0306b5", "comment": "Malware payload (Stealc)", "value": "56d3fed40192b4a1c4d2cabf8f27791780e618025b3af96c1e815621b22b3dfc6eb0d520979aab6b99191616f1741771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692622645, "uuid": "e1fdfb9b-490f-4a59-b610-80b248cb9157", "value": "T1AE44AF236390A872D4574571CE2AF6B47AEEB4718F68564A3F281B7F0D706B2D22730D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692622645, "uuid": "0fcceb99-e98f-447d-ae25-22ca2aa1a5b5", "value": "dd524e0314968bf576181253b87644dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692622645, "uuid": "5a542b1f-07bd-41b7-a107-2a2b1826493f", "value": "3072:Q7DOaxlLtUy/h/VOz1n4Y2WxC4yNpyEDzqYlvN1ZBz53gdZ:+OaxlLOy/hdkdbpxQJvN1ZLgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692622645, "uuid": "521e3ada-67c1-40a0-ac70-636cd168d5d6", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692622645, "uuid": "ab55aee4-7601-4d41-903f-23671cede2d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692622645, "uuid": "6e525bc5-46ba-4c30-9061-b4fff7544160", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7187ee-4024-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692623698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623698, "uuid": "5929b57d-77fe-41dc-88d9-4d3852bc17d9", "comment": "Malware payload", "value": "76e5c6155cb2e7339c8808747047c2d6", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623698, "uuid": "45f95579-938e-49d6-86ee-c1d8d02aa09d", "comment": "Malware payload", "value": "b8d2ce79f2f5e3a1c59d78089b326991626f82e7d9d832ff804ca1d26b4f3920", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623698, "uuid": "4ec747a6-403f-4ef4-b31e-48f179963d0a", "comment": "Malware payload", "value": "d815e5f4d650701c1ba6ccd8d7a8a803e8a4b450", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623698, "uuid": "02722527-9e23-4b90-99d4-ca1140d71e19", "comment": "Malware payload", "value": "9f2fef80293b9828f902dbb8255cdb85d4e0f6fcf735224612c34737549d9e4e3d87899976f169490e7ad426c2df336d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623698, "uuid": "0a72349f-30ef-471a-a10b-39003b6abe7a", "value": "T1C541956F4392303BB7F210159381B447BAA590CE6C1B7D047ADCA11BABC125A03A7F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623698, "uuid": "834b11b7-1fbc-4d63-9442-8b2bf4acd418", "value": "48:rujcjBAfUxjSvb29XY2CQpScoQ+JwpAikSE09TZOU:ryUYT29XfScx+mpAhL05ZOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692623698, "uuid": "957c5742-8a24-4150-aca0-1ed4856f1834", "value": 2033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692623698, "uuid": "b8ccce51-812d-4756-bece-ce5217c33ede", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623698, "uuid": "4375d4b5-d109-4938-a68a-f19a8824c2f5", "value": "0ZVrHVTb.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9853fc9-4055-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692644715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644715, "uuid": "af8a8e94-634b-4fc3-b066-79c242958e18", "comment": "Malware payload (njrat)", "value": "2046b546c4352659a1e2132266320026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644715, "uuid": "9388e68a-3089-4fd2-b493-da5da631951f", "comment": "Malware payload (njrat)", "value": "ba0a08f59f11d391d5ce008ac55d5833b6cebcc8663f2f30e3adef69aa24b483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644715, "uuid": "02a9fbe6-947a-4fe8-906a-e9510f354343", "comment": "Malware payload (njrat)", "value": "d15304e8c03154cd7b7f76cf5d52bed7829d86c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692644715, "uuid": "4fbc8a3a-a0ed-4a99-a7d1-b480ad38d40f", "comment": "Malware payload (njrat)", "value": "4a27200bc4acec96a964d4e889862b27a5284cfa6ef48116f3d12f0650484ab309b5c59644d8c63dff2b345d336abb78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644715, "uuid": "0a48693d-6058-42b9-8415-6e93564e8c83", "value": "T18C93F64D37E55069E2FE4AB3A8B1B2404F7AF0471742934D49F16DA61B33AD84F48CAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644715, "uuid": "cd84f1d9-d2a6-44f5-970a-e0d714ea08ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644715, "uuid": "9f297107-5324-4d0c-bd82-cac588711f27", "value": "1536:gnEM6IsSOu4wDa1W14z+B2WfkXIVR1zpuv:2E3wDa1WwoKIVRXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692644715, "uuid": "07f52d27-fbc4-4b60-9a7f-e4af705a5c5e", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692644715, "uuid": "bb90fece-85e0-4e5a-a5ed-43f9a64888f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692644715, "uuid": "324e437c-9997-4943-9785-6a2757d5ea60", "value": "2046b546c4352659a1e2132266320026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05280fae-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692602778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602778, "uuid": "83c1f6cc-b5ed-4cf4-b8f4-2eee49ee47a7", "comment": "Malware payload (RemcosRAT)", "value": "03822cedfe4d336fb7b8bab0e101ae7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602778, "uuid": "d943e7ed-4688-4a58-b432-d0e50ff6cbcf", "comment": "Malware payload (RemcosRAT)", "value": "ba82a2d12cfee47fcfab1e288a80e1792e6a8e8260e7582b007221918aba0310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602778, "uuid": "74ac2be4-5b02-4a6f-9898-9bdcacf69e9c", "comment": "Malware payload (RemcosRAT)", "value": "4cc85c0e8330dc7d04b1883d0eac35ddd5caf45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602778, "uuid": "3063959b-705b-4beb-9311-cebbf89681a5", "comment": "Malware payload (RemcosRAT)", "value": "3cabf24144bc50a2f2d48e22af44db2bd8ba6f4fd0695989f0ba1f3c1c0cea404d93a9ab6212af94f8e8131cfffbcd04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602778, "uuid": "f1312ee6-2b23-49fe-b641-d1ed14b06d1c", "value": "T1E7251204A2A48B3AE0BCDBF23497A1603FB99A5F9096EE942FC534DF253075512D391F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602778, "uuid": "00068e29-b028-41c2-930e-1593c46c05d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602778, "uuid": "a85ab7a6-75fc-4d2e-8f90-78a69fc18c3e", "value": "24576:j1g++PA0agXAK0QyU7QWRWrfAWC0Jjm8T5:jU40JT0QnsdC09m8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602778, "uuid": "d9956c75-33bc-42c1-9172-cea9b78eae34", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602778, "uuid": "53cf8912-b79e-4fbe-bda5-a4b026b975fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602778, "uuid": "f9edf82f-5a69-4da1-b539-8ed02efd5c21", "value": "ORDER 0749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8b5a19-4040-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692635649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635649, "uuid": "10240376-3185-406d-bcbd-3b76b3271fae", "comment": "Malware payload", "value": "e4e9792c52398cf9a945155d31ec032f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635649, "uuid": "dae274f1-9da3-4a2f-926d-8aadac38cf25", "comment": "Malware payload", "value": "bbf816a8251d20d4359ed8ed6c05271f6d06649ed42152e29e8c6239dc8ba390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635649, "uuid": "e4bf5ba4-bbbc-4b5b-a3a9-169caac23e7f", "comment": "Malware payload", "value": "5963bb4bf015c4685261aa58d97d48483166d00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692635649, "uuid": "5846cdcc-e3a6-4a50-9a7b-f4ebe4a18401", "comment": "Malware payload", "value": "de7c004fd29229146b7f82724676f0ef10537dff1fbb0fd9a237a969f27d4e059dab16830ea824657091405ce3bc3949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635649, "uuid": "13bcf98d-6411-41c4-9bde-03deeb3347e4", "value": "T1B9949D223AD2D433D8B211701F69EBB6567DE9700B6209DFA3E42E6D1E74AC15732B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635649, "uuid": "bf2c5eb6-61b7-4a9e-8180-01a56c7462a5", "value": "43b6aad63215aa6e4674d5e2172b7a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635649, "uuid": "0b2f873b-6656-4754-9cf6-134df3f9a65d", "value": "12288:5XbiQnSDqYisDEiD3jbTFiuiSiO+3P53nUNlQK:JbvnSDqJsDEiD3PTFTFiv53UNWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692635649, "uuid": "5c0ab11e-7b4f-425d-9e73-8a9ab9761736", "value": 436072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692635649, "uuid": "61df0e8b-e60a-4188-9649-d3e04fd037d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692635649, "uuid": "90236cac-d8c9-48b5-a68a-3c8363729ba0", "value": "SecuriteInfo.com.Win32.DangerousSig.31613.1750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09869660-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602785, "uuid": "f8fded7e-9672-4c01-9166-985fc870fb9b", "comment": "Malware payload (AgentTesla)", "value": "a1662bced65cd0b1a4be962758368cb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602785, "uuid": "c5b98a64-5088-4a3f-a9ef-1b823d45ed7f", "comment": "Malware payload (AgentTesla)", "value": "be7d2434ae5541a33eda329236dd69fad3756256ba0e6a2a6e6a7658fa58aadd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602785, "uuid": "cce3a664-a0cb-4b8c-b534-ed8c347dfa19", "comment": "Malware payload (AgentTesla)", "value": "94e231c250c84bc79c11d0baef91d4a440b1b5e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602785, "uuid": "f340b433-cc37-4a80-ac2d-7bde03c1943c", "comment": "Malware payload (AgentTesla)", "value": "507fd75091d6b24d698717aa25ab2433d22d92546284d17c5802a730e2c17407ce9eb26c1141ea6b5771ad83857ab2b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602785, "uuid": "55bfd6cf-f64c-4786-bc6e-7a8d3075eb22", "value": "T1BC0469F0317D83D3E1A18EB11FCA86B079F136ACA8D0560DA0F59B2E93D2355149D9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602785, "uuid": "4e961d8a-2c16-4827-ad55-feeb2a6c53a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602785, "uuid": "6dbad794-afa0-4a35-960e-dc7601f3f868", "value": "1536:WAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgE:q+9wqY+mhhhmitqOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602785, "uuid": "99dabb31-6f74-47d8-915a-09c706cb750c", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602785, "uuid": "4ee074b5-2001-40f0-b8c5-69b95d58b8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602785, "uuid": "185699cb-454a-4c26-a29c-95e9797c2565", "value": "PO 23000409 update 18.8.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009f0736-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Floxif)", "timestamp": 1692602771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602771, "uuid": "dc22a37d-cc51-4cb1-84c9-48d02607c8bc", "comment": "Malware payload (Floxif)", "value": "15710b09fe672f077e2a4889686258a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602771, "uuid": "1d232f71-aa16-4b37-a962-545b134cf08c", "comment": "Malware payload (Floxif)", "value": "bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602771, "uuid": "66a00b90-02e7-455c-af95-73d4a0b91e94", "comment": "Malware payload (Floxif)", "value": "706a0b4a44db01c4a1bb9038da32ff9a82b8f8bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602771, "uuid": "e7cd84a8-3911-4a65-a6e1-cb33ea705408", "comment": "Malware payload (Floxif)", "value": "e7c94a04a7629df0b2b47ac02bfe08711023d13b505600961a279c72468b85a6bda2636dd84851ab68982e6738cd28d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602771, "uuid": "1b3f0541-807c-4d22-a705-4f248e0ed577", "value": "T1A7A43C16E721712EF89BC4B07A9592576818AD371188AC6BF781DF9A34315D3E0F232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602771, "uuid": "c0122814-5624-4133-bdad-5d7b6e51d458", "value": "86bf44e6e79fdad0760a653106f14f37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602771, "uuid": "7549df1b-2bbe-46cb-9dd9-c9437a10400c", "value": "6144:jK5nIK54IV2OyPlbh5nf+4a+9vkC7CYfHOn+Re8d1/w5KA81IJ8GpF6nuTmOOU:u3aIVCWAcC7CLn+TjYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602771, "uuid": "17fdcae0-b098-4a6a-a8a6-72855d07f8d2", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602771, "uuid": "c1051bab-3aa2-425b-aa00-268348b81b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602771, "uuid": "47ffa7e4-b5a8-4c16-80cb-c953cb96cf41", "value": "bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992a5072-3fdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692594007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594007, "uuid": "261103f4-2b04-498a-a10e-fffe4241eb00", "comment": "Malware payload (Mirai)", "value": "ef240e2e594f9dead98b624b97baac9b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594007, "uuid": "68fe34f2-1101-4b44-b979-ec753b8e83ba", "comment": "Malware payload (Mirai)", "value": "c0bc0a7d56bef7b29fc86ffaba2c10136ecdcd6b6efa6366838b90e6275d707b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594007, "uuid": "c144fdc0-9782-4303-8529-f61e4b43234d", "comment": "Malware payload (Mirai)", "value": "cbfb424cdd309004d1e563cbb32b567587b4080b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594007, "uuid": "2e3f7721-ac05-45b1-ada2-36f66778c83a", "comment": "Malware payload (Mirai)", "value": "bcdf37f33f8bab243653734c19ca69919caa1f49c344909df58abb459dc9046d7cdd7c5484ae45095d06eba908a71f73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594007, "uuid": "a8648339-40f3-4b32-9ca4-6185e9bb47ea", "value": "T1BF6319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594007, "uuid": "7ec7f867-756c-4ab5-851b-37263d932dc3", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8+M:GbtexU0r8QCKw2Fbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692594007, "uuid": "af81e4ab-6002-4488-83ef-743669c28867", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692594007, "uuid": "789c244d-3d53-44c9-a0bb-f8078c48353c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594007, "uuid": "4a4a7a9f-1c5c-44f5-a837-193ca0ac171f", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfeff22-4026-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692624479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624479, "uuid": "708322a5-271e-4243-ad6d-b42d5c7757b6", "comment": "Malware payload (Mirai)", "value": "17f274dd0665508a0b748ec0168b983f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624479, "uuid": "64f1c9a9-8ab8-4d65-bd43-2ae603c0a1a5", "comment": "Malware payload (Mirai)", "value": "c1bc4ea1d8a856387e95ff72677a41fbbd59cb12a5d4e7a4e3e78bdbc5c0d40e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624479, "uuid": "eb275201-2cac-4121-b455-31f26c310d71", "comment": "Malware payload (Mirai)", "value": "11e8e21f8c261005abe14b75ea1847ebceed1eb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624479, "uuid": "743e3f8c-4e0f-46d7-a90b-5c50bdd03931", "comment": "Malware payload (Mirai)", "value": "5cdf3502012d3b32bca62d9ab50d43d0f5e89205f9431eb57696360caf25787fa747707f77daf66e53fa5e0ef5fecffb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624479, "uuid": "7c694db7-8886-40b7-acf1-fff1faa20140", "value": "T1F9C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624479, "uuid": "a86d7f95-f42f-4bca-9543-21fbe9382438", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPxL7ymm/QMurB1nKGNb:SMQplVxamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692624479, "uuid": "8fffdc8c-20be-4bbf-a3b1-70646893b118", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692624479, "uuid": "a83a8aeb-bfea-4a7e-ae2a-8796fc84f91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624479, "uuid": "3d3b448a-06a1-40a1-a088-abb6b56ed8de", "value": "17f274dd0665508a0b748ec0168b983f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12450196-3fdb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692592063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592063, "uuid": "f8604cf7-26e1-43f4-ae62-c3f077dec505", "comment": "Malware payload", "value": "dbdb6a746f8ff65d33c9182a61ef8921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592063, "uuid": "ff1023c5-ba80-4da2-abe5-f58293940496", "comment": "Malware payload", "value": "c3a4821abac34ac8322f7ffbccc8801ba1afa5fd43dad7b0401078f68de99a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592063, "uuid": "5eaeabfd-62f9-413d-b379-5e31e42dc0b6", "comment": "Malware payload", "value": "ef5b171a2948d96ee177cc0255bb20aa346574f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592063, "uuid": "ec7e510b-ef86-4c89-a20a-2a1817e9548c", "comment": "Malware payload", "value": "30a9d759e3cdf53559295eb3197fc063de2a1c93d490da09e7d51b258e147acafd7b466c425944674d5228cc05150123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592063, "uuid": "33241a24-2134-4774-a75c-1a12d472013a", "value": "T1E5E4126069EC8FABE176CBF994B1210003F525125873E79D4EC720DB69777428E26B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592063, "uuid": "ad859e6f-3c7b-4b5f-9e94-5fc753d1ecf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592063, "uuid": "206af00c-1bfc-4612-9fcd-66b286775cd6", "value": "12288:nrOh+xGb/8iZHJdwKkHpv3gGcRMFi8WZQCJHAwr9WIvkWjSHmidd76CDro2:Kh18iZHwLgBRMFiZZdHAo9WI8H6CDro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692592063, "uuid": "3309acd3-bada-4d3d-8fe5-aeb935adb182", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692592063, "uuid": "984f01b3-bd4a-4daf-84a0-ea6476104163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592063, "uuid": "33dcce0e-688f-468f-ab3e-b3aa4edda11f", "value": "SecuriteInfo.com.Win32.PWSX-gen.17816.19326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07f58a9-4067-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1692652511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652511, "uuid": "9d835004-acc1-43b2-9e57-3e3be02c72db", "comment": "Malware payload (TeamBot)", "value": "05ee766764895b57a45ded1f72bdc5cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652511, "uuid": "f4ed19a2-7c93-4198-8ce0-ed36c1ae6700", "comment": "Malware payload (TeamBot)", "value": "c66485721d614838d276317700f0dfc98ff9605bf9e1d1b78de4c44c326061da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652511, "uuid": "1af91ecf-f16c-448b-88b9-7a02957b0acc", "comment": "Malware payload (TeamBot)", "value": "289fa810ae56ed436469ca2e63dd369b74d95723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652511, "uuid": "df5acbc1-efe4-4a79-b4d4-2761242e8a38", "comment": "Malware payload (TeamBot)", "value": "743aa89951eea665f306b42d358ba08ee87170eb4d7b5cc4fd31a3e185d772cabfdff6066171a98944646681981191eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652511, "uuid": "365e1643-dbed-4bdf-9d12-d2178b45435a", "value": "T14F34BE13E2A1E871D8574A3DCA2EC6B476AEB5318F85DA5723185B6F0DF02B2D277301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652511, "uuid": "4d70d8c7-3c40-4408-8384-f681461444bf", "value": "83f305571af3bad4fd0b459ab4b0a012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652511, "uuid": "2b723b67-27ba-46a6-8741-6e95db5ab43c", "value": "3072:eLtZvLuWWX37DO/0yFrwhN0hsfr3VctpwBq98kWbujmT5XLQ9:aZvLWX3720yFXhsfQpZZWbujmhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692652511, "uuid": "c8f4b0b7-f24e-4f88-84c9-e8e062ca2e57", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692652511, "uuid": "1bc27427-d7bf-4be3-90c0-c66a57405030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652511, "uuid": "b5ea713d-cd2b-4b8e-98dd-55ceda44c018", "value": "05ee766764895b57a45ded1f72bdc5cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb0e8e2-4024-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692623729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623729, "uuid": "63a81bbb-67d2-42c4-ad79-7812c8a866ee", "comment": "Malware payload", "value": "85c70d925ba2f8ab6fc5d5daebdd7860", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623729, "uuid": "38b6773c-bf54-4758-ba40-97e40222ea8d", "comment": "Malware payload", "value": "c79815d59ccd995e540608e9fa002ae42e95f62a6b5b1fe791ad49d31d679398", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623729, "uuid": "5826019e-ee75-4489-876c-1e1217883c8e", "comment": "Malware payload", "value": "674f6abc8423698766a63bddb17d1559c6f01cc4", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623729, "uuid": "6683ec36-fecb-4284-a642-0af0bc20e728", "comment": "Malware payload", "value": "c274508b60a3dbf6dc5311759f5a34fa84b09ce82745c85bd60932604f615adbda37230020d6d9ea10a20d3d2b857442", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623729, "uuid": "6ffe41bf-e751-46d4-b1a0-bd407838b409", "value": "T11E4165F1F727C1C44076A677DCA7908AAE7880AD002155097ADCC9D9ABB1D60A275F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623729, "uuid": "2a73d94f-6673-4d68-8ce5-7874ea5cea67", "value": "48:1cOAqUkr1Vje11Z9IYb19Z/cPFFpgfqpg4:1ZlUkrLGZB191C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692623729, "uuid": "8e13661c-1be1-435e-b085-4d1c101cf220", "value": 1958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692623729, "uuid": "cddbb5f1-97f3-404a-902a-ccc2b5b8822c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623729, "uuid": "334eea48-af78-43d8-b4bb-dd57878e1604", "value": "yTj0n5qu.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f593b69-3fc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1692583119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583119, "uuid": "1df4742b-a30f-4d54-8922-7e035fd15b99", "comment": "Malware payload (CoinMiner)", "value": "d614315f62c2264d1fed72fddc6f9d36", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583119, "uuid": "8db4e261-fd5d-4cd3-b8d2-5403feabc2d2", "comment": "Malware payload (CoinMiner)", "value": "c83d9ac2faf97cf8fa022e2704b2acbb2e10cd049a6361c8679b29cda53c86e0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583119, "uuid": "b74775bf-3e50-483e-b4c7-a5825fc9b3e6", "comment": "Malware payload (CoinMiner)", "value": "925515b62c919c330c649436cd1c19d55904e500", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692583119, "uuid": "1c16d380-1aae-4330-a9df-383c4a825063", "comment": "Malware payload (CoinMiner)", "value": "d464f35b8c7d90e0fa89e4f9517e9425e439bfe7d326e70580551e8e79691fcf202b082a29e191f3378229b320764e73", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583119, "uuid": "6413f189-a83a-40c5-ae4f-675ccc305813", "value": "T17056DF13E119ED42F79A7EB57AFAD544C030A7A375F74228627D0AB18D0C2DC8D316AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583119, "uuid": "f3785335-ac01-4829-b7eb-fa62fa779944", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583119, "uuid": "ef91a6b6-29cc-487b-8fdd-2482b4135631", "value": "98304:rwenEHwqqjx/q2fMIITAw7KZUCmavPlfSV8cVdEEw1:rXEH+FqJ7K3Tv5xcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692583119, "uuid": "b50667ac-76a1-462a-8936-0106c525cc90", "value": 6029624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692583119, "uuid": "091ffa87-f3ea-4681-af2f-3b29e2b7216f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692583119, "uuid": "92a30b3d-c322-4f00-8a02-6f815e5b2214", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4bf91a-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610284, "uuid": "08c64122-874e-4855-bd81-80b3eb55d492", "comment": "Malware payload", "value": "a71df40a110816c166da52991c858cb6", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610284, "uuid": "06e9efe7-1a8c-485d-8622-d5f006e8682b", "comment": "Malware payload", "value": "c89a9d9bcf31965c1d0cb1a80cc0269c84aaa368c5d2457262396a4f87ead940", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610284, "uuid": "4182fa35-cb95-4bf9-95ee-c97595cdc03f", "comment": "Malware payload", "value": "438cb6b47b97376d907da0f38c30d46b82ea3065", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610284, "uuid": "8dbf62ae-4030-4d97-9670-b1bc101bf230", "comment": "Malware payload", "value": "bf2cd9612bcbb1a258e370ac7d7580e69db06ab4d9d5fd3aac0462c41f31eb83ec1bcd2ccfa7c1b7fc87bb81aecb0c2f", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610284, "uuid": "53a06622-a46b-48de-ac30-d1fcab2ca1a8", "value": "T1D131B2331522804C9EF24C5D637EA77C67B3C4183BA4D7AFA79849A85C02A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610284, "uuid": "db20fe34-87bb-46f5-9bc2-097780593cc2", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlJItakK:4oyeP9YeYaMImCmlItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610284, "uuid": "620297ee-ea80-476d-a452-9d15471c6cd5", "value": 1791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610284, "uuid": "fdaaac0e-2bfa-4e2f-8ebd-c6758c83b53d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610284, "uuid": "b44e5866-a584-469b-9ce7-6d285293d72d", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9668c7-4023-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692623356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623356, "uuid": "c75503c9-40c8-4b06-9b4e-a8882662c4f6", "comment": "Malware payload (AgentTesla)", "value": "9cf6063608f250626f2834856396092c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623356, "uuid": "d51c94c4-355c-493b-b9b4-b202934d858f", "comment": "Malware payload (AgentTesla)", "value": "c9e9c0c331d38ad123557f095bf0eb4ee4e11d00a6b39e923a33e18102f91d4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623356, "uuid": "f6225f6a-3192-497b-9533-03f07f58f775", "comment": "Malware payload (AgentTesla)", "value": "98371d8f9c1002fb0f916c99649bea2ce6cae1b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623356, "uuid": "fbc557e3-99dd-4481-a69d-1c64b6e2d80a", "comment": "Malware payload (AgentTesla)", "value": "89775938e59d30a814b67a7293cc458a4b01e29fc6ca1b904e489e1e9f3c208858e1f31e1abfca079712795d3e865b49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623356, "uuid": "729d0925-a2b8-4fc4-89a0-41ccdda1a273", "value": "T11B15D618FA59DA3FE39C8C3950F9DB2B29B99FAAD0F0E351C010517518E6CAD0DB6163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623356, "uuid": "d3286afb-f640-49bb-af35-a981d5784f07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623356, "uuid": "cb1cd370-7826-4597-9311-b6f4e18a5c90", "value": "12288:dHsLMTTxTdyFOILC3KrXwX8dZAg6jumsMT:dHQGdVIO3cXwMzAPi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692623356, "uuid": "e5943154-87b0-4cba-926d-0634f14d0836", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692623356, "uuid": "b6b4c79a-1abf-422d-94a5-7917bbe7da0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623356, "uuid": "d30009ff-845a-432e-8998-2b7582c712fb", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127cc127-4006-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692610531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610531, "uuid": "8eb689c7-348a-4d56-ace6-51afa49ad762", "comment": "Malware payload (AgentTesla)", "value": "8a78998f2b3d91eee64cdabba464edc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610531, "uuid": "f49c406f-bb00-43db-aacd-b0b9249acd56", "comment": "Malware payload (AgentTesla)", "value": "cc0ff94435a883b461d26716d636619c6c670e6e574a2f58ad76f5c1f6de5d40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610531, "uuid": "36012fbc-c81f-41d9-b18b-111c9c6d83b2", "comment": "Malware payload (AgentTesla)", "value": "441193a72939d4b2c229a8f9bacca153d601d422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610531, "uuid": "245c9497-5ba5-4e30-8ee2-cc3dc316e50c", "comment": "Malware payload (AgentTesla)", "value": "109a0d8f69af101b7e06c8a1d0e28384d9e4ccae7372d5ecca71a689ce80a17c4e8a4a90f9a5ce922669c1c17c3974b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610531, "uuid": "9d6f6a44-a812-440a-a1ba-8c907172603f", "value": "T154349B1161FE5188F6B37F521BA964F58F67F6A54B3A925D204C030BCBA7D00CE66B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610531, "uuid": "abf6612f-0653-497d-9f06-ec9a29a2554f", "value": "3072:GiIi8TTomamomzmwmfmpmNLmHTB3LGLamNkGnk9kMk9kQk9kwk9kck9kxk9kpk9w:GiIi8TTn9niP+0NaHTBpOmJrpneXso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610531, "uuid": "596a35b1-7d40-4c6f-b810-2a3bb0bc9d1b", "value": 237318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610531, "uuid": "43ee424e-040f-4152-874b-15e19b650583", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610531, "uuid": "4096e380-b749-4b6e-a187-43de216c97cd", "value": "SCV.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7d7f09-3fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692595893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595893, "uuid": "5861bf8d-facb-4ef0-a3c8-06b831b2084c", "comment": "Malware payload (Mirai)", "value": "c2c1b28cae79318334870d0e3a26635c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595893, "uuid": "8c77a9a0-f529-444e-83d0-f0ae66b86cf2", "comment": "Malware payload (Mirai)", "value": "cc21534a815025fe3e32ea711994ae93f7989681db260c0ecf239db18330bb9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595893, "uuid": "9f9bf6de-067c-44d9-a07c-3aac4fe43dd8", "comment": "Malware payload (Mirai)", "value": "75ccf9c6d9a2b2546e4974ea49cee13d69f954e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595893, "uuid": "f508a93b-a243-4bc9-b1c4-5c2cbfe67f0c", "comment": "Malware payload (Mirai)", "value": "aefdfb4173e45c0f8b5dbedbbfecef6f129b4cf0120545922bd8e0e9ee7f2f851deb0b9d0c76c1d0a815ac31a12c075d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595893, "uuid": "e56210af-f5d5-4eef-9fb4-5edac953ad6a", "value": "T1BC530A817C91AA29C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595893, "uuid": "b96ca537-aff1-4b53-ab84-e7270e8cf512", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzDeMH:dOxkyRWiPkjX0QckVcwLjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692595893, "uuid": "d03b5053-5d7b-4149-ad48-f9c1b25bc3ea", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692595893, "uuid": "70ff445a-fffa-4224-9d0e-176b7e314935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595893, "uuid": "b2c0d191-fea0-4548-afe5-cd0dbab021df", "value": "c2c1b28cae79318334870d0e3a26635c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8394b7-3fe0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692594445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594445, "uuid": "20e74804-9808-44cb-a20c-aec865af5d23", "comment": "Malware payload (AsyncRAT)", "value": "9110b8fc5527f8bc9606c791d98b7c60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594445, "uuid": "381f431a-f331-472a-9b57-f0924b56bdae", "comment": "Malware payload (AsyncRAT)", "value": "cd6f1689432af870c144f52458497cf59a85d4423c517eff6d63c35d9de97913", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594445, "uuid": "23299109-b95d-4113-af9c-12346e80a214", "comment": "Malware payload (AsyncRAT)", "value": "0bb18e805dfa000fcce1243e1b1c02c4bbdcf4d7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692594445, "uuid": "12e89ca0-24e3-4a57-8a59-e3422d8809eb", "comment": "Malware payload (AsyncRAT)", "value": "d6aff347fc6b922ff7c7f298a290cc2017a2a1554e1be8766875628f80b31f8ac163c57b300b5cdfa07c6904515c577b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594445, "uuid": "af0a7e7b-25a9-4aa8-a14e-5fffebde463b", "value": "T14B435B0037988136F1BD4A74A9F2D2658275DD272903C65AADC53CAB3B73BC586026FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594445, "uuid": "eb663602-007d-4a65-b255-326169b74ba4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594445, "uuid": "f743809b-a789-4401-97c9-d29b39d42561", "value": "768:Eq+s3pUtDILNCCa+DiAxxJgDHwRdCiN8Yb8gelrKavEgK/JGZvWVc6KN:Eq+AGtQOAxJCHwPzbT8KankJ8vWVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692594445, "uuid": "48b0bfcd-3d33-4957-8907-b794279f8114", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692594445, "uuid": "b9010f9e-1a3b-472b-b2df-ed1183b1ff2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692594445, "uuid": "6882b938-a9a3-4c05-b53d-128292ce8e2b", "value": "bPbg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945f08f8-3fc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692584121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584121, "uuid": "0a28f373-6859-4d2e-94af-f1a4ec55439c", "comment": "Malware payload (STRRAT)", "value": "08e91c2adc6af9c39bcf4f70ea7c115b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584121, "uuid": "8a0119d3-fd0d-4ad9-83dd-bd1ae72d3a06", "comment": "Malware payload (STRRAT)", "value": "cdcf032b414681daa7515f8cff0fd4a8566e875063a214bb86b197c3c32be56c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584121, "uuid": "faee4ef5-2c83-4152-960c-8c1dcf151684", "comment": "Malware payload (STRRAT)", "value": "c8c58442be4614a07370d2f705430e79df36e8f5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584121, "uuid": "c6d340dd-b1e6-4a71-be02-ae42c287d5c0", "comment": "Malware payload (STRRAT)", "value": "b7f054c2095b254ace98af5d89508a035cbbc2447f44654f88417480b91c0651b04288095768d93db0fe1b34365336b7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584121, "uuid": "8c6def90-8ac9-4ba6-8f8f-c49dcc3b0817", "value": "T1D724F16B3EAEC2F9D0579CB14A408962629CC1E8D001E55F2AFD1C968DB4CDE0752EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584121, "uuid": "60c119c3-aa62-4b21-9491-0d10757ca636", "value": "6144:Ge3aF7EIXVReqhbvjwbh+meHy84qAEoTX:GeKWIXVRDhybqy84wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692584121, "uuid": "c4f5e418-658a-4364-9390-687f42076842", "value": 214066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692584121, "uuid": "15beed1d-4927-4b37-be38-b5397081a98c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584121, "uuid": "6aea6729-01df-47f3-be9b-0ee0a775ff33", "value": "Voltmatic Trading Company Purchase Order.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c7a633-402b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692626405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "4cad53d4-931c-4809-bc54-b0cd2670d615", "comment": "Malware payload (Mirai)", "value": "580f0aecb549fa7425c8d142eb64644a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "9d42d197-f1a1-402b-a5ef-24bef3890957", "comment": "Malware payload (Mirai)", "value": "cefd223470d9c6e9458b9519ba504370ed12c5129a79bbd066e95e9d86179e42", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "3138cb0c-d379-4835-b9b4-ac3d7a224730", "comment": "Malware payload (Mirai)", "value": "cc7c5f136af769921ff8f25758b260454c67bf48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692626405, "uuid": "09ab0ad5-eaa0-43c7-8b2a-e346e2136c56", "comment": "Malware payload (Mirai)", "value": "51377d81c64b829cecc79472134b6c37b89f8ebe313de9cb19eb42523bd70ebb3f728b6b4e001887ced052d506139452", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "01db1815-7d50-4f5b-b0c7-9c5dcf7e6c3d", "value": "T1F7A2D11172A32D66F3DD1C3DC9AA8317B9670BFC90F6327679815520C94D24B3E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "de1665d6-b7f2-4bfa-80ba-58a2eb6ab882", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjmihymdGUop5hW:UvQn4j+ZO5fKAlxqis3Uozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692626405, "uuid": "d6374ca6-9694-4e16-90c1-1152f08cf48f", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692626405, "uuid": "60d6317a-0bef-44d0-8872-c7f1b54e9553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692626405, "uuid": "ad8ed77c-5b43-4af0-a818-a535e893465f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c122ef-4029-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1692625677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625677, "uuid": "2da729b2-b001-42c4-8986-1f4f00d4212b", "comment": "Malware payload (Fabookie)", "value": "68f6c654f3b3adef19c169283d27aeb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625677, "uuid": "945b1c8b-1c3e-47ec-b523-2d96a4aee2ea", "comment": "Malware payload (Fabookie)", "value": "d117e234ed8a65fe05b3e3adbcb47f04be934572084706b86a3ba5a42eae2629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625677, "uuid": "66fc7633-f5e0-4f3e-ac23-08246962e22d", "comment": "Malware payload (Fabookie)", "value": "2bda6cf502295ac1a2a5df1c450ccac14e302b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625677, "uuid": "35910931-9fe4-4006-ba08-ab93fadc231b", "comment": "Malware payload (Fabookie)", "value": "378e3fd1dc8e94087f42cd0ff57e1b61c6e62f81d256d562b1621220fad638e393adcc50df1a73aff3d47ac001df22eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625677, "uuid": "406e6761-47ae-4e0f-be1b-86fa6e2c32bc", "value": "T169742881B3DA4038E072C679CEB1C263EA767C155B3096DF07609E6A6E73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625677, "uuid": "ce70ae7e-9bf8-4314-87fc-a3a9f35c974d", "value": "ce0c54abf9cb1706cf3f091f1f306b7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625677, "uuid": "cfc5f53f-6a99-4d21-aad2-99fd627085cd", "value": "6144:zFw8RIT6Fam4StJ3rXDW49Wr7SkDcPiaODgKYleQ4S4P:zPdtXDzkJXMAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692625677, "uuid": "6831ed7c-d128-4d2f-a8ca-39aa839d056a", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692625677, "uuid": "ab40a92b-b99f-4c4a-b44c-c0614e92be08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625677, "uuid": "4bc352f4-2e05-4d42-892d-af1a7803273d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa692110-400e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692614222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614222, "uuid": "54189e2e-7c07-46ab-82fb-4be7d0e592db", "comment": "Malware payload (SnakeKeylogger)", "value": "bfdee5b2ac7c4cb3a400f6bf0b0e8883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614222, "uuid": "2b391492-94c9-4c84-a1cd-5eeed510856c", "comment": "Malware payload (SnakeKeylogger)", "value": "d1e61f8292f9452e5e75ce71c8af143e1406326c77bd863cc93fdfdb319df2e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614222, "uuid": "be23574f-24a2-4c72-b086-0ceb39d0f171", "comment": "Malware payload (SnakeKeylogger)", "value": "22fa9c6fc6d4421118f861bc8f52e4668ed1bdad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692614222, "uuid": "046b0269-6964-4597-8c09-ec00aa75d0e2", "comment": "Malware payload (SnakeKeylogger)", "value": "ab4b18ab9b93a400654c0e2c3e82f69b10a87d348c632eca81a1cdecd9b1bd74aba950f0843d422523b472e23a9c6c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614222, "uuid": "b4a4e2cd-2751-4082-bf69-7f1bad6f854c", "value": "T114B207146E29C437D6A845B948EA438C1278EE336856F79B4DCCBB563C37BC1D8824D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614222, "uuid": "97014bb6-4ae9-4d43-aa2a-39f737f055e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614222, "uuid": "e72048aa-ae52-4a87-906a-fa88cadc8fc1", "value": "384:L3xClkRKwBHezlp6ihnoRf6g2aWk/QaCsLweV88afXpBC88aHXpa:1p5ezlp6CgUe8fXfRHXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692614222, "uuid": "4dfdd1a0-42f9-4f8d-8663-406dd8d84bf5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692614222, "uuid": "148b2ca7-d3d3-4c25-8ac0-b37c84e23d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692614222, "uuid": "a8867a98-29b4-404a-897e-8df791d84684", "value": "Diizc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dff3fb-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596235, "uuid": "bcdb7306-8ec9-4a40-a0f4-08d9f722b6d4", "comment": "Malware payload (Mirai)", "value": "8f7284d0f2316a5538e2667bf3163c7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596235, "uuid": "733edad8-7830-4914-bc56-35ce2367d7b0", "comment": "Malware payload (Mirai)", "value": "d31a122d3336c4b8b2d5d8ba1b4b103ceb9b3add15f6c3ec2ad6d0fa39f8ecff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596235, "uuid": "530249a8-0a61-46e4-98fa-b4b3eb8c642e", "comment": "Malware payload (Mirai)", "value": "ffdedcf39289d5098e035e793e85f68c4d7ba810", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596235, "uuid": "ee8f61aa-0ee1-4ebd-a013-6044777bf3e3", "comment": "Malware payload (Mirai)", "value": "bfad7c19020530eef0167c44d981717da605d46b721c2796ac42cea9178f27c72992a55818a02584edc6b417b4317f00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596235, "uuid": "f6e18885-6e34-4b5f-944c-1586b248b037", "value": "T1B1D2D08D76D363F68C8DC6BEB35E003A709E74E9A6B19323B305D5530766180F651E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596235, "uuid": "64998ec0-7384-4f38-a5a3-ef43afe105b4", "value": "384:MPd/PxEDLd2TwULzm6lowYcEaqsp9qC450LQixBfE4jdlz0lewZ90BKRgQ/KXNya:klxKd2FLPxEnspd6IHE4RlY990iggKka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596235, "uuid": "17af7370-62e0-4006-89ae-7704620a5d0c", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596235, "uuid": "e6a95718-21ef-4a1c-981e-ca24b90e7bcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596235, "uuid": "904dc7d3-85a6-4073-8cd2-bb85b3a10cb3", "value": "8f7284d0f2316a5538e2667bf3163c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c18527-405c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692647445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647445, "uuid": "ce9ddf2e-7b68-41fe-acbe-22dbf9ff1a2d", "comment": "Malware payload (Mirai)", "value": "59dec3ad89fb3d2b59a010083b41ac88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647445, "uuid": "6de2ac22-1e3d-4310-ba42-b91264e62b28", "comment": "Malware payload (Mirai)", "value": "d50351f70b6db77de7898389d1676f8bbf5c941e4823382c9bd5e6daf305de08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647445, "uuid": "4c77505e-ad59-4ff2-b904-6e6fc98eb732", "comment": "Malware payload (Mirai)", "value": "ba57085c8b8cd8791c945d0c09bd7f9d2851ec41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647445, "uuid": "10e79cc6-3441-415b-af3d-4c8a3685eacc", "comment": "Malware payload (Mirai)", "value": "3cf0bc6d0188ad7d914cff372c61a1c9c4fae32efb13b76315d44ae1dbb7638776af6ac711aa176f59dcd3c3405a6b62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647445, "uuid": "df686821-c4ec-49ab-989c-6cdfa57a993b", "value": "T181437D26C8299D94E10DC634BD784E741B23F00C9626AEF69E8786964053B7CFB993F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647445, "uuid": "73d834b3-29c6-4de9-b2d6-cf2cf229a922", "value": "768:XZame9eieaqteKc/ziVjwtGzdn048K86UwyFN36UVfvrC4CkoHuLC8e+79yfX:JamM33wa2VwtGGwyFN36UVHfQOLC8el", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647445, "uuid": "d8d9b56a-8fbd-493a-bace-8a386fdb41f6", "value": 56000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647445, "uuid": "b42c12c9-91a6-4c74-b54a-d84337937162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647445, "uuid": "18df8db1-46b1-4b97-8866-91837fb90aad", "value": "59dec3ad89fb3d2b59a010083b41ac88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902a52a7-4024-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692623627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623627, "uuid": "7d7bbadf-0acb-4ffb-8107-7e88bd81aef8", "comment": "Malware payload", "value": "fd7b85c840c1b3741d3b9966d3fa2929", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623627, "uuid": "709022ff-0c32-4d6a-9f88-ecf81fa20989", "comment": "Malware payload", "value": "d5373acb39f7d2ccf316d650f0393e2723d897da2ee72699336438412501e12e", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623627, "uuid": "8f7f273d-6a71-43ac-aaf5-a41a55ced579", "comment": "Malware payload", "value": "826fb22e8186c8ef770b3932978c0194f0255f5e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623627, "uuid": "a3e2074b-7f1d-4ef2-8dec-9f5a9e5e9559", "comment": "Malware payload", "value": "0b72527271e3913fa5e91c7fceee23a8ebd5df206eaeb42f962d1d8baca80d1dfd23579d613b19ce89043dedab46277d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623627, "uuid": "e1418cb1-d857-4094-99e7-fc21b2f0d61e", "value": "T15211DDF65B1E5012C9B9CB421D57925ECF6081A258D40B05B8FD4E74DE39123A35EACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623627, "uuid": "eafb7564-71b8-4230-889c-ab077c5bdfcc", "value": "24:DOVtyCijVhpgsFTxnswvpdPNuR71q2z8JAh/:DOVtyCijVhqsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692623627, "uuid": "925a9d2f-e646-4665-a674-d242f630dbef", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692623627, "uuid": "f6fef570-66ee-4c1b-bb76-0ec076354434", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623627, "uuid": "8b1dc934-ef36-48bf-9aa2-938068107a67", "value": "pN2Gqn5j.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efda888-403e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692634738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692634738, "uuid": "cd63c76a-93a6-4484-9cc7-bfc449c0a582", "comment": "Malware payload", "value": "08565ce38c9247749247979f0117ddf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692634738, "uuid": "39568f28-7c4d-44a3-a43a-3a516aee3556", "comment": "Malware payload", "value": "d7d47b0b0aa55363efdf394d4c3ad4dc6e175edb80e22ae6e7b37cf3bc1d32d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692634738, "uuid": "ec31e29e-c78e-4cf8-86e0-36275f054d23", "comment": "Malware payload", "value": "50ae0ed33485a673e57f74d126eac70b9ae97dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692634738, "uuid": "4870b9a7-a003-4d94-8d86-f16305bab213", "comment": "Malware payload", "value": "b35ebdd464cb817325ca07c4ab2290de77d716d5ee7d80dae681fa61fc680cc21f36ae8740a0709f35438cbb1704d566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692634738, "uuid": "b3ddd90b-5215-4fb3-b463-0b5dca8a05c4", "value": "T10C55D025B2A44476D156BD7A8C17F3F8852E7D222974ACC22AD57A8DCF36373B8180D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692634738, "uuid": "0b9c9a14-508f-4573-a841-318d69438133", "value": "6d93e702d29a5a3decf1d11adcff6a32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692634738, "uuid": "6231a4db-b12c-4c5a-80ec-66b7c52891df", "value": "24576:s+RGJCckr7y+lf4MkEYHHMsxIdgi0CGxMKNK7:s+XHQLMUSgifIMKNK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692634738, "uuid": "b79f136d-358e-407e-8736-4a48aa26bd1b", "value": 1366528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692634738, "uuid": "ae65e6b6-e1ac-4563-bf23-5bf24bd5a13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692634738, "uuid": "c02eb726-6b3e-4a74-9f33-02b59c550f21", "value": "Xjwfktyw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11089370-3fdb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692592061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592061, "uuid": "ad988527-8c6b-4523-a032-49c0c183168b", "comment": "Malware payload (AgentTesla)", "value": "fdf1d0cdbeea64ca6a6eba7f0fac58a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592061, "uuid": "dfd3771e-31d7-41a7-a709-dc03943a3f5f", "comment": "Malware payload (AgentTesla)", "value": "d9790b25df3e792b4af4dbda1962f7bfb884eb3491f68db19249061b8441a126", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592061, "uuid": "e5392717-b580-463d-9df0-124a634d46b8", "comment": "Malware payload (AgentTesla)", "value": "bd693b28de6f687c3a713f2e4ff58b39e2c6560d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692592061, "uuid": "caa8ba85-bef3-407a-b7c9-149f822694c0", "comment": "Malware payload (AgentTesla)", "value": "1c5ae1baa9ff860a1356cd2a235a92b497f45afccaec7f1a514b81b6047de23abc778a35009413f109c97c6743bdd9e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592061, "uuid": "cc846969-b29f-4b98-a2f1-07fca0180a51", "value": "T1FA9228277A5D5670CA26CF3AC487E44207A2E50374B3C60EB44B230A28437EAEF77785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592061, "uuid": "adb92bd1-0849-4685-895f-db094cadd642", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592061, "uuid": "9db60f1e-2664-4aff-9b15-8a8535fc24ac", "value": "384:8KO55Uim6ebuC8cOkd4gvbH3R9BuG2hJntugTnwqKfq:mvUizeKC8xgvLtKJMmwqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692592061, "uuid": "ce1918b1-57c5-4832-9e06-f3f0da566752", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692592061, "uuid": "87823197-069a-4a16-91e2-8fc6eff98444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692592061, "uuid": "2c3a8d25-2bcd-46fe-aae0-dbc4d5fad3d5", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.HJS.gen.Eldorado.12185.30777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6eb128-405b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692647404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "21612479-3c2f-47c1-b3a9-c5c62ed044a6", "comment": "Malware payload", "value": "3d819cbd845d3de717f02fbb1d273d4c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "63c0af3a-f359-43a5-bbcf-9e41b7d34d3a", "comment": "Malware payload", "value": "dba50a90c11df27867455911730dc85c1ab03057cd5a0e0b25857599222cb393", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "ad2380de-c0cf-490b-ad5c-519abe9d53d6", "comment": "Malware payload", "value": "35b9a32172a89317c7c8c04c61236b51575185db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692647404, "uuid": "9accfba5-29dc-41b0-be01-c42b53d3d632", "comment": "Malware payload", "value": "7855f1b57d021148dcffd507117d3e54a8e05628418e6c7b456b2a1972643a95eed88e450a05f79caf3547298376f6b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "846146d0-0f09-4bd7-b5af-2d00fa355fe0", "value": "T183E2E15926523870DE6390B111EF1BC1E4780FE6BA9B4C0BA571ECD6CC93265F873E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "4ec6b2b1-4d45-4cd7-bb82-249d4fba275b", "value": "768:zwKWQJwNhPAlYvlu58kaOw2eEx039JgGlzDpUYskB:DWOwNo58UwAx03XVqYDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692647404, "uuid": "0b07fbb6-f396-44a5-8ffe-84dcf1222f4b", "value": 32888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692647404, "uuid": "bbcb5e86-c6f0-4d36-8509-4035f18fd952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692647404, "uuid": "0d028e50-19b8-49ea-bef6-777b4c1361ca", "value": "devx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d140377-402f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692628159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628159, "uuid": "9988cc09-945c-47e0-b69b-c9111c6e232f", "comment": "Malware payload", "value": "6ef2667c08165b47c54f99d63027a79f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628159, "uuid": "d1dc6494-3c8f-43c3-8327-64fe55badc57", "comment": "Malware payload", "value": "dcf3000bdcc1eb1c24fdd8feaf057d9c9b1c4fd9af7887361ea8da91dc475aa9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628159, "uuid": "1786c1f5-e9a5-42c9-bff8-4550d1fb8cf1", "comment": "Malware payload", "value": "c7495e2861d6ac7821cec07cb1b36a70afb3ebd5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628159, "uuid": "83d53016-69b1-4d27-801e-61ff8c387845", "comment": "Malware payload", "value": "e39c2dcc54c7b2e6f99d4e12e078ff03794f40407e56c2bdd0b8857993af1dce4b272c8033f3dcd391f6b18c6b11671d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628159, "uuid": "15d8419d-05c7-45e3-b6ca-7cca18881eef", "value": "T170C4120177DDCF9BE16F52398683E689A12AEC991E01DF6B78E1B70D6C343353C0A5A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628159, "uuid": "24f11180-3798-43d4-a596-1f34d25afe57", "value": "12288:XC79BbmKy2AfG3CQ7nKS9LhS8jWxZIVEs0Rk4q:XW9BbmXGj9LCxaV6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628159, "uuid": "ce119bdc-f55c-4b16-a2cb-59484d8c285e", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628159, "uuid": "c34fdf5b-d223-40c0-a3de-b6fe2beac453", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628159, "uuid": "8cfffb45-cad2-4fc3-908a-f2b42ae497ee", "value": "New Order Inquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae91a81-402d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692627538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627538, "uuid": "721524b4-6c9a-447e-900b-223b446c286b", "comment": "Malware payload (Mirai)", "value": "75a506ad591742b28c259041f53730b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627538, "uuid": "b93ffb6b-201d-4e2d-a059-5ec8ae264ae1", "comment": "Malware payload (Mirai)", "value": "ddb41d92740bbce395b9de3ef4b1aa3403a1213ad014cee6cb23ced8dafaa24f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627538, "uuid": "9da7b3d4-3c61-4b08-a156-2428fe6988d5", "comment": "Malware payload (Mirai)", "value": "ad84f82f6b9f1ea5c2f81c3288268572528aa3a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692627538, "uuid": "ce5524c3-ae12-4f30-8d15-d48ef75a7db2", "comment": "Malware payload (Mirai)", "value": "12e06f9eb006ba0dbe90e8e26846847e1a8ff21c4334d43890770eb66f551b79a763cfdca04866bd400657d11b3f6487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627538, "uuid": "60145c29-f527-4519-9a48-e71193e1e3a7", "value": "T1C3A2D019BF2C828BC836293555E9E6D61356FC71F29DDC092940C16FF0A33AA2870E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627538, "uuid": "209f68e0-8278-4baf-bd1f-6dee05990316", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTh:k98o08kxofBE+ZkXaITbp2F2TWul0c51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692627538, "uuid": "9fb0daf9-7405-491d-b08d-2f4ce03bcd22", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692627538, "uuid": "b00a94a0-0e9c-4384-b8b2-7df9888d981d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692627538, "uuid": "e4b1e866-a932-4bf7-9c24-04f9eaa2880b", "value": "75a506ad591742b28c259041f53730b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a76367-402f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692628519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628519, "uuid": "cbc8fc9b-61f2-43e7-8d41-96c5decb9c8c", "comment": "Malware payload (DCRat)", "value": "334556209bb6211756fb1c31c1f2bfb3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628519, "uuid": "e81e9e49-7022-47a3-8fd2-1c69f9bc7714", "comment": "Malware payload (DCRat)", "value": "df6156a04af4a695997f7374cd92518c4d27978cc2896ed071fba96fda7a918e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628519, "uuid": "3b34ebc1-7ec4-4394-a1f4-88185ec9f39d", "comment": "Malware payload (DCRat)", "value": "6152d05238af661cf65eeef7dbcc4624a649a868", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628519, "uuid": "c1b66843-15b7-43e9-8b1d-247121eaae8b", "comment": "Malware payload (DCRat)", "value": "7020e064acbfbef7d6d8445af94d7f7a5724aeadd8250f9cc361103ca48f3fa8afa537b4d8b2ce9d512bfa8f28437d4b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628519, "uuid": "82913b3a-8a5a-49cf-8936-6bafa21ad9f9", "value": "T10CE5333067D0D079E91777724F2582A0A92BF8212F992ACF7793932F5EF10D0DAA9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628519, "uuid": "cdf3b999-d297-4a68-8da8-2e015f13850b", "value": "a58360eb10a18d5dc70efe7d39616fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628519, "uuid": "c6997aa7-7b10-48ed-80a4-936395e686e3", "value": "49152:3IA3qVqlpaOO9vgqlIx6Xd8HTWHkJuwi+DOWBfY2LN3bm2ErJgzRqr5OV:4ADPOBCU1ko+C67d1Er+zor5OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628519, "uuid": "6f624c10-c7f2-43fb-a912-923cc211ffa2", "value": 3055616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628519, "uuid": "54717b68-bc48-449f-b9eb-1345d1e1348b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628519, "uuid": "d48f0a14-508c-4bb7-aa7e-55398b57e374", "value": "df6156a04af4a695997f7374cd92518c4d27978cc2896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0343c5ad-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602775, "uuid": "f985d0e7-7686-4242-b0ac-d60c54103449", "comment": "Malware payload (AgentTesla)", "value": "abb06c99920f6b7a0fc1b1a8fb329d3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602775, "uuid": "88b6d42f-b68e-4f55-9171-d53faecefe4f", "comment": "Malware payload (AgentTesla)", "value": "e0c3c6252a6d0fd8979a30bafbf4d41cd9d0868ac1a1b72fa7165d1761d68fd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602775, "uuid": "3779e99a-424e-448d-ad35-7245301cf438", "comment": "Malware payload (AgentTesla)", "value": "57a5e9dd27948147935710b5e299d83fafad3f93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602775, "uuid": "177e1f2a-f808-467d-b325-01b7c0e1e574", "comment": "Malware payload (AgentTesla)", "value": "3d83f02803bd6120a9da721618679e324cee54e30a0f46c24222d9e728f13ec7a276bf0c6b765b5158847b1bf857c060", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602775, "uuid": "18ce65dd-5ff7-4424-b233-3aad839accc8", "value": "T19B15D53CF616DB2BD0CC8CF988A5192FB9F99CADD0F1B3A5C173C1A85BF981045A6452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602775, "uuid": "13f87253-3617-4df0-9a6a-1c6308725acf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602775, "uuid": "8bd01bed-6127-4590-8d18-06235e8bac0b", "value": "12288:9+70pKXQl2FNGprSWr7Kr1gUfCG92I/R9d2+pCZ9GPk+hU9:E671g9higC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602775, "uuid": "cc9b2ccf-4e19-40de-88dc-4949e8a0c6c0", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602775, "uuid": "39b639b8-5ad1-487c-894b-7152b5982568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602775, "uuid": "e575183f-8da4-40d4-8158-7d43bea9afbd", "value": "Invoice & Packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f3d06b-403a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692633195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633195, "uuid": "5254b4ef-ac1f-4ccd-bddd-df23830ace81", "comment": "Malware payload", "value": "b8cfa222736bb2e4a133d5f2bfa54cb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633195, "uuid": "c4e4972b-7595-4885-87e3-df47a8b6ab36", "comment": "Malware payload", "value": "e143f931ee42c00b0132a92d8ee6439862f81a2f99904e0ec3000f04cf353245", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633195, "uuid": "211e5a1f-9a4b-4293-8279-522a5f84429e", "comment": "Malware payload", "value": "bc8fc6fcee2401efb0f830123c677e28f0d5ace4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633195, "uuid": "df724372-278f-470d-94e9-6de27dd81766", "comment": "Malware payload", "value": "8c7f2e119366366326d42ff50e52d372bdffc998e452d09ff26c0ae564c9be881ab97b5d8bf6a0c0f3e588b0b594f694", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633195, "uuid": "cca8e339-ae2d-4e82-987a-a8c04e7d03db", "value": "T14A636C0239C0C032C5816A71663FD2D3696B7D504EB6C58F77B96BBA8EB11903E36727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633195, "uuid": "217b343d-ac36-4501-9086-999f21d4a468", "value": "b1141867ae472c2bfcfa281c505949ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633195, "uuid": "ea0be8fb-f0b6-4383-90a0-54bc9d52a1d9", "value": "768:yB+XYKjVoNvpO0PM246qVKyFVKR274SmetRQvrE67BAyziEXMcie8SK4L:iSKy+VGtRQvDAa2cieD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692633195, "uuid": "5b50700d-f83e-4fd2-a3ab-c83651b29098", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692633195, "uuid": "6c5a9fb1-255d-43d4-8f66-8b6cfecaf8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633195, "uuid": "48a9fda0-b279-4a35-9f44-3b65e2d4e5ae", "value": "b8cfa222736bb2e4a133d5f2bfa54cb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cad95e-3ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692605165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605165, "uuid": "8db88ace-63da-4921-a13e-fd47e7cf1148", "comment": "Malware payload", "value": "2684b795956953dd9dc655520799752a", "object_relation": "md5", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605165, "uuid": "908f5930-65ca-46b0-af31-af99944a6b50", "comment": "Malware payload", "value": "e224b77fedf4ccdfde9711bee8fada7571612ee4cf5121515ead913da5755b5e", "object_relation": "sha256", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605165, "uuid": "0d2189fc-e1e4-40b1-86bb-43447b73f7c8", "comment": "Malware payload", "value": "0d5c33dc4bd5bac37ecbd5b7c99135242328317c", "object_relation": "sha1", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605165, "uuid": "e9adb7b4-9e63-49f4-8195-3cbc31eee154", "comment": "Malware payload", "value": "a5b03bf70b02e55d17cef26cae7ebe49ac7a227373275a04055cfd0c0111f0602d60c76e09eb97bbe778add857ff069b", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605165, "uuid": "d7d02d57-0eaf-4820-b84d-01ee9d0dc4d2", "value": "T154210E3C15A94711C3F1013F28BA63078E36B9D3D9728E2D0290920A7802A01FC2DF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605165, "uuid": "69aa4091-d4b4-4f61-b2f9-8e9a79a22a59", "value": "24:80N8NiJ/AEB2FjU9BJBq+/475aWUMagaozab/OD41ULw7mN:80N8NkLB2hOJG5dUMFrabOMiLCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605165, "uuid": "4e2435dd-32f2-46a7-8d7b-69227c76dde6", "value": 1222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605165, "uuid": "26684b1b-53be-42d5-b300-7acdb37b06bd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605165, "uuid": "06cc7392-ec60-4c66-ba55-623d9ebe403e", "value": "vip-book.pdf lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe629be-4059-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692646551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692646551, "uuid": "1ed8d3e4-9ff8-4bd4-8ad4-207c886bcf62", "comment": "Malware payload", "value": "ecee3d17e56ce40995f662b9afdc3956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692646551, "uuid": "ec1fc5c9-cc54-49a6-8cb5-60388cafb420", "comment": "Malware payload", "value": "e3fe88f60fc737ccfbc2ed15905d227243e98bb68ab8df8facf0d17ded567f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692646551, "uuid": "b415c7e7-4ed2-4693-8091-6fdadb78c035", "comment": "Malware payload", "value": "663107ba1308d29dd0391a1a9e09a3bf8e319ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692646551, "uuid": "6459c807-6f95-4626-95df-401cc89672f9", "comment": "Malware payload", "value": "104c78b8cdc855d2c4c49e67bd0b7c679b39ee980ada8939c3c2bdc73aee0cf1190ba8f4b7b3293d316d7c8824513c5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692646551, "uuid": "bcaacbe9-52b6-4a0b-9926-faef55549ec7", "value": "T137F4D05613A8C71AE6BE47FAD1204CA487BEBD17E956E34E0C8038ED2933702CB5556F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692646551, "uuid": "063d2bdd-7651-47a3-aafa-de0f069a4878", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692646551, "uuid": "ad07bfd6-e76c-4f54-bedb-5e885bb7595e", "value": "12288:oUVv25w+oeAAdB2d1mbTwb4Un8Fpch8m0XRwTptUxsQiwwFkCVR5:odLUTh89XOrH2OR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692646551, "uuid": "a6a16970-b5f8-4265-8748-006d29dc5b93", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692646551, "uuid": "3186d2a1-53fe-4f21-8b26-67dced0998cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692646551, "uuid": "09805bb5-b99d-451e-bfb9-5aa1c9d11818", "value": "SecuriteInfo.com.Win32.PWSX-gen.24193.25042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8d0fff-403c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692633854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633854, "uuid": "99b21d55-be4e-4625-90ff-8527021da191", "comment": "Malware payload", "value": "27a1f8ac85fe682ed157ac9384ebd71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633854, "uuid": "c7f62d85-e3b9-4abd-a293-66673727f00f", "comment": "Malware payload", "value": "e72878ff332581bb11bfbc6c19a6aafcad87a80993fdca422d2e41716cf8ed55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633854, "uuid": "fdbd0e41-9993-447f-9fd3-7c78d845aa91", "comment": "Malware payload", "value": "f9bcb2d2a18007aa68b3a3b6d82c157599aac72f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692633854, "uuid": "3739210e-d4d8-47ee-bb52-145d54aeadd2", "comment": "Malware payload", "value": "f11d76fdb17a505a6c5df1d628e7ec89e97139ce5437bc21045aa49eb273d23f33e86db5a37239a5e9685e17ba1fe2b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633854, "uuid": "c7e7e294-1a9f-46ca-99ef-02ffa863b9ca", "value": "T1CD15C53CF616DB2BD0CC8CF988A5192FB9F99CADD0F1B3A5C533C1A85BF981045A6452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633854, "uuid": "9ff6e04c-4310-40a0-a619-14cf4987b760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633854, "uuid": "c4eafde7-13c3-448e-81d4-e550697896a0", "value": "12288:P+70pKXQl2FNGpSSWry+YLPlbfaE/Ra/v9IuT2YuecOoBxYx2/Jp:L6LIbfH/gT2YwOwgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692633854, "uuid": "e1f42b35-1596-4002-95b8-75cdfb783317", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692633854, "uuid": "fbd95ce0-224d-465b-af77-357d46a639fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692633854, "uuid": "530589d8-5f72-47f3-bbcd-776ac3d1f6a3", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2dafcc-402f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692628209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628209, "uuid": "cd042148-703d-4f67-83ec-d09583100d9e", "comment": "Malware payload (STRRAT)", "value": "0e87d16c15f59423dd2266814b16f6ae", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628209, "uuid": "f48d4681-38ee-4455-95db-cd94ae396e40", "comment": "Malware payload (STRRAT)", "value": "e930ea95630f1144e2fa2fd3653409104bedb04cb526f6abbfc30b79d23ed1aa", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628209, "uuid": "28231a07-e42f-463d-bb27-78db25f4af96", "comment": "Malware payload (STRRAT)", "value": "cbcda6e5496086bf8e1129e2160059fe6c318930", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628209, "uuid": "abe04849-1503-4639-82ea-d4198086d794", "comment": "Malware payload (STRRAT)", "value": "ae94328c30a228ef71549718bea1482f034e2160198715750ab85392d61c5e64bbff92dc8f17f554bf8e8d6be0b512ad", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628209, "uuid": "0bf7c0e3-7a3f-4537-ad03-2ecbd377b2dc", "value": "T156A4125F7FCFE4B8CA076072904080A6560EB0A87153416F9AFDBA9A0C78DD91B59DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628209, "uuid": "f3987b2d-0f45-47ad-9c7d-346913f1c3b8", "value": "12288:98QlP+9NW32j29pBucycBSvwznel8YGbQnZcYP:98YSjyFBSIztQnXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628209, "uuid": "4a005ce9-3f56-418b-80e9-5f87fe7e8a50", "value": 456242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628209, "uuid": "ab6598cd-ca69-4672-bf3c-97e2b562cd64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628209, "uuid": "27d6b96f-4295-483c-a3f4-222c8bb8e84f", "value": "Invoice no17684.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09aa5c0-3ffa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692605643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605643, "uuid": "3e9ab29c-02ac-4267-a6f2-ca76aaa1c0b8", "comment": "Malware payload (RedLineStealer)", "value": "76a4293da34ac128744bdcc8aefd42d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605643, "uuid": "b10b0ef2-e164-4a6b-8561-0f04cc3b6fce", "comment": "Malware payload (RedLineStealer)", "value": "eb8297f319b09cc16011c0dbeb6580055a4e32b0629d42f21d042e9223320d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605643, "uuid": "0ea83b9e-dc2a-4853-b359-c0bef02695f1", "comment": "Malware payload (RedLineStealer)", "value": "02f6f63729ffbc7e90a10406f36d6cb6bbb88cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605643, "uuid": "9e42fb9a-5d62-48a7-87f3-db348c51098a", "comment": "Malware payload (RedLineStealer)", "value": "8455073971a7d053d4929cbd33601a51a6e66dbe03d48043c7c863497a3190ed775da97debcce42d5a47547d546754b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605643, "uuid": "0ff475c0-cd0c-40a5-ae24-2342ea4a3312", "value": "T16C84F11276D0E871D1968A318E1ACEF47BEEB8208D65AE5633541B6F1D306B1E36334F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605643, "uuid": "6d1685f3-af41-45e8-b029-62dcdfc759d6", "value": "906d5364405f9cc59565936404d3c7be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605643, "uuid": "b63c2230-ad2d-41d5-9517-0a44ef34ecee", "value": "6144:XSyHoLzjaJWt0KiXuJDsjeSFHEIl7rdeH3/8K636:XSyHonjaJWnbSXlQI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605643, "uuid": "c85f9459-f39e-4d3e-81be-8267d467c40f", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605643, "uuid": "b9b5817f-71e2-4a08-a3d8-ac9594d8ed5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605643, "uuid": "e578c33c-1745-4abb-b8e7-f96758218f3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c42af9-4035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692630918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630918, "uuid": "db5e2cb5-447a-4cbf-992c-5efbea210856", "comment": "Malware payload (Smoke Loader)", "value": "8158e732ec628c2d681a6896583b3b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630918, "uuid": "82727408-e2ae-45c5-b46c-107f86a73f51", "comment": "Malware payload (Smoke Loader)", "value": "ec5b67d263ca1afc21d4a28bf5fadfc0697c531c23c5993a114ac24608628f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630918, "uuid": "ba7b2212-9f55-486b-95e2-f3e41f6a77af", "comment": "Malware payload (Smoke Loader)", "value": "8aaea6eb9ac3f7e2da0b55d20584a60b6508a6cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692630918, "uuid": "45be3347-f124-4a01-a114-6498381fbf9d", "comment": "Malware payload (Smoke Loader)", "value": "3f09c6e23400da92b464ec42004c1cc251897b9a7410513c0452f82a2357bad13637c12729dfcf7f5083033b775b18cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630918, "uuid": "c7e49461-5b60-49e0-b57e-de010398862d", "value": "T19944AE327690E871D55B8631CE2AC6B47BEEB4718B5A964633580B7F09302BDD2E730D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630918, "uuid": "9e44314f-4e7d-41c6-882d-389607ad764c", "value": "dd524e0314968bf576181253b87644dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630918, "uuid": "b46df4d5-27fe-4987-9d66-deb1f580c692", "value": "3072:OL34axHLsfxcvJPacXbq6uygrhBt3T+1ct5wBtD3GEwe/53gE0Z:44axHL6xcv1xBtgZScnwB8EwAgE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692630918, "uuid": "4b947ac8-bafe-47f0-849f-3632779506ff", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692630918, "uuid": "4821a005-484c-4a0f-ad68-443058692fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692630918, "uuid": "3aae6ada-619e-416c-88a2-a8cea5f55651", "value": "8158e732ec628c2d681a6896583b3b3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2ab78c-4005-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692610363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610363, "uuid": "ce7252ae-d717-434f-9a63-d3befeb0b05a", "comment": "Malware payload", "value": "cddf3f1b344630b0197b1febf4e6c87d", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610363, "uuid": "9c4b0f9c-b709-489c-bfe5-19918f9c788c", "comment": "Malware payload", "value": "ed3b2f1ba1ea76022452b1e92b4f368df812fdfb472f6668b34cece137de1261", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610363, "uuid": "b5b875e1-f875-4a08-9f24-f97aa3a83934", "comment": "Malware payload", "value": "4fc104dbda30b8db57c56ef5cacf0c9fb2f0a3c5", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692610363, "uuid": "847a5753-d385-4c41-a40e-62f8ed404878", "comment": "Malware payload", "value": "5b3563b76869ac8960ef288043e216b5472b15f3cf2c821808c8e988186d16c45c4e0da90e77b245b986bbb0e14d0ee0", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xjnhzaj12b1", "colour": "#8BB217", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610363, "uuid": "bd92db6d-cc90-47ad-b3ad-eeaa0dfa5679", "value": "T11431B2331522804C9EF24C5D637EA77C67B3C4183BA4D7AEA79849A85C02A7B857CC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610363, "uuid": "45cdcae5-80f0-4329-98e0-1a8fa3710023", "value": "48:6i4MSo0wTeLyfP99YlTeY6EurMI0j0F5U0YlPyItakK:4oyeP9YeYaMImCmLyItakK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692610363, "uuid": "17a472dc-8fe2-438f-a25f-bd2760f9f2cc", "value": 1791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692610363, "uuid": "ec358dca-7bd0-4778-a1b9-87c83e7ec4cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692610363, "uuid": "fd122ad2-7f72-4c3b-8e97-f2d3696c6e1f", "value": "vn.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3713a423-400c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692613170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613170, "uuid": "c7519ac7-4883-447b-a229-c5403d5406e7", "comment": "Malware payload (AgentTesla)", "value": "eea69bcae6efd9e145d56dc73793fc58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613170, "uuid": "23da9470-9b4a-48a3-98b8-01bf69611a73", "comment": "Malware payload (AgentTesla)", "value": "eef774ac4951051ee5e1d512452482bdbd33c5339327ef261b9905ab7a4b04e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613170, "uuid": "52b23e98-2a14-4502-9bb9-80583cfe8ec2", "comment": "Malware payload (AgentTesla)", "value": "54f485e46ec30cf84e16521ae0c1e12182080436", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692613170, "uuid": "879fa1ce-4e56-4a9e-bf9d-7def1fe3db51", "comment": "Malware payload (AgentTesla)", "value": "bc567241832db7c42eea32324dd506de173c91e9cc93244fd69d512a990b175de48159900bd12f6b65fdbf50502b91dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613170, "uuid": "aa125349-b8af-42ca-8591-ffcd37af3864", "value": "T11B251241B3168F57C4AC0C3144B296180679FC6A9960CB36FEF5BEBD3A733856326792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613170, "uuid": "1d65adda-d3f9-4725-9d95-40930fedbc6c", "value": "24576:/Ge5RC5/4od37tFRCvPFy7qfIReKVodddGdBnyE6h:+MSddq2q9Kb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692613170, "uuid": "52b538f7-7eb0-4b53-b992-23555bc07dda", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692613170, "uuid": "e2f302b6-54b2-48a5-ad56-6bf9dc6a527d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692613170, "uuid": "0fb4c472-e24e-48ae-b566-82e77b040a63", "value": "Zam\u00f3wienie 4080723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05e1ecc-3fb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692576007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576007, "uuid": "ee374a7d-4c4e-4b6f-a4d2-ff63cb4d1c1e", "comment": "Malware payload (Mirai)", "value": "3203292694f4f8ae56fc47a7e6d6d4ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576007, "uuid": "ba347ba6-01a2-45b7-b5d7-6fdaf4eccee3", "comment": "Malware payload (Mirai)", "value": "ef3785dc13f45711f79f5f29494c8d492056ec0fd8c7e11c8b8b0e0a7f911fa0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576007, "uuid": "c3b71e97-1499-4536-88dd-7c90d7a73295", "comment": "Malware payload (Mirai)", "value": "02a2865069aa5a3d068992246063ff5ca256f3f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576007, "uuid": "c22a4d20-ec76-4fe3-a9a3-c6d2c4569dd2", "comment": "Malware payload (Mirai)", "value": "0f277fe8707782b1201a9f35b54f2e139e9e3978e70f3cda828f69bee67cb500864b8588bb7ddfa7404fb2ecc248cf6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576007, "uuid": "ac705083-6e8e-4986-afa4-1718c3b94fbb", "value": "T1FC630BC6B8819A3AC2D157B7EB6F118D332567E8D1DE3213CC180BB4778A90E4D57B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576007, "uuid": "292eda2b-bc17-48e3-b718-0cbe4b3c431a", "value": "1536:fOfms7txq7UXcI/Me/8J90cJXWHIVdpmAQNwvYrPX51tcMKd3+3+:fO+4txqoXcI/Me/8J9DwHIVrQWveK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692576007, "uuid": "c20ab456-92cd-4291-9e9b-8d928a76a95a", "value": 71136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692576007, "uuid": "e7c8196a-40c0-4c50-ba12-3737d139087a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576007, "uuid": "daec0b80-cc9c-4650-8b86-4d9ea1fe640f", "value": "cutie.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f75ae05-4030-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MassLogger)", "timestamp": 1692628726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628726, "uuid": "c13bfb87-20e4-418e-891d-8c146c676ada", "comment": "Malware payload (MassLogger)", "value": "5a9bce6908490be3729050df12be32b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628726, "uuid": "bdf9c03b-6070-42f5-bd1c-f0df41c25875", "comment": "Malware payload (MassLogger)", "value": "f04ace87c55691161603b413725e8a4a6e8035260678e7d0b3b39b51d8c23cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628726, "uuid": "10fbeb75-ad05-4a65-9a7c-53fe8809de19", "comment": "Malware payload (MassLogger)", "value": "a9e5db1d42349eada2198a2c8cef15babe338bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692628726, "uuid": "602beeb7-5052-4fa4-aab5-b94315520090", "comment": "Malware payload (MassLogger)", "value": "ae423951f435f6a71a7f63ed35d35c5e4937c93f5107e19b192e797f5335714f0c71360f94f6f680d026c7e03744db28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628726, "uuid": "2ec9da4b-c005-45ed-917a-2b941df84f4f", "value": "T1F7F423E3F37E831CFA0E367E8A48E06D50F960650823C7AB1F4A79D55D235613982F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628726, "uuid": "6e112f7f-b0d0-43e7-8c0a-5f3717fc0d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628726, "uuid": "8de993b0-b936-4fb4-b036-888dbfc7862d", "value": "12288:CMsVh3mHgDWA0WHQiLHyP40wI8AzR6HT9XWZQp5Jrc1MPUkFDLn1h5ZjNl0b:CmHU3bHrK40wI1CT9B5Jg1MFVLnDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692628726, "uuid": "60beec4c-7fbf-484b-83da-13671f5476b0", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692628726, "uuid": "b901cb22-415d-437b-ab72-50e47a534f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692628726, "uuid": "958ad7bf-9213-4f13-bf3c-d91a952a3bb8", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3528c9c-401f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692621619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621619, "uuid": "e36435f3-03ac-4e77-9545-8876cff616c7", "comment": "Malware payload", "value": "c41f67fda9429fd0deaeb8b56bb555ba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621619, "uuid": "096060df-bc5b-4523-9ed3-a87839ce1075", "comment": "Malware payload", "value": "f1913fec1a1369388f0b2a1125e19b134667adf471f3adcc97b6970fb70fdd29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621619, "uuid": "3a4da22f-2c15-4400-b452-461cd77d74d2", "comment": "Malware payload", "value": "e30e2eb2cc93a266b950c9ccaa11f488e98ed56c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692621619, "uuid": "aaccc031-52b5-46cc-8b3f-6ab29a3c301d", "comment": "Malware payload", "value": "9b2a8768c3f8c07a5808b4705711213d0799acb0110f41b5aa3a4431c03e177ed64832bbe03b92a97e45daef3c4252ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621619, "uuid": "ee1b7021-07bf-4c4c-bbe3-f31fc4d69ba6", "value": "T107236B00B691C0B3D69B163869B9C662067F7D935AF494573FEA030D8EB16C0BA3D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621619, "uuid": "0754c852-fabb-4749-b8f2-281e83fb1cd3", "value": "07ed6970d80772ff905788fa3e1463f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621619, "uuid": "606cb451-8e12-4324-90f2-dbda1827147e", "value": "768:chTxc0Je3ufiM9T6pf+zU4bY50EcQISWYNKGIPsQyddj/I469:chTxTyIkf3ISjIPQfQn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692621619, "uuid": "231123a0-b02e-4bbb-8e92-6768a5ab27a0", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692621619, "uuid": "bab087cc-e6ef-4e7e-928b-a61fcfd8f416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692621619, "uuid": "dc41f410-39ed-46bb-a05a-7fc739ad9e5e", "value": "SecuriteInfo.com.Win32.PWSX-gen.3221.1843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b55a9ce-3ff9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692605097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605097, "uuid": "12810656-a5d9-447a-a650-887e1454aaaf", "comment": "Malware payload", "value": "8a3a1d57c8f91fc801f658805102bbc5", "object_relation": "md5", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605097, "uuid": "a7906ee1-5eeb-4642-9107-b996d483d7e5", "comment": "Malware payload", "value": "f1fa42c3d50d4468b9ac3f7e5cdb1160c8f7ed7bbb6e4017859b837dac7e8d93", "object_relation": "sha256", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605097, "uuid": "8e7b0601-92d3-414c-a7a0-6e387e227dea", "comment": "Malware payload", "value": "4784b9a3c04657417893e6facc9ed5bfee3e0687", "object_relation": "sha1", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692605097, "uuid": "888acb4e-7b0e-4d07-9b2c-29500409609a", "comment": "Malware payload", "value": "dc65e7a126b2ae989b005cc5113b849be7983a01a59c1c451b3ceffdd2008efd08d05db4eef8498a8ebb67adae8a4809", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-9-18", "colour": "#D7B4F3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605097, "uuid": "dd69ac33-4a3e-4202-ac83-a91ede9a1c88", "value": "T122F4AE1BFD92D5EB22BC5261A1837E2D45803836459FADB622FE36481C8394CD99C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605097, "uuid": "92b960d1-7e03-4eef-94da-3312d40842ee", "value": "12288:DSWv3E5tGI7/koVNgDjM6lqHJy9ehcq92XNGR2poqxYG6PINZ9d:GS3OrjVH6lqA9lq92XNGR2ppTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692605097, "uuid": "6a869ddd-b451-42f3-b971-dcdddc63a795", "value": 786591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692605097, "uuid": "945761db-436a-41d9-8809-4f19e39c193d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692605097, "uuid": "fee719f6-343b-455f-8e90-e94a722a0eab", "value": "config.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10eb9d7c-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602798, "uuid": "35a32f66-f974-4552-a632-cea2c214b87a", "comment": "Malware payload (AgentTesla)", "value": "554c7d88ee5a0edd7ab2b029b5cb40b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602798, "uuid": "e560a2d7-b75b-480f-b10d-4e757abed6bc", "comment": "Malware payload (AgentTesla)", "value": "f2e9c6382b13385151878ca126674de95ecc85d5b9012e9561bc7a492600c77e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602798, "uuid": "62f8b80b-76ad-4a78-b2f4-a23410156340", "comment": "Malware payload (AgentTesla)", "value": "a96cfd277e84339ae32e525e5b6c1fd13f52f79c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602798, "uuid": "5014785a-60e3-48e4-bc04-b4adcf67ebe4", "comment": "Malware payload (AgentTesla)", "value": "7adfc510723c42b21ebd75a08cdbfaf8ed0532997a5c67c772f9b4348b1b1b15f718381d2fa3cbc6494cbdacfe486b84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602798, "uuid": "8f9b4cf0-2b3d-46cb-95ef-24a2a961d764", "value": "T1B4B45E067349CF61C11F16B5C4A782F413A7AE40EE12DBCBB18EBF193A723E95962147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602798, "uuid": "b728d864-eb7d-4df0-9f11-cd8279f9a261", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602798, "uuid": "22167cb6-0ae8-49f9-8c8e-afb9f433e906", "value": "3072:1pz3nYQ0dWs9UY0fCPtgrSA3nUCKEb2gm4efhAP8tu5FPY:AWs9DACP++knfpbbmhAEwFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602798, "uuid": "65ca1b39-86b4-49ef-8a6d-453f1c4ac027", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602798, "uuid": "90b5565e-7503-4733-bb59-00e3f113c22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602798, "uuid": "b4a81cc9-dd82-47e9-92ac-3143a4d17130", "value": "YAMASHIN VIET NAM - PRODUCTS LIST_15082023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757ceea4-4024-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692623582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623582, "uuid": "043b53a1-ab79-4726-8ea7-063d70c79a11", "comment": "Malware payload", "value": "372d2efde675fd6f1140b575d1785ac1", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623582, "uuid": "86b98b6d-eb0d-47b9-8be4-e973a635cd8b", "comment": "Malware payload", "value": "f3dd9c4337ed0c2516a1e9e6dd5147fc4e7182072dc3798b9bae51a3824b5777", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623582, "uuid": "649e5f0b-9deb-424f-ba91-dbea757cfbb3", "comment": "Malware payload", "value": "64a8d4148e65151d7d74dc05c01a2e5b3ea830f2", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692623582, "uuid": "0ca1bdaa-ccee-4172-818f-8bcb8f45a489", "comment": "Malware payload", "value": "0aa9326bf6a8dee232f2ea133b214b7dceb45a8f81c7d31909bd22d23ccac6ac9a7594d91d57c2d806a2d186f167cbaa", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623582, "uuid": "6c6a3baa-7a3d-4f0c-94fe-b394305e82b0", "value": "T18511BEB65B1E9012C9B1CB420D4B525ECF6081A258C00611B8FD0A71AF39127A35FFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623582, "uuid": "52b6e9fb-6f47-4fea-a1e8-84749a8fba03", "value": "24:KOVtyCiDzfGrNsFTxnswvpdPNuR71q2z8JAh/:KOVtyCiDAsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692623582, "uuid": "3f6db3a7-679b-4cc0-a778-202b17679761", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692623582, "uuid": "237161ec-20b9-4396-bf51-30b1b6637172", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692623582, "uuid": "0ebc4fb2-29aa-4f03-800d-b5941c22e711", "value": "2pdXTWGc.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd339a84-4066-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692652050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652050, "uuid": "904691f3-0488-4183-acfe-f3ef52b4a9bf", "comment": "Malware payload (AgentTesla)", "value": "a64f13191e02009e1254db3b8e5dd8e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652050, "uuid": "b788a555-5fd2-42bc-ba5a-ff34d3917887", "comment": "Malware payload (AgentTesla)", "value": "f4d50f538efd2ade1a4aa8ad827b6885af60dfcee80abe5efce6589318d7b45f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652050, "uuid": "e85c409d-2460-4105-82d3-b90e3ca12d1c", "comment": "Malware payload (AgentTesla)", "value": "c2d9d99c36cd38ee84c7cc817351e3e22c457090", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692652050, "uuid": "f14f46c8-5217-4854-8cab-307b1feaf677", "comment": "Malware payload (AgentTesla)", "value": "c77068f7f00e222a6a320d0e4bb9028d54008c836f5da26169070babe16c441513982e7e331d1b18011bb5a763e098b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652050, "uuid": "078bbdb2-d133-46ee-bfdb-69153b45818f", "value": "T1C4340E137E48EB15E6983D3FD2DF2D6413B2B0C70673A60BAF48AE6525412436D6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652050, "uuid": "98ea4568-3b22-43af-a7ae-f04a57004db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652050, "uuid": "2a8de47e-d102-4818-8c07-cb971a62a663", "value": "3072:jkY6E5OcnW4fufqeM0MYvKRMDxsrPjGqmy3:jvnWzqeeXqDxsrLMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692652050, "uuid": "d9c0852c-0807-4111-b208-9cad57e1efca", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692652050, "uuid": "c06dff23-6281-4763-a044-add597c0f951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692652050, "uuid": "7b933b5c-8110-45ba-97ef-17c11586e5a5", "value": "RFQ New order inquiry product.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9506123-3fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692596262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596262, "uuid": "df2ee654-dcf0-48ca-b8b0-3f812b2c25e3", "comment": "Malware payload (Mirai)", "value": "4a9ce2c9af4b231557b1ff5db60603b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596262, "uuid": "56e3b6ff-fcb8-485f-bb7c-fd05fb8c5255", "comment": "Malware payload (Mirai)", "value": "f5102644dd1bde6d5a1e3b1023bf45ca1901c4e1fa29a9eb7717bab884606f72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596262, "uuid": "c2e2b225-bd6d-4c7e-bad0-f1d6cd9225ac", "comment": "Malware payload (Mirai)", "value": "82f19df889d84483df130cf62d5c7988bb1e6ab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692596262, "uuid": "5e8a7a20-d3a5-4a9c-939e-4f171a60bbf9", "comment": "Malware payload (Mirai)", "value": "aa88a01280018b04e774c1c78a552c7f7ac4b8568eef6c50f1af5a231914cdc125272da9a995aa724d1f8c47ef730d05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596262, "uuid": "2ba05b02-7ea3-4dd6-b43d-9609c4ab970b", "value": "T110536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596262, "uuid": "850aeddb-4971-41d2-a3a7-046cd639d972", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA85:p5VHV8I9cK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692596262, "uuid": "1e0e5c8c-c20b-4e7a-bef9-8cd554023e3d", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692596262, "uuid": "37f4d922-b5c6-4027-9812-e423113199dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692596262, "uuid": "9af58107-806b-4fb8-babc-cfeb70947647", "value": "4a9ce2c9af4b231557b1ff5db60603b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77a53f7-3ff1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692601789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692601789, "uuid": "54199831-6b6c-446a-ac92-ad4a425c6e59", "comment": "Malware payload (Amadey)", "value": "947068f7add2376ee9076e7d46a22660", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692601789, "uuid": "a8b539b8-1d06-4be0-88e6-d29f6d76729c", "comment": "Malware payload (Amadey)", "value": "f53f52f8cbf0fd539a3878142ac58e8c0cf2d63db1aa5053da0075b813a339ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692601789, "uuid": "ff771881-3cd1-45b8-a104-2649d635d7d1", "comment": "Malware payload (Amadey)", "value": "126a5515babbd93b4706e471bd671032683ce592", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692601789, "uuid": "7e349312-d740-4a38-acc5-3f78713f03e5", "comment": "Malware payload (Amadey)", "value": "c2282f2c44fb17584c1a57dbf22ba8b25aca3a0754c0f1972b1dd48e1b59e5145e0316a0db0c0d6e7a48f1f3b5fbd6e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692601789, "uuid": "ff4f842b-bc82-40e5-b9ab-1587b3650454", "value": "T16D34AE2366D1A4F1D55B8531CD1EC7BC7BEEB5214B59960A23240BAF5A703B2D22F30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692601789, "uuid": "e5d28bde-a7c0-4bab-982a-83f78b3d4bf0", "value": "906d5364405f9cc59565936404d3c7be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692601789, "uuid": "f0cc3f85-5649-4a37-ac3b-5f29ea8a363c", "value": "3072:EgP35s57L+zINm9YiS+AIJqDoGcCUGMqGT1q8JyY7+D5gBuaMd:bps57LmI3IJ+7G5F1Bu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692601789, "uuid": "d6ab9e40-819d-4958-9bfe-59b94d9cedc6", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692601789, "uuid": "e90e2f0e-94ef-402d-acb4-295708012c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692601789, "uuid": "821c9006-3268-4fc1-a57a-ac849d60e43b", "value": "6523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa00196-4051-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692642892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642892, "uuid": "b1bcf1a7-989d-4618-ad78-44e074efaf7d", "comment": "Malware payload", "value": "51df28ff4aa752c9ec3e7aa78fca32a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642892, "uuid": "73a7b455-34c8-419d-9860-a46423ecf4ab", "comment": "Malware payload", "value": "f6f85660055449f6067caf1b7ac13ae1a689b0097c362c63667aba2e1f12f476", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642892, "uuid": "8dc8be9b-d186-47e4-87d7-a454de5c50c5", "comment": "Malware payload", "value": "85dd02a685d6af1f65235c3d5fa099a6c6f80384", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692642892, "uuid": "697c6c50-aa19-4c4d-ac84-b6416b52365a", "comment": "Malware payload", "value": "19f9524d5341256841cec6a11850b5dd861de89ab1b93e709e794c25aa58ba05504b80acfe5f671a4842e7542f746f59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642892, "uuid": "aafced54-c149-43c9-8fc0-6a73fc12d149", "value": "T191236C457291C073D69B033429BA862206BF7C929EF4948B3FE9170D9EB12D07B2D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642892, "uuid": "9b2135a0-b783-4b13-a336-05ef8ed343bd", "value": "e16bd71cc52f8b2347f0367958a2caa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642892, "uuid": "8e9b361b-0c8b-493e-b337-69d9cca21f49", "value": "768:MLS4WFkWFhTdW66YL36jOG7bYtEESAboWV2NKsEBsQyddjViPCZ:MLS4U9XbgdKQfu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692642892, "uuid": "772920b5-5b8d-4275-a769-165df1ca2812", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692642892, "uuid": "e4cb2b5c-c44e-4429-854f-193f7c59127d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692642892, "uuid": "9aa8b671-bd33-4680-95f9-33e766510841", "value": "SecuriteInfo.com.Win32.PWSX-gen.18899.5686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba333f8-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692603031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603031, "uuid": "c4c263db-f8d8-4a84-aa75-2181f778cfe3", "comment": "Malware payload (RedLineStealer)", "value": "d68e9b7fed1efde41c7447daf1ec32ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603031, "uuid": "ac616d8c-57ed-458a-af28-47251df13844", "comment": "Malware payload (RedLineStealer)", "value": "f74a35d89cbb249232a46462f0bc9b1855951cd0fd0ad149341218d8b99c2e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603031, "uuid": "26c49f7e-928b-4dda-a9c4-c9bcdddcd3d9", "comment": "Malware payload (RedLineStealer)", "value": "2d087f9f340190f81109d10712cb5c274c5b124a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692603031, "uuid": "697631da-bb5a-4ccf-a94d-1de495d076de", "comment": "Malware payload (RedLineStealer)", "value": "ca6f5d0f3bbbdd60208ff0651982e6253fcf167167db8c6f6a3b5aa48cdbc706033b54cc10abfd180a743b6b25d3e094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603031, "uuid": "8f053995-2d93-46b2-a062-cb167a60c4d6", "value": "T159355B107880D126EDF3117696FFB820C6EDA070072D59CB52B93AEFC6189E17B3E566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603031, "uuid": "bd5351a9-d343-400e-ac5a-b226c7937984", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603031, "uuid": "403429fc-ba1a-4573-90ed-f187c82b8f3a", "value": "24576:l9Y1/jI7PvqonaJlM+sYnus0htzO+hHwpz:l9d7Pvqo8EAR8hO+hQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692603031, "uuid": "60fe2d91-c296-436c-af66-efe6444bbb04", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692603031, "uuid": "1023aeaf-75ab-473c-9f07-14cf9c1585df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692603031, "uuid": "1d4d8f50-f65e-4a69-bd73-9a97dbfaa062", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.31964.11496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa78e96e-4029-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LimeRAT)", "timestamp": 1692625819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625819, "uuid": "a655b9ee-c0fa-40a0-9e50-3f2d66552e6b", "comment": "Malware payload (LimeRAT)", "value": "eb2bc869689c92c21e68f3e684ccea37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625819, "uuid": "5d8b678c-4a88-4c4d-9360-4684eae9dc24", "comment": "Malware payload (LimeRAT)", "value": "fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd07c75c6ec44e3e8736c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625819, "uuid": "1791fbc3-3ba5-4b2b-b63c-087494ef4245", "comment": "Malware payload (LimeRAT)", "value": "54ed976bccb60e2ff754c94310a913c3063316a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692625819, "uuid": "b0f26774-89af-4982-a48a-1b348c93b8ae", "comment": "Malware payload (LimeRAT)", "value": "22851524b5e80e7f72227f4369c08ab6d18ef7734d8dfa847c2878777acd250aafdc66dffc0f6eecabebbfd7d138142e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625819, "uuid": "1f5fbaf1-d604-4c45-b862-e964db9084a5", "value": "T1D2344B2D1AA7CE7AD39C8BFDE0464950A7FE51479A92F309261004F6AC023D9DF252F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625819, "uuid": "cadff334-4c77-4a3a-9db3-a0828fcca677", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625819, "uuid": "8450fd9f-f058-4dd1-adf4-2a5584040317", "value": "3072:g/UfafnkXTXbYFxo5ob07ABrXSHMNQ/wCuGw0J0pokjMeltBitKdAZNAQq+8Vih:g/inXbYFxoz7ANEwnGw0iikivZNLqrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692625819, "uuid": "929ae971-6514-496b-a11a-7e89ac7b3724", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692625819, "uuid": "ffe99963-8c64-4f3d-90ac-9dcd01c55734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692625819, "uuid": "433795b7-76a7-422f-a73c-2dd64d680048", "value": "fa6af7e23ad1d78e2fa4ed2d372a0990a78bcc3a49bbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06451636-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692602780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602780, "uuid": "56f564cd-4c9d-4160-a389-c6251212c1de", "comment": "Malware payload (Formbook)", "value": "f1434f91b2ee01d0c0c2e7d4a6efe46a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602780, "uuid": "c9dee301-965b-4d0f-b435-1470decc2009", "comment": "Malware payload (Formbook)", "value": "faa252f595975231e286495efd9163606d5675e40e1aa4532eb6a1b957c6a5c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602780, "uuid": "f262aac5-2604-477f-b4ba-b4d98760d329", "comment": "Malware payload (Formbook)", "value": "c97f924202c10954c7bfcb8cfb5a64c6a069eb2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602780, "uuid": "6abe9711-e00a-4df0-9c6f-beb4dfde6107", "comment": "Malware payload (Formbook)", "value": "fa9eb2a670cf2fe63aa772c5f52713872f7736750316d8aef86fd00d29913861c59e011e5b0f12846e7c4aa8ce25afa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602780, "uuid": "9a31e872-d54e-4ade-b156-907d82b454c5", "value": "T1A9343911275C4B1BEB9F8B78E454A91886F281B6A38FE7527C94F5FCED03385DC061A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602780, "uuid": "bf379a90-7ff7-439e-ba24-f9f5a409f091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602780, "uuid": "57d2094a-15f6-4c8d-8b06-e7e73f76e4c8", "value": "3072:sQdsI1dGoNJ2ZHfz/TACwvMnDIegPx8btlWBVJZtnfdpaN:4yfK/z7ACFIeEybPWBVNnfdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602780, "uuid": "0ccbe354-3c3b-466d-b6f2-9eae7bfd5b0a", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602780, "uuid": "e2dfa9e2-b193-4909-b3b7-11bcd3229ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602780, "uuid": "382963c6-ea7b-43e1-985c-72b747aa45a2", "value": "OUR REF RFQ 6000066536 - PR 10023150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b723b8-4027-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692624903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624903, "uuid": "2bc66eef-db7f-4409-9660-e8d25d38a375", "comment": "Malware payload (RedLineStealer)", "value": "04faf6d2a3cdbc53f7a10b0988f4b288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624903, "uuid": "460d3837-f0a3-4519-bb18-d363b29de3a2", "comment": "Malware payload (RedLineStealer)", "value": "fb14388a70ce830ec47c12a68af6a3cb6df6e994a34e80528de176eab62b3ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624903, "uuid": "c4ba4a78-3c7c-4645-91d9-0bd3ce3fcaa3", "comment": "Malware payload (RedLineStealer)", "value": "a4fa500f1c301b34dd6b0a1dc46e5e290cf5672c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692624903, "uuid": "a031bde6-5571-49b5-8a1c-f26d6761ac3d", "comment": "Malware payload (RedLineStealer)", "value": "c991f39f61a211a02a5282ddd8976a2a7b58a79273952570cc8af0c1a9c4632f47c6906e1084856c1d4cb4bc57bf89b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624903, "uuid": "5c0a63ed-903c-4c03-89e1-a19df9bd7ff4", "value": "T1AF353B3038E5957EDDA310B786EE652046FCA0B00FE557CF9184D6FEBA246F12A33586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624903, "uuid": "9a5a8f15-d30d-48a7-a9ec-637d7613fd57", "value": "fa0f76338375d3e60669765a50375aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624903, "uuid": "55a823fb-2209-4396-bad8-21f251e32f74", "value": "24576:59Q1/jI7PvqoPCplM+0gnuc9xO4/oBiJ8wpz:59l7Pvqok8oR9xO4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692624903, "uuid": "468eff5e-453a-4cdb-97e9-65e56540e835", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692624903, "uuid": "2ba7d8f5-697e-4b94-9137-ae92110107cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692624903, "uuid": "810721be-098e-4b8e-a18a-2bded5adb22a", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.31995.3721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460dc3af-4033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1692629945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629945, "uuid": "c53de409-7c9a-4ce8-a0e9-4f3f70cf841d", "comment": "Malware payload (RecordBreaker)", "value": "6ef1e4eb4447a37e49946e86021314e9", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629945, "uuid": "af0c8f6d-5fd4-409a-9b17-555d3b6d67bc", "comment": "Malware payload (RecordBreaker)", "value": "fb6dcfde4437027abef2cf99a67351a16f28615457339ac160d55cf8ea57bc81", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629945, "uuid": "2c35d90a-0957-4f7d-b814-0d1b43d2bd42", "comment": "Malware payload (RecordBreaker)", "value": "29426df9e7447aa088c21c38f44a9ecfb7b266d9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692629945, "uuid": "b5324c5e-8a99-4461-9f2c-f47bf405876f", "comment": "Malware payload (RecordBreaker)", "value": "0be21c4f4e214fddd9bab96e51d26a4059b5161efd2fb80fb2744dd379b643f36b8d1c1cedbf4f5921a80624a81feee4", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629945, "uuid": "d046b6dd-020c-4409-887b-a51ca7bd2543", "value": "T182C538427E42D922F019A237E4EF040D17F8E8112AD7F7277DF433AD54623A27946DAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629945, "uuid": "fc1bf403-1a6a-4c9a-8f10-851677a9610c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629945, "uuid": "f7008d37-66ce-4da2-8f5c-1f25bfa49ef3", "value": "24576:ouSNRJncu+meZg+yjGFl4z/sQ65aPuGibvDRv3X/RT50oI3ThQhK+Mh3j3T6u7oQ:oN1hjGgVjUeQjxP/RvxhK+OjG71ol+Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692629945, "uuid": "8be75334-1ff7-4044-8432-70e95810e2c2", "value": 2629376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692629945, "uuid": "f20d66db-bb22-468a-860f-56d6cab81560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692629945, "uuid": "354f3dbb-0922-4787-a383-658ff1961282", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d0a9c6-3fca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692584876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584876, "uuid": "75443986-a138-4c4b-bc65-811c82c34447", "comment": "Malware payload (AgentTesla)", "value": "2d56504284fc89bc4989cdb1956430f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584876, "uuid": "926e47a5-e545-473f-9af7-6ed800f52d3b", "comment": "Malware payload (AgentTesla)", "value": "fbc09bd6ea72efda299854b428571705f6600d693b33c2a52fed78e2180ce2b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584876, "uuid": "1ffe0cd5-6a85-48df-8447-2ee97f7308c6", "comment": "Malware payload (AgentTesla)", "value": "1416cce5693f9d0367496866ee69b2a3925adbeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692584876, "uuid": "2ce3ae19-3f32-4d63-ae7a-1b628ec1dcd3", "comment": "Malware payload (AgentTesla)", "value": "5917eed35cc190ba4f31772c6edc91478c48b9e178ac5737f58dd470e46f9126c565ee8d05f944d084198c80baa07d62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584876, "uuid": "12bd235a-eb06-470a-a99e-c7b61cbe78ec", "value": "T16E05B43CF616DB2BD0CC8CF988A5192FB9F99CADD4F1B3A5C133C1A85BF981045A6452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584876, "uuid": "8030489b-2b50-404f-b1bd-3a976c562db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584876, "uuid": "d78b3c13-e10a-4374-a8fd-b0583773769b", "value": "12288:d+70pKXQl2FNGpBSWr9n7Ek82MJBZHhmipIi0wi4c7JfT:G66jNHBUwDAJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692584876, "uuid": "b5550528-6889-4b9f-bedd-7f0585e024b4", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692584876, "uuid": "5f5112fb-f9a6-4091-b9d5-e9c4412e785f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692584876, "uuid": "45d4ec59-5e2c-4965-9504-f8fa707ea69f", "value": "SecuriteInfo.com.Win32.PWSX-gen.18830.26944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a64958-4048-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692639236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639236, "uuid": "74b0a99b-102a-4d4c-867a-5665987d6c2b", "comment": "Malware payload (AgentTesla)", "value": "d280eefefdd8e6e518606ce8b79482b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639236, "uuid": "12a2298b-3d2f-4b17-81ad-fa164f5060ce", "comment": "Malware payload (AgentTesla)", "value": "fbe43eccf559247f04391a68d08546953f0010957aaaa0205187a96b5fe57c94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639236, "uuid": "5e295551-8575-4b9f-8267-ab81bf5bf50d", "comment": "Malware payload (AgentTesla)", "value": "80429350e61f99821b91d30372b701547c994dce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692639236, "uuid": "3cef149f-850e-4da0-b531-5fba5bf39baf", "comment": "Malware payload (AgentTesla)", "value": "28e386c7b72626d575e18cb896b404866ab719d4b20dcf15ade04d2f2cd8a21af0cdc91dbb80d5bb7e88e05843136ae2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639236, "uuid": "1fa40b96-5829-4ee0-bcf6-ac2f1dac22e5", "value": "T13E05D01213A8C71AE6BF47FAE4614CA187BEBD27D657E30D0D8038ED2932752CA0556F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639236, "uuid": "a5ee5110-1e25-4250-acf0-84ca64db764e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639236, "uuid": "e87ead4c-5889-4971-8287-dcffc9dbf0b9", "value": "24576:KdKk+pxlfz5Z++WAwdz3nLHKgX1iXysZeg0EU:4+DlP+DAwdzTbe8eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692639236, "uuid": "2ac76e31-b0a7-4d5e-b735-f99366820b47", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692639236, "uuid": "fea7084d-2a2d-4b11-a0ca-6539d7fb47cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692639236, "uuid": "7e8a199f-e31c-4699-8e71-73846b1ed1f5", "value": "SecuriteInfo.com.Win32.PWSX-gen.8807.11627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f572ff-4075-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692658418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658418, "uuid": "15ca553a-d1ee-44ab-9985-8728dba017ef", "comment": "Malware payload", "value": "db896ff1c3a206de4da48748f0a4731d", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658418, "uuid": "c8b44f83-d75f-48b4-9d19-9156fef78590", "comment": "Malware payload", "value": "fd834695fc878b5ed5178dad86cf30130adf4a7ac88d5997f8eb7814ca41f211", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658418, "uuid": "a97db1c8-b216-44ec-95b9-99b310c275f8", "comment": "Malware payload", "value": "28e85fe7ff3e99fd2c629db98690ecf72194ba7c", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692658418, "uuid": "41d660e5-f08e-42ce-ada8-fd4116f91c25", "comment": "Malware payload", "value": "693996b2e84abbee5e28d32be5b6a2843dce7c96574a61c11bfb94bfd6aac2e507de973c66578eca58ae2f7a16489978", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692658418, "uuid": "bd5bbd3c-27c6-4954-89ad-0dc291d397e0", "value": "T139F5EEE784C42CC293FF041525A3EF6032BE2584A138D24F7C591CDB688DD95AA5FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692658418, "uuid": "22d61117-244e-4f00-bf22-898456a8ae68", "value": "24576:2KyTK3lpgjVaC5CAfmXAYpDRvGGOtL0DBlkyYXPGEIwP:WCPeVa4/fkAqD9U8BKJ+EI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692658418, "uuid": "3e91d51d-80c1-4061-9cc8-e33c761c8110", "value": 3375948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692658418, "uuid": "ac08a268-314c-45f1-9109-f0d2f6b214f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692658418, "uuid": "959c6962-a011-47c8-a56d-947b5f532e60", "value": "installer-package.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd24a0b-3ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1692602789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602789, "uuid": "4b318abf-8b0b-48e8-8e9e-c777412f2cad", "comment": "Malware payload (AveMariaRAT)", "value": "a545baf24459d8744221b6e5ddd3c907", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602789, "uuid": "129718ea-061c-4e45-abba-8efb42390a8a", "comment": "Malware payload (AveMariaRAT)", "value": "fddc45c619ef155f89b380c83d461f9f84470651d39a297213a61f90a9a04322", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602789, "uuid": "578ce8f8-33cc-4728-a168-54be6b00d4e8", "comment": "Malware payload (AveMariaRAT)", "value": "6ee5e869ad9ed84560fc77ed26144078c6d01abb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602789, "uuid": "8a260784-6fe6-4224-a694-2e09f3f0bef6", "comment": "Malware payload (AveMariaRAT)", "value": "6f885f0ef0804f815b90754bfc0365002e861ec4224e99eefa2509a754a3ce27dcb65d434d8c8dddb0622142d8a9e3dd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602789, "uuid": "797c6f67-1441-4573-9b36-adfb3ec9eaf8", "value": "T157752207AB4656B5C5445B78CBBB732083F0D656F733C24B7C4D63962B03398AA66A0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602789, "uuid": "552bd0ba-87d5-4c9d-999d-03c2e5503cb4", "value": "24576:vptSQ/hf724aRHAPPTNmVM4BbuItN9/r7TDW3aYJWq9F0RPEzbEyLoPhC:rl2ForNtMghJ/9GPAIyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602789, "uuid": "0612784d-94db-4ae9-bbb8-28b46b67b6f8", "value": 1686528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602789, "uuid": "e50ba0d6-d91c-456f-a7ab-08faab6b1fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602789, "uuid": "89b45195-a08b-4a2c-85c6-fe6d0961bf36", "value": "QUOTATION LIST FOR TURKMENISTAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951afa6d-3fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692595718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595718, "uuid": "803345ce-019d-4be5-85d1-4b16c13bdb77", "comment": "Malware payload", "value": "68dcb77e95bdaa5c542f0cce1774c53f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595718, "uuid": "5ec09677-24c1-4de7-9f79-ce5b4fe5e2bd", "comment": "Malware payload", "value": "fe4feab807451ddd836adbe040d8494c901bf9500564c31f8841033b0d9fb916", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595718, "uuid": "dab756de-84fb-4986-9a7a-b921af2bf4b9", "comment": "Malware payload", "value": "fd6677e135355b9b1825a673d7fa76c74914e69d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692595718, "uuid": "376ecabf-1c48-43cf-8070-a46f012c989a", "comment": "Malware payload", "value": "0096216594dc3e4569fb6ee65fe0c577db9ae18f67d11770bdfb764d3407cafab2528c1a338a52ccbd007aae40d2bebd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595718, "uuid": "39b5f241-b3b0-4da6-b42e-d2fa8c090d5c", "value": "T189B3786DD34F01A9CF52527B9B1A0E8541FCBB3EB28411A2346C537933EEC2D91266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595718, "uuid": "6c6e14a5-a12a-4824-8ffd-3465c4b7dfb7", "value": "768:qwAbZSibMX9gRWjN9FdyZPZMiggy2CFZ7mKMb3S8iQ7n:qwAlREwZPZMHgxCFZ7RMb3S8bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692595718, "uuid": "8dd69b68-b7c7-4e20-8f24-2383927d5a8e", "value": 115122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692595718, "uuid": "d4947082-d9c1-47f9-9313-a1be2db5b481", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692595718, "uuid": "4de0f3b6-9e09-41f5-ae1e-46e27fe6fe54", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.4766.27344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcd2ee6-3ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692602762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602762, "uuid": "fb51b52f-5f62-4e7b-8399-7e994ede7590", "comment": "Malware payload (AgentTesla)", "value": "211cc9065649db3cd6d2b27b60904f62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602762, "uuid": "1e021a51-c563-47e9-b8c7-637b9e6fb23d", "comment": "Malware payload (AgentTesla)", "value": "fe8fe2d1a57f344afaebc018a90acfd787b897b2a5baffd045980ff7a5c00bc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602762, "uuid": "99f6e3cb-b23e-4125-8545-2c76b4432c7e", "comment": "Malware payload (AgentTesla)", "value": "6c724039b6995607dee6d5d6a48b06c806eb355c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692602762, "uuid": "8641c7c2-63a4-476c-bcb9-601e5b5dbc90", "comment": "Malware payload (AgentTesla)", "value": "5411320de30f26a5609a654ba358d68798628a918903a9f532af1a24cf5fbf05c95b89850ccb8c73e04962ca05bc6b8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602762, "uuid": "8bed0bae-a1f2-4d0b-aeb0-454da1040bba", "value": "T133E4F140326C3F73E8399BF55022A9500BF76C5A60BAE94C8ED379D72276F424E16E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602762, "uuid": "f89a62bd-36c2-4686-9c5b-8120dfa5edd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602762, "uuid": "39eb29c8-dcac-41bb-afd2-24788dac3920", "value": "12288:3W23/gPrk6AQRxwZlOK1q3hfwqrSg/b596cBs2yov2QdOBu5p/I:dwrk6VqOK1q3hfzSg/j6cjyC/dOBu5pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692602762, "uuid": "199d924a-9764-4027-a3ea-ac7d94a3ed7c", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692602762, "uuid": "345ac638-a6e6-486c-8707-29bb63248c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692602762, "uuid": "eb8223dd-3132-4993-8a84-82eeb294721a", "value": "2023080181301512300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7d33ce-3fb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692576006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576006, "uuid": "7f5327a3-3e73-49d3-a072-c068b2cb6446", "comment": "Malware payload (Mirai)", "value": "ed941bbe5ca58e07be54f0ee85ab54b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576006, "uuid": "477bc6c9-4438-48e8-bca4-0c75b5570667", "comment": "Malware payload (Mirai)", "value": "ff0e259318164b9627a3d230d85a7b0d3dc185075edd9112a3451924b4b6d056", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576006, "uuid": "133330a7-4b55-4e2b-9e03-d82b64da975c", "comment": "Malware payload (Mirai)", "value": "3bda0369edc82fa7d4d7c388cb8b986c921c7b3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692576006, "uuid": "b7db4323-0297-4fa2-8980-19124c0edd87", "comment": "Malware payload (Mirai)", "value": "a2bf1c67247143a92ea6d710cabfe27b1673f8454a0245e75c91d24be5dfeba0268194e135d22033ae55ba6338722aac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576006, "uuid": "f7a77bc9-be1e-4edb-a3d0-2aa021ec1bc6", "value": "T159243B46E6409F17C0D317BAFA9F414933329BA4D3DB730699286FF43B86A5E0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576006, "uuid": "b028cc3e-a556-4ec3-abc3-9f087cf247fb", "value": "6144:LbGKsyh8O2Nia5ZjQwQmLoGtKt6Srjq27yETKs6TeFM/96fnSSmuwgFUdWYS:LbG97ia5KwQmLoGtKgMq27HTP1i/UfF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692576006, "uuid": "04cc43ed-f4e1-4b9b-9b8f-de9a1dfb1444", "value": 218514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692576006, "uuid": "a1b00155-2019-4f89-bb57-d8fb91c5b6e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692576006, "uuid": "1321c54f-9a9a-45ac-af64-8ede11654da7", "value": "cutie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }