{ "Event": { "published": true, "date": "2023-11-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-17", "timestamp": 1700265782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "926a3dcf-8049-47a0-a909-4ff9b6336b7c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff35f69-84e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700183199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183199, "uuid": "9d2a3f88-e4dc-4d86-9266-1df07903d7c4", "comment": "Malware payload", "value": "11ce708f6d75cace2be219e79966fdfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183199, "uuid": "ea4840fe-3abe-46f6-9bd5-7ee2bc4690db", "comment": "Malware payload", "value": "00d943709baa0d034312f4d6ee584ac89e9e0546007c91bc187d2b0209e39e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183199, "uuid": "1bb50e65-9217-492e-81e0-e125596c738f", "comment": "Malware payload", "value": "731544b54c025d43f819300047b8ca378d7eadbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183199, "uuid": "ceb31696-ccbc-4a8a-b21c-303ef784b7cd", "comment": "Malware payload", "value": "5d165ecca16b3743deebd24a3c7f808ea8315bd9081392e545332644ed13cb2c50ab4abd3af33c27fabf2afc263ecf30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183199, "uuid": "d1b1ce70-33d9-4190-8367-5af298a52f00", "value": "T1FF344C1392E17DD2F9268B728E2FCEEC76AEB5908F49776D12589A7B04F0072C163350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183199, "uuid": "70947474-e97a-4126-a5fe-dcbf08399027", "value": "4b036b1ebc23e5c5c9b73c2e7870fe99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183199, "uuid": "9c54cd25-2aa1-4b3c-a246-cb7b356ae7c6", "value": "3072:gP5fLBqM/pLeAiHu5N3rQfeifuJKJKROwAeJN1u/z4G:6LBLLZrnJGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700183199, "uuid": "6e8ca06b-754a-4b80-be20-62c54ee4c541", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700183199, "uuid": "c7ff9de0-2f82-4cc2-8304-5975e51ba978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183199, "uuid": "58f011a3-b267-440c-9b4d-48a42ef2d2f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c78c187-853c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700220559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220559, "uuid": "e7d95459-19c0-4c9d-bd0c-6abd6541f785", "comment": "Malware payload", "value": "1ed9f9bb8c6f1d5c482b4bbf61cf8ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220559, "uuid": "bd400eb2-b5be-41a7-b3ee-d93290b8ef60", "comment": "Malware payload", "value": "04f692202efaca511b15aefa33daf5bea9287c8e8947fb62e92d3825e5ec04ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220559, "uuid": "7a84d86f-b035-4699-8ed7-857c9a46effb", "comment": "Malware payload", "value": "945b9bba996c54233daa15be3349441286b040cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220559, "uuid": "aeca4262-9faa-41c5-a7ef-f3cba2696f4d", "comment": "Malware payload", "value": "1fbf6b4f13d94f5f66d2b688937e563d43cedfa57b4714b146d94f11231f1aea85beacc8dd1a7f855b273dc33ad0e6c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220559, "uuid": "0592e1a9-6b04-427f-8504-3d5184311713", "value": "T1E435F117FAAA4EB0C6C91737C6EE52142774D782B293E70A398E13ED1803376EC25597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220559, "uuid": "a46d6124-16be-458e-a2bd-960d401bfed4", "value": "24576:BKoDXIOa8ymdLfTpg2H2j6QOsHEARhz0YYeqkkaNDd1:BaOtymdL792j63+1z0YYqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700220559, "uuid": "dfa8777b-257f-4ae2-b8d4-41e9de54af72", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700220559, "uuid": "2b923fb1-5c8e-4927-ae5c-b8e658b7e1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220559, "uuid": "41ff40a5-99c5-4795-958f-025d819805bd", "value": "SecuriteInfo.com.Win64.PWSX-gen.15914.1593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b994c205-8545-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700224500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700224500, "uuid": "1b72434b-d213-4fff-91c1-ba660c8ef895", "comment": "Malware payload", "value": "9bf6ca378047e98025ada5c22ca2eb74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700224500, "uuid": "0ab1a021-2b25-419a-bdf8-51cf57289a11", "comment": "Malware payload", "value": "0a453bb9fad90369d0de1b1c13a3f8b56241d90c81a3f1408d99072dd6d64ce1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700224500, "uuid": "a6f1bb57-f278-477a-b7ad-7c1456012b1f", "comment": "Malware payload", "value": "bd2b7667185f3539da0ceb872459ffaafb26b162", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700224500, "uuid": "5605b98d-ab3a-43a3-af2f-f2843319b129", "comment": "Malware payload", "value": "ec3c9c18629c42a3bf1353c574d0e1476eeae054f2dde92c556f49fb4798f544d30bae603debc2bd29211c59fe6936d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700224500, "uuid": "679eb208-c0fa-4105-b2da-709bd9be0bc8", "value": "T18AF5D30076E91659F9F31EB526BAB204D83EFCAA8B51C2CF3154919E4961BD48D30F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700224500, "uuid": "d38a2a63-2368-4a3f-80f1-9ba804df9fd8", "value": "4e4a6bcb0a4d906241efada3b9ef82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700224500, "uuid": "921fe935-4b3d-473d-aa3d-08ef92ce0fb3", "value": "49152:MM7wMc13tn/rx+h6a3vHvPaQhVTzCFOU+SHjJmrACuUm7fKFQvs1:Xux+oiCQhVTzCFOYHjYrA7v7frvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700224500, "uuid": "1b016de9-1ab7-4207-b99d-bb016b15a608", "value": 3394104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700224500, "uuid": "aad8d16f-1852-41ed-bd3a-cf74f7d4ed07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700224500, "uuid": "119b2631-b73d-4e18-8249-34bf35fbd541", "value": "9bf6ca378047e98025ada5c22ca2eb74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c07bb47-8574-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700244610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244610, "uuid": "90c17ac0-a775-42a2-b36f-539f254ce874", "comment": "Malware payload (RiseProStealer)", "value": "834c2d9c64623afe284bb1f53c783520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244610, "uuid": "b4d1dfc8-503b-4e5b-a8a1-61922c1d1dfe", "comment": "Malware payload (RiseProStealer)", "value": "0b80450a115b0d5e7f1cef47a0266057a79c3329e4be71b8517c8c7fa61739f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244610, "uuid": "a9c56e67-bf6f-4c68-88a0-49119c5014b3", "comment": "Malware payload (RiseProStealer)", "value": "0b71400e0079a79cc16a8c5ade9a5b8ad56b1bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244610, "uuid": "be08b8d9-8d98-4c2a-980d-7b217707c5ea", "comment": "Malware payload (RiseProStealer)", "value": "0861fc4acbeb239bdfdcfa2ebf97be0a7a1447dc59d70f82d15629bed03dc0c3a25de69e430494f94fb2191a61964959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244610, "uuid": "13e73321-1ce6-4104-b952-972252a61be3", "value": "T105652302EAE514B2DDB92BB058FE17D31B34FC729D72421F5B205C2E06B1565A8B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244610, "uuid": "1ffd39fa-d345-4772-b212-1b094ad58c16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244610, "uuid": "76090285-e578-44f4-8334-815a222de02e", "value": "24576:DytpayTsVqGMLzevj5kBCOMYz7jjVI9OpgGeH6YCk7pLmXu9z6nfy:WTayTBGIK75fOMYzL3MH6u1Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700244610, "uuid": "c2f7d1e8-9ca5-45e3-8a1a-2e728a17e83c", "value": 1491968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700244610, "uuid": "2763fca3-4b93-4ccc-aa63-71699d89e260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244610, "uuid": "d8a740ca-ef66-4429-a800-15aa8954788a", "value": "834c2d9c64623afe284bb1f53c783520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eba620-8537-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700218235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218235, "uuid": "60c65fb4-0451-4fe4-84d3-7549550dd47e", "comment": "Malware payload", "value": "8eb1da1ecbc83a38d6217b3a0b09229f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218235, "uuid": "ed166a40-d49c-43d7-9a76-83096de66bd5", "comment": "Malware payload", "value": "0be2e0a1c628065bbaf48b0cf627a0a32323fdaa377b1aa7c667ef674124397f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218235, "uuid": "d3a34677-e225-4e46-a3ca-8f2818954f50", "comment": "Malware payload", "value": "f26d719a346d4476d46af241bd3a9434e7c83e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218235, "uuid": "4730c7e2-0b4a-4178-9f56-0afdc0bd9bae", "comment": "Malware payload", "value": "245e38be03ec55d467e3de2e0ddf86eebf1e10a2c27962347a3c2e491a991fab0d7c8baa688d10df5316556f20de3d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218235, "uuid": "59960ef0-5300-4c79-b689-10d3a385e9d8", "value": "T14D66334873640CD5F9B6953E88524134D5B2B8224B90D29783FCABA72F976A0BE7F740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218235, "uuid": "2efcd6a8-50a6-4fd2-8846-f0b01774a98d", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218235, "uuid": "40c8bf96-526d-4e9d-ba7c-54efe3ddb85c", "value": "196608:2FXW5YICteErownP0oTcMsABqPEOzgunZn:0hInEroeMogFABqM3un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700218235, "uuid": "8893811b-2da2-49dc-a876-f7325faab738", "value": 6573601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700218235, "uuid": "e5a76547-f46b-4911-8ada-a21f15ca24ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218235, "uuid": "26872d33-7e31-43f9-b65b-26320e049c1a", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d14f796-855e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700235190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235190, "uuid": "5ed2e54c-667c-4bcb-b2be-ad2c8fbb2026", "comment": "Malware payload", "value": "1e723a96f93d0f5a6319413595660f4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235190, "uuid": "1ff38d43-f60d-4c8a-9b55-45446ee554f4", "comment": "Malware payload", "value": "0e093049b2e7265ce11c541b4f4d9125d44f668fb51ed397c51545c6b46f0fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235190, "uuid": "3a7026d5-5ab9-4f23-b9a0-4f9ea99dfd1b", "comment": "Malware payload", "value": "4741d4d71cbe09bab41808a29c83f28c449f3ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235190, "uuid": "fcbce117-8bee-43a1-81ba-22e2da8bfac7", "comment": "Malware payload", "value": "2dfcda807967c6b64c5696ceebbb47bf184d02f0c6e571a1b8bc55e1278ef416a90549f0f8ba3ab6d4936dd3e8733ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235190, "uuid": "72e87964-1c1e-45b0-bdd8-b993a3b1e33a", "value": "T1D9442B0342E17C54D92A8B729F1FE6EC772EF6508F597B7912289E2F14B02B2C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235190, "uuid": "56b9ab60-9ae0-48b3-9840-e1bf65be388d", "value": "3cbcbc585b75792bafe59018ed63eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235190, "uuid": "a0c74518-47e9-4172-be7c-d6d444a3c26f", "value": "3072:LN/kOdzXtLYeZKpK3SYSzks/sxL4epLwTpKuQwtJl9JUeNHEKRqxYtw39i3Fb:LNciLfKpK3WQLspKuQoZJ9HmxYtwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700235190, "uuid": "6a1af6c3-ab19-4dcf-a4c4-43a77adb4fb6", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700235190, "uuid": "c63a893c-8168-427a-a2d8-8804403b577f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235190, "uuid": "238276fa-a8b1-4809-b970-c914c518f3a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a985a890-853a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700219749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219749, "uuid": "787c7f70-dbba-4c1a-8d4f-6baffd9c95f4", "comment": "Malware payload", "value": "8a039073c814bb9d90789ee84a07cb1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219749, "uuid": "dac062c9-2d42-4cfd-8157-5ce77ce4749b", "comment": "Malware payload", "value": "0f0faa3f4e0604f70fda2093c95ef104e55ee74575466c1b8ab4c77f28174ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219749, "uuid": "f732299e-7c2e-44c6-a904-cf64edc4c3aa", "comment": "Malware payload", "value": "afa0ec9943aab246736b7e35bac1922d331a2241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219749, "uuid": "ae327e1f-2e3a-4d7b-91f6-9f50af3943e3", "comment": "Malware payload", "value": "417a787226c96a4afab3ae58fd766e6ce455f6b16ada531509fe291fe9fa3ad875b964585719236343eb2d88b1c604b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219749, "uuid": "2701cc40-e090-4d73-bb12-b8c98d9bbc4b", "value": "T1B8F47C4373D6C8E1D1471BB7C49FA5201378E98EA2A7CA0E3A8677661C933626C4774F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219749, "uuid": "79c38f11-0f1a-4315-8a58-78c356b25480", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219749, "uuid": "64a90701-52c7-472e-a61c-f08a1375ff67", "value": "12288:bE1iBDKeK07Cl5Wf4nniAWxiq0cI0DrSqfKbgu/SityjK:4wDKeK07gE4pWxPc+SqM/dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700219749, "uuid": "21d1df5a-4934-4f6a-a42e-499130ec1930", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700219749, "uuid": "10d61d52-b872-4434-8a2a-07647ef2ad2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219749, "uuid": "168ace22-049b-44d9-9345-046cd9ff710a", "value": "Payment Voucher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c212a6-8538-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700218660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218660, "uuid": "fc23b0da-f673-494e-a725-e7f717f944cc", "comment": "Malware payload (AgentTesla)", "value": "03d4cd64d2f6d5f9a8897f3507b6e4e7", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218660, "uuid": "3e0e7d7a-34b9-4314-a747-79bfc2189373", "comment": "Malware payload (AgentTesla)", "value": "10c7529595589edaefb4335f222e725d1ead2a883894fd582651367a47f1dcf4", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218660, "uuid": "790f1bf4-759d-4e23-9554-1ddee9ae2e0f", "comment": "Malware payload (AgentTesla)", "value": "4e38f8f98142501e83e309d1a30215e2a7e17b7e", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218660, "uuid": "5be4ffc0-b5ff-417d-8f85-e1837892bb0d", "comment": "Malware payload (AgentTesla)", "value": "9143f5e2bf956edea3e089fabebfae8320e7a29bfa595ad529780a21241288f0eea9aaa210f791a497031eda74229b50", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218660, "uuid": "9f5a7ebc-a93e-45ab-8442-813a854d8e7a", "value": "T13905331B55E22052284C070B9FF0D399945F4DE4C028B69EB7E569DECDB0E2BBE2B174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218660, "uuid": "164b1b3a-224c-4a48-ae0d-bacf43fdf952", "value": "24576:wXWXqjomPG9AdgogzenBAiYQ5ae9F8Ii5n+DnC:wnjomP+AjgzenBR5Jf8N5InC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700218660, "uuid": "44e297b2-0b45-4533-ac81-b35548b3c20f", "value": 856653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700218660, "uuid": "1714be54-dc47-4696-9125-3d22956ca805", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218660, "uuid": "0d4abef0-6a1a-4e35-926e-f129ede983ed", "value": "New RFQ - CO213538PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff91668b-8536-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700218175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218175, "uuid": "d05965dd-c422-48e1-bb3e-b098d0185cca", "comment": "Malware payload", "value": "122dab9ce8c4dafdebadc3aff6ee4f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218175, "uuid": "12a8285e-c0dd-441f-bb73-7382a549c1f5", "comment": "Malware payload", "value": "1186dac5cf754305a3faf7a6a9fd3ab02f1eb8272e56e23ceddad9cdab50aa2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218175, "uuid": "47750f18-ac6f-4d5f-af09-bb484e952ce0", "comment": "Malware payload", "value": "2a5e8a942d49f1b278cdeb7d450bbbf46ead7eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218175, "uuid": "985a1218-8e87-41fc-b41e-7c2ff3084d37", "comment": "Malware payload", "value": "3d8192f4b6ec4e7e6ae5b9260a8a58529be7528cc3309efe1446b7996601589c01bc9a0c24d0a3faf3867e80ebdcbaa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218175, "uuid": "4bb039b7-5506-480d-ab75-e4ba742f583b", "value": "T1006633A85A802CF4EA258235E983D52BD9323C738351C58B475CBF176F639C2AD7EB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218175, "uuid": "435dc66c-39c8-4f92-80c5-e4779575a24e", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218175, "uuid": "855841c0-31bc-46b8-89d9-3e209d04f4a1", "value": "196608:w5TWDyAAYG9xzHkkUo80YBgSEmmvz87okj:+cxPG9xAkJ80YBBIzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700218175, "uuid": "27b0305e-34b6-45a0-be53-310372d18dd3", "value": 7035396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700218175, "uuid": "49ef5a0f-f7a1-411f-aa87-311ce266c11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218175, "uuid": "e688f58c-a80c-4522-9660-596e5be8b7ea", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9fae9b-8583-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700251220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251220, "uuid": "0ed7fa43-bf43-4047-91cf-5143c7176d1c", "comment": "Malware payload (DCRat)", "value": "200fbe006c4bd2254f52a2511351db06", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251220, "uuid": "4de4f248-8231-4568-b3aa-1f64903df4e3", "comment": "Malware payload (DCRat)", "value": "11e9006a70a09fdb18197a2ab767335abad8b628302345fe4a97cfd52fca0358", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251220, "uuid": "1d9badf9-ebb2-45bf-bdb8-053a9ea9be9d", "comment": "Malware payload (DCRat)", "value": "a861260bf97882d4c9bcd8c8ff20f55bd76ede83", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251220, "uuid": "db863c37-2818-469b-8c64-98fa74aedc87", "comment": "Malware payload (DCRat)", "value": "1d8f2534395c4437cd554579da2c49db161484d5acfd6e9c08aa8e79c0fffb025948f4ea4dbcaf37da0364fabb0708b2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700251220, "uuid": "5d273b09-7581-4157-8504-76055999c29a", "value": "T176355A01BE44CA21F0191633C2FF495487B4AC106BA6E72B7EBA376E55123977C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700251220, "uuid": "6d4c52a0-9e4c-46d4-907c-ec457edf72e3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700251220, "uuid": "4149759d-9b3e-4890-8bc6-ed8c28f9bfca", "value": "24576:U2G/nvxW3Ww0tAz3pfv5IOTh+hGBJgHUvhMUo+VdiYm:UbA30Y3nVd5xTo+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700251220, "uuid": "d8a87955-ae98-41d2-a3d4-f5479ebe5103", "value": 1163352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700251220, "uuid": "ced7ae5d-bec3-4754-bb20-09eb424b93ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700251220, "uuid": "98609bd0-36b4-418c-b8ee-5bd5247af878", "value": "200fbe006c4bd2254f52a2511351db06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55d8a53-8570-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700242935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242935, "uuid": "7ff01d1d-0985-4d2a-9698-a923ceb6d098", "comment": "Malware payload", "value": "832e09b3a31ef270c0c1538612fed5b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242935, "uuid": "4721c921-e5f2-4acb-9a12-ccb0630869ae", "comment": "Malware payload", "value": "12764f4502db82d167aab4ad176f468d443488099d7f884359c98a2d45587711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242935, "uuid": "52707792-3271-4409-a18c-13767348ea28", "comment": "Malware payload", "value": "cb97a5d1d84a1b0737a2b62a3a42bf88f9a1189a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242935, "uuid": "7eff7183-1446-48bf-b856-0485e65a9348", "comment": "Malware payload", "value": "39e978383a966735e0f6a02764e9c97bb71aeea786f80b22150d556405b7a2fde0954a61c9d2aab2dda4c0b63e4626e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242935, "uuid": "e7943554-b7db-40ac-9ba9-8dcdbdf2c043", "value": "T1B8447C2362E0FDA1E92647728F3EC6EC774EB1608E55776A22584E5F48703B1E163327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242935, "uuid": "7d7f6c80-8440-4d2c-bcb9-9e55f587f321", "value": "3af1886f786e2122c71384398144c402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242935, "uuid": "3a3f1628-2a43-4390-a072-54e091917c74", "value": "3072:C4IBUHamI8MBGdxMludvBDhS2A2tNGIrRM6FcJg9/p4CC:9CE5IJGdx8Kvu3wA6FcJgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700242935, "uuid": "c4bce13d-b1dd-4308-a76e-3ada7f1f3239", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700242935, "uuid": "fc034090-4849-4b79-b3a7-3054f8b8e633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242935, "uuid": "22c64e4e-ecbc-44f2-b036-180b125fe9d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8380e8-8552-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700230169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230169, "uuid": "9277de13-a162-48f8-998d-8c7bd9f97e66", "comment": "Malware payload (AgentTesla)", "value": "5e2e4795b4ceb115db820f4848a878a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230169, "uuid": "a7c20a14-dc69-4560-8deb-b81ded0ee15c", "comment": "Malware payload (AgentTesla)", "value": "143866d0bdfb3b9317c58f0eb7e69d29d5e275a5ecd873278e984fdf77023901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230169, "uuid": "d2c8bb7f-bb40-40e6-83f1-c42965ba9251", "comment": "Malware payload (AgentTesla)", "value": "970cd3022a7c867c6ce4456c9843e54aa7c552be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230169, "uuid": "985e664a-e8c5-47ee-8f0c-298bdc5c76e1", "comment": "Malware payload (AgentTesla)", "value": "cf9c9eed2af164ed70610319801a5119bfa80b6f7f979ab47a9dc62f926c0d1bbc9416b399ab83001b9618a77b3f978f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230169, "uuid": "43cd50a0-aae8-408d-8787-c5aa88b5168c", "value": "T17D35173C2B9A0667FCB9C7E6DBD08127B661AAE7B119DD24D8D213C65712B4274C023F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230169, "uuid": "83a9da40-e33f-4c52-84b2-e49f9e0f3983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230169, "uuid": "2e113f30-bc3b-483d-af48-4a786ef29b17", "value": "12288:yozVJBHj4co3Ba/mFiTEJ0+0OR8FCkot07UMGRZ8ncv7gVbl+7crdPwtHJzDVmG8:9rlE1n07Ugbl+7cZPked7ilrt30Kyca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700230169, "uuid": "3625dadf-395d-48e8-b8e6-9035c3308471", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700230169, "uuid": "e13b4ef2-39f6-4531-b55b-fab80a7564aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230169, "uuid": "c3076ce6-7ddf-42c9-90a4-f4524d542124", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db4c905-8552-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700230037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230037, "uuid": "1a3b6884-1116-475d-9a50-1abac3f32725", "comment": "Malware payload (Formbook)", "value": "cb3a27d3ec788b089aff106a62cfbb9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230037, "uuid": "95d721fb-d792-4c3e-8773-7caa569d9b14", "comment": "Malware payload (Formbook)", "value": "1438d6560513e13637d36ec1b71f07ae2ead032e83fe2233f3b1775bc16e1f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230037, "uuid": "a36bc597-d7aa-4cf9-a4a5-2701241a2d64", "comment": "Malware payload (Formbook)", "value": "e8ea0a3fdb4f5114dc88cb679016f91a6c073259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230037, "uuid": "5e9c9e71-9fb7-4a8f-9559-e40428e19634", "comment": "Malware payload (Formbook)", "value": "14fd583603446539bc2e28fdfe4ee2be75cb12af2440532571a2772f1da35e3b1e5f53c4de4909a39bd9d22ee17d4c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230037, "uuid": "612e96ba-7a79-4bfc-a94e-8af562c762ba", "value": "T19BD4012D8BD8FF53C7FC26BDB4C4651E9E71EA831A8AF747A98DE5B144073308960252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230037, "uuid": "b55052a1-1585-4e0a-856f-0790e91223a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230037, "uuid": "564f7259-0976-4486-a2c7-6303bee0df09", "value": "12288:e8718wkx7U0MYzIsNCiKRUvIpZEWmHWYfHEeeK6M8lA/+LjLQzBm/mdqV:e88wkx7EsTCizDW2zTr63lA/K3+cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700230037, "uuid": "7b17add4-9a0c-4cf2-ad5d-764f777bae59", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700230037, "uuid": "0f7507a1-f27f-4a1b-a2ae-b82d99e7e0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230037, "uuid": "36af2733-7b5d-43de-9063-4179964d53b2", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbd6113-855f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700235379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235379, "uuid": "1e1bbd60-16a6-443c-a873-c93e6fc0bb4a", "comment": "Malware payload", "value": "9bbdc08c91d9231f3508b97d8775e923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235379, "uuid": "0202ecc6-620d-4d7b-9590-da09c181f1c2", "comment": "Malware payload", "value": "16c61a49974e3e90f1c0514b86cdb70e4464ef0aa1620ee18d30233985ebcbd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235379, "uuid": "cc3e1ca9-1988-462c-9238-560dd338f063", "comment": "Malware payload", "value": "4d7cb7cb4bc77fd227b0ca5c67ee0eca61ee665c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235379, "uuid": "3abd3d00-b6df-4cd4-a041-6a696386fa0d", "comment": "Malware payload", "value": "209ad356bc305a3324ebbb306d524aa43ec3af551a2a7028a8dbb3598913515b0a4b7e55e29b28cc606800eae07ad29f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235379, "uuid": "8d1460da-3561-4d28-975b-22505c5b1149", "value": "T14F0728C7E85100E5C1AAD37485669262BA703C8A4B2027D73B5CFFB82F36BD49E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235379, "uuid": "b10c97f3-2798-4f1b-8d46-182456032332", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235379, "uuid": "e4baed80-bd6a-4484-a4e0-69483807f4d5", "value": "98304:W6nN55/QsY3Jphmt6PaB2//cDo49DctkfFG/3s0OCwEz+ni2YJ5j91Uo:Ww7dfYC6741FGz+ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700235379, "uuid": "f09ce1b8-ce52-48b1-8132-6c25652c8b5f", "value": 16866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700235379, "uuid": "247c8905-a504-424b-b039-c4d045b46712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235379, "uuid": "24384ea9-c10b-4779-988e-8f3b0549a2f9", "value": "SecuriteInfo.com.Win64.Evo-gen.23946.19054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59530db9-8519-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700205441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205441, "uuid": "6cbaa9f3-d696-4cb3-9c98-d4818e2205eb", "comment": "Malware payload", "value": "d3f6d40bca88051421668bd295322894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205441, "uuid": "8eb4baaa-1d89-442d-a003-3e0fec38dddb", "comment": "Malware payload", "value": "1c93b99d8e1968867508692feb30aa67c0a48a2a623704f982d1dd9754125ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205441, "uuid": "0910e8c2-6e16-42c5-9016-c76081a29264", "comment": "Malware payload", "value": "5bd5d07a1d69297ace31b8851168282f99d6becb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205441, "uuid": "e501e40e-1877-479c-9388-a4e1f71ffa14", "comment": "Malware payload", "value": "3fc9949a288a021d9d4ff231b150f60eed4bbf376dbac4c04f0ddb8d86d0b897a94cb903b23eea938edfa803edf162bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205441, "uuid": "f1526690-c1b4-4fb9-b649-5f360b159c82", "value": "T1E044290392E17F56E9668B729F2FE6ECB70EF6508F49776912199E7B04B00B2C163350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205441, "uuid": "c0f96d35-fe4a-449d-960a-a4ce0451fb62", "value": "0a51b1dee43d79ab01dde11c015d41e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205441, "uuid": "86395bf2-7f68-4e80-957c-f2b352099ffe", "value": "3072:WA/kRL2i1bPY5+FYGvdktSdNAaH2YVlFJqZDClXRtd3FeJ21ls/zvl:3kRL2ODYcfkMvz7xhde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205441, "uuid": "30c40e03-3d65-43ba-b891-d017fefd1a87", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205441, "uuid": "84af76f9-6b2c-4ac4-bdc7-285299315330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205441, "uuid": "1238e0de-083a-40ab-9c99-cbddb9bdbddb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387d59d0-8515-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700203668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203668, "uuid": "2d750a9a-aef0-4359-a9d4-0416047b78a5", "comment": "Malware payload (Formbook)", "value": "e9b37a468b48222b906518483dc48b55", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203668, "uuid": "224e2edf-cb21-4b1c-9e8a-25d3cfcc7c76", "comment": "Malware payload (Formbook)", "value": "1de8fcd8eba96e2fd7040cc0f69a1c9a12dee721f39be7d1a8a342bcafd328da", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203668, "uuid": "493d8626-0995-4144-b83f-6cd938481d88", "comment": "Malware payload (Formbook)", "value": "cd96dd2df238d42489a3f56b6417443d91b6390e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203668, "uuid": "d7e5c33a-031a-48ef-96ba-e13ef63cf0d7", "comment": "Malware payload (Formbook)", "value": "e2a76dfd8ef970b4079ba7865a48687aa24f871d29884cbaf38b53d5d315b4941a38f7d722875f72a9ac7131afa05854", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203668, "uuid": "40582453-8c8a-4354-8372-dbcbdad91036", "value": "T1E9F45EC9856915CE291C3EEF91B83A831FFC8AF7AF040214DA9AB446AD775F18048DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203668, "uuid": "46b2b2a7-0d1f-486f-b195-2724a17dfca8", "value": "6144:IAaqNhcGVUaKjopT+LXdF38sP96tNrPYkMxppelVRKceAsaStA4Chh:DbNhHT+LjMyoN0kg0PRSvaZhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700203668, "uuid": "fef96254-bcd3-4196-a5ab-5434541fae62", "value": 784764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700203668, "uuid": "69719ca1-fd76-47b3-9d4a-022f3c27a720", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203668, "uuid": "ec346916-a2a2-47ee-a9e2-84b684f0e940", "value": "setup.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1fec6a-8548-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700225709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225709, "uuid": "d3b7ac76-9b6e-41b2-abfc-a0493cf516d9", "comment": "Malware payload (LummaStealer)", "value": "3d85c228c83fc98727df4aaf372f9f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225709, "uuid": "90af03d1-f96f-4593-8654-df98ec5d427c", "comment": "Malware payload (LummaStealer)", "value": "1e1eded4c45e13cb89eb8969d9097c394eedefeb13b7eebc8ff3908c879f9084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225709, "uuid": "0d37b0b1-2b3e-4a0a-b5e0-13db4c7cf090", "comment": "Malware payload (LummaStealer)", "value": "5e25afd4882787ba922d98309922e74dda5622e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225709, "uuid": "c381a019-4426-4087-a4d5-6e597b815172", "comment": "Malware payload (LummaStealer)", "value": "0f4a1806f14bae7b29266eed913a944810b7440f79e500ba5425d891e1990326cfeb175e4603d7c03a4839c74bf8b309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225709, "uuid": "aa033d00-623a-4914-8bd7-e82444e93004", "value": "T18EA4CF03D2D17C54EA298B7A8E2FC6E8761EF9508E5D77262129BF6F04B1072D273B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225709, "uuid": "1981c88d-56a1-44fe-84df-92305b77c274", "value": "1e4c03c8d316dc9d74593d2b0d247c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225709, "uuid": "48286095-bf0c-4622-961a-46d8abb84c70", "value": "6144:9Lfdm4+y/0JS5ZSNR9YQ/mtKA/no6HzZ754qCSUrF6ZOlF5cysB1tMK0w56jgMN7:9jdmTy7mz6no8Nd4qCVrFoOJSt0w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700225709, "uuid": "b3f3f3dc-4587-40c0-b715-8234a3ae891c", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700225709, "uuid": "8ccb74a5-d865-4707-8bb9-5f15d975fb9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225709, "uuid": "68b79928-4cc7-4b33-959d-38a698ad6a44", "value": "3d85c228c83fc98727df4aaf372f9f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b233ba-8559-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700232975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232975, "uuid": "bc5fcce6-d69b-4b4d-8182-c14f5c786d68", "comment": "Malware payload", "value": "9a7ad587ebb1677287f7a9ffef2c1a20", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232975, "uuid": "b2871763-aa65-45bb-9b82-adbbe7c96548", "comment": "Malware payload", "value": "1e9a457e1a02eb67419d8b9347893b0634096c892d9edf38e8a231852ef3ba0a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232975, "uuid": "319ec9eb-b84a-4d28-98eb-2d8a7be27f4a", "comment": "Malware payload", "value": "6c4ea120268888b821ce6b13d2965e64200075ba", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232975, "uuid": "190c3a15-a9d3-4e6f-acb3-b1726fff2661", "comment": "Malware payload", "value": "c6cf8204a2879d69a1edcfaa7840e9066c4ebadd437c7e46cf2c38fd39c40f2fc5969f14afdd917f921e8b90e77767bb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232975, "uuid": "454fa834-7c11-44ef-9980-63b15b5417b8", "value": "T1CC4733E971B2E0BEFE4EA0F57157C883156895BBC8387D958D24E540BF33631A6832B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232975, "uuid": "549918a5-1d5a-402c-932b-3813290462fc", "value": "f724bf854d48d0d9304afe0d4a20398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232975, "uuid": "9b720c66-d794-41da-868b-4b6dc157fe51", "value": "98304:uSWRZML74SV5/tehLUI5YvY/hIf4n08IOeGq6Tt5r1MR:uLRZM/4a6XU40K1J5r1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700232975, "uuid": "98505098-c23f-4799-962d-2bd1cbc25d0b", "value": 26141072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700232975, "uuid": "990594c7-9648-413c-9228-e811bde72b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232975, "uuid": "13258485-f08b-4c63-8d5b-1b64b4f8ea1c", "value": "uTorrent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54614d8d-8518-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700205003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205003, "uuid": "e615da3c-8fd9-48a5-9bc9-cf2661725245", "comment": "Malware payload", "value": "0161cdb73a523464e8caeea489bc0eef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205003, "uuid": "12a7db03-74d1-4acb-bc26-b9d153d9d740", "comment": "Malware payload", "value": "1f73e589e5d4828b950b260955970e7aa2986f60ca05a06ba4b4fed7397cef13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205003, "uuid": "a164fbf5-9bb5-4293-befc-5d72ad5a20bc", "comment": "Malware payload", "value": "1abd1255f0dcfa6d75914961edd5f4d0fdec316c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205003, "uuid": "dd84d9b3-356f-45d3-9a63-41c3a722c4be", "comment": "Malware payload", "value": "486caf9d89b4b600b9f04716ac2c819f203d75b24b50721aa82848b793cf34ded3e8e9970c71b9c83a3cd7555ef54720", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205003, "uuid": "a0b597a7-3751-46a6-bc91-920a8578056f", "value": "T109349E1366E1BC61D5328B739F2EC6E8B71EB991CF58675E2218563F08701B2DEA7310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205003, "uuid": "c67cf5a5-6cfd-4c20-a525-38c0761a8b5e", "value": "4b036b1ebc23e5c5c9b73c2e7870fe99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205003, "uuid": "92f02518-d259-47bb-88bd-28803069c60f", "value": "3072:D8g6L03RQS/+Gnm94LvF4bc0hBvU6I6L5KEeKROr0hh1G/ziU:sL03RQU+GuavObc0hJhLUrmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205003, "uuid": "1fde6a65-3dc3-494c-8d03-41cdf045cce7", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205003, "uuid": "d9ca58f6-f4b7-4e8a-87c8-9da733fe38ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205003, "uuid": "a5ffe5c6-6ac6-458e-b521-060baba75e5e", "value": "0161cdb73a523464e8caeea489bc0eef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7424b65-8548-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700225892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225892, "uuid": "08ca0978-8cef-410d-a022-ed3c54c5e56a", "comment": "Malware payload (Mirai)", "value": "56e08e19ff82a944d93fefc1011b112a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225892, "uuid": "1a8c29ca-cbdc-45f1-98eb-eb7a65576517", "comment": "Malware payload (Mirai)", "value": "2032ba1561fdfa8dce836c35bc1f89aa9a806c021f1ed7f7c32324b54e450290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225892, "uuid": "54806d3a-9e12-4d0a-8c4e-be8670f88807", "comment": "Malware payload (Mirai)", "value": "39c7ac391ba16ba49eb6f9fae4cd1fc96ee252f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225892, "uuid": "dcbf8b3b-26c3-49fa-a705-e5f60446cc11", "comment": "Malware payload (Mirai)", "value": "9fc7627c9630c76aba67df46129c7235ddc1fad748657e74e92a79a0db7bdfd257eecdf67b31d32f5d2cb0c05da4c214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225892, "uuid": "ab378d93-c646-42ec-8818-ca1ed8b646f3", "value": "T1B6C5330DB6BD866ED7BE03BF7784760418BFA477282199F64C8C8652C7D85A2DD42C38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225892, "uuid": "0915024a-dd3b-4b91-adc7-12a425b1492c", "value": "49152:hvrDasVvsDPtAHpzin3fj63JZZWrHJL5U3JVV7wWEYItCz:1TUDVAHpzofYnZY5cVVOtCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700225892, "uuid": "7d17cd0e-6572-4ad4-b764-05b5be58c6aa", "value": 2685440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700225892, "uuid": "f89bf3b4-f735-4ea6-b3d0-69323b3c6c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225892, "uuid": "37d9ed96-ed29-4046-aeaf-cd71459c2849", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73d9d24-84f8-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700191506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191506, "uuid": "4ef537c0-654e-4661-89b1-1024fcc25b80", "comment": "Malware payload (LummaStealer)", "value": "dc3d0024b58a56ad2aeec6161bb1aa2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191506, "uuid": "48cd1813-3798-4f16-8342-e470a973b1fd", "comment": "Malware payload (LummaStealer)", "value": "20ec1d947dbe9f6a854c738dbba273cdaf8754e2505f43aab3fd7c17ea4ec23b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191506, "uuid": "ffcadab6-93e7-401b-a626-790390bb1bb6", "comment": "Malware payload (LummaStealer)", "value": "c6085dd73f086a2a6cf0ff18fb72b089ade92c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191506, "uuid": "c12113c7-09b6-40f8-892a-4b8657b0aa4d", "comment": "Malware payload (LummaStealer)", "value": "edad8eed79f7c57beab8fd6aa39504a0a542c77346404db8ef832afec6f9433b5b8878358c9fcdfe71bd418db77c9749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191506, "uuid": "751642e1-885e-4679-80fb-b3c5770dc5e9", "value": "T157A4CF1392A17D96E9278B729F2FC2E8761EFA50CE49776D12189A7F04F00B6D273350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191506, "uuid": "aff9a63b-838c-4e79-a79d-76056a3c83b8", "value": "d95f0de2d3200302100bf757ee3e513d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191506, "uuid": "71cd5b1f-e86b-4f06-8977-ca447b15305b", "value": "12288:ImlyHOWp0AAed9ykVdMWCp09mWk96Jm1M1:IbAYD3CpAlY6Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700191506, "uuid": "e6cf1a24-3e26-43e2-a644-8eb160412da9", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700191506, "uuid": "7808a09c-65cd-4680-9262-eed20bcffa3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191506, "uuid": "0730f3d9-7ae3-4127-baf9-d3256ad6c393", "value": "dc3d0024b58a56ad2aeec6161bb1aa2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f678e8d-854c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700227329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227329, "uuid": "0d7b6f0f-1db2-481b-8a9f-11a7c79e68c5", "comment": "Malware payload", "value": "dec6ead6afa19daeac0bcac6259b5ae3", "object_relation": "md5", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227329, "uuid": "0da43be0-ee23-45a3-90d9-fd49df47f684", "comment": "Malware payload", "value": "214620d45bf8ffd61cc150b79a4c301d64a457b4d5e26aa9640c62504f26aeea", "object_relation": "sha256", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227329, "uuid": "fc0e787e-3e2c-482d-8e62-a2007c1b3e32", "comment": "Malware payload", "value": "093b7695ad08a4ce0d4bb6bfe70be11b01ed8160", "object_relation": "sha1", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227329, "uuid": "0b3cfa0a-6e8f-46f7-ab47-59042df53db7", "comment": "Malware payload", "value": "75572d38a712597c8372f72ae11cfd13810a59e4dc61a745ab7c84f7016ea0e711f3ba893a6f938945e7c8429d4aa0c0", "object_relation": "sha3-384", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227329, "uuid": "e607f9c7-8260-4e1d-9b9f-ea32c76634d6", "value": "T1041500F2B21476E2B2CE81650014BF7983787CE2CDD2937CC72960A11E6BFAD9D15887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227329, "uuid": "1a80d19a-3d98-41f5-8210-bd3e64704b4c", "value": "384:lOOOOOWCOOraJOOOOOvL5OeOiy55OOqOO0OOyOOhOOW+jOOZaOOBKOOqSOOCOORt:3z+pU7lsz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227329, "uuid": "1fc2ea45-791a-4dca-822b-15d4747e6fb7", "value": 951396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227329, "uuid": "dad692f7-5810-4db8-9029-578729383d8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227329, "uuid": "d75f49fb-6907-4f39-acfb-84eea6ead6d6", "value": "KAMASUTRAKIM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e64b435-84e0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700181049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700181049, "uuid": "bd8a901e-5cd8-4173-963d-3ad006420192", "comment": "Malware payload (Mirai)", "value": "c492fbc0ecbeafc05940ee0672d02137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700181049, "uuid": "4ebdc408-c17c-4601-865c-342e9b4372ad", "comment": "Malware payload (Mirai)", "value": "219b6f5e8f526973cb8129b25174b6efef51df69b447d20132b72c899911f7dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700181049, "uuid": "d4c88dd6-d54e-46fc-a482-59acce471f34", "comment": "Malware payload (Mirai)", "value": "07058a9d2a3841607a11fcb645ba9fc534152c80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700181049, "uuid": "8e39ec43-1507-46e4-a9e2-223697df0a9d", "comment": "Malware payload (Mirai)", "value": "123f206fbf47a19538b29bde166c4d338f6de941cce0a8d283722345e8e92f1e03856513f4df0359f75358bd64d0a5e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700181049, "uuid": "4e69a57f-6b52-425d-9e21-117095c58e9d", "value": "T1E513F1D1132127CC8361EA7538BE702A8534552F32E51D003DA7A28EF54B71598B7EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700181049, "uuid": "31e4037b-20ee-4f66-b1cc-16aba69e6f75", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGUf:87vbq1lGAXSEYQjbChaAU2yU23M5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700181049, "uuid": "2056edb6-0a17-4a5a-b091-13d79920b43d", "value": 43524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700181049, "uuid": "ac8baaa9-f059-4858-a6ed-bc1401cdc44f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700181049, "uuid": "a9320051-c2c9-40a8-9841-fdf2140a3991", "value": "SecuriteInfo.com.Linux.Mirai.4338.324.7454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8e6f67-854c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700227302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227302, "uuid": "b51e0647-19f8-40a3-a4e8-af108e4aa691", "comment": "Malware payload", "value": "42793c675abdb127218c7e9bc0440bf2", "object_relation": "md5", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227302, "uuid": "1e6ed470-ed54-49e6-9aad-cbd3bd9cd82f", "comment": "Malware payload", "value": "22a665c4024f8447effbdb475d596d1156ef480edf135fe68c227be840e7aa6a", "object_relation": "sha256", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227302, "uuid": "0a2c8789-7263-4a58-986c-c2507e902ded", "comment": "Malware payload", "value": "9d5dbcad1e98c7d7e90ae9e8c9ecb876eb3aa9be", "object_relation": "sha1", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227302, "uuid": "bd666006-163f-4e1b-819c-0bd1fe4b66ff", "comment": "Malware payload", "value": "ecc0433bf7af7e1922e0ab07953b8b0c5267c244f22d380731b1650b9cd0015558928302ba60b3ffba5a2d4f7bcc6918", "object_relation": "sha3-384", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227302, "uuid": "c229b475-fdb8-44a6-81fc-2cde3032a0f5", "value": "T1477608E2B6143AF1B0CE806550257FB5C2797DA388D2837CC76D60910E6BFED5D2A48B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227302, "uuid": "fa6d2076-d609-496e-af8d-b733987514c8", "value": "3072:rZFDC1zcrwmBEoD/sg1Nz2AmVXzltlETCh+vdZvIddwxNC59EnNaUcQs4/7KSwKU:r7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227302, "uuid": "c8655ed9-8889-4a4c-b2ea-fe04e182bd89", "value": 7179498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227302, "uuid": "57137441-559e-4283-bfa5-bef37d1cd669", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227302, "uuid": "2758c99f-8697-49a6-8c97-79375614fb84", "value": "txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915ec25b-856d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700241613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241613, "uuid": "fc87688f-a8b0-407c-9c2c-7c5b6f9b25ba", "comment": "Malware payload", "value": "34b66d803c875d3b4ca8504db3467964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241613, "uuid": "0f357694-1988-412e-8979-a35dcaf8c1b1", "comment": "Malware payload", "value": "24450ab6087a7ccff3ed532a40d0c8a42452cd16cd409b3c89ab1aab73809a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241613, "uuid": "821b1b1e-7885-4154-baea-f081ac64381b", "comment": "Malware payload", "value": "bf0070b87f926ea0be8a0d59694ebcb629329c94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241613, "uuid": "a02ae04c-9be9-4922-8031-dce90e3622b0", "comment": "Malware payload", "value": "9deb24c96d3e8aa0e15ac0670237f1e6f37ec16217004867c6c04c91a85175b2db5f838e07e30dd7542db834c29aa216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241613, "uuid": "fa9f1f65-d8f9-4047-83cd-ae970c138463", "value": "T10D9408A12ECBDD4DC3865F7E07EDEA39A5BDCF8179194013CB220B49B4B6D8D7881981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241613, "uuid": "998e9189-fa34-458a-a85e-a3b1dd93a8f5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241613, "uuid": "1ca20daf-635a-40e3-8420-463c4ea4833e", "value": "6144:8740Ijz6rELb1j1GSSSSPD1IcccpSISjS6KSSteS5tsLakSSSSRWBzbLphDmSB9r:+Oz/X1SfVXQbTLmTNnpqkgL6dmAuRKJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700241613, "uuid": "d15f00ec-e632-4286-bf68-b2136563f731", "value": 410501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700241613, "uuid": "8f1fcf17-9bd5-4906-9e6d-6490657365df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241613, "uuid": "34bad440-9c0f-4504-a72e-85d9ad7901b3", "value": "SecuriteInfo.com.Riskware.0040eff71.20773.22910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e9d2f5-8564-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700237854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237854, "uuid": "fa1dbcf9-ca82-4417-a2c9-f10590439aa9", "comment": "Malware payload", "value": "f0b64fd58bf7add23da99eab816c35bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237854, "uuid": "141e72d5-fb84-4d67-bd48-76adc0ce1d29", "comment": "Malware payload", "value": "27a00472519ed002a4dbb09fa244c39c4bdfa744819a70e7cd600058ddf54263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237854, "uuid": "c2b242ec-0e24-457d-9904-687dfc61f004", "comment": "Malware payload", "value": "d5dba11da7337534e92550bb37c232bc229848f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237854, "uuid": "e9a50f70-19cb-430a-b591-14edab385aba", "comment": "Malware payload", "value": "20dc0ae144c66f51835d371206be1169729d46f9f47d4b7f37b73e435565ed163312ae6dbe467c502725cb74148d1c24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237854, "uuid": "420c82f6-076d-4d41-93b3-ac3a109e5c5a", "value": "T17B763391BADD8034C4909630DD5169A6A2F6D91B5B7183F73B8C0BAC6BB30B4D137ACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237854, "uuid": "7269547d-3463-4b83-893b-cdbb6eab762f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237854, "uuid": "438aead3-c13e-4b2c-b886-60678ac9626e", "value": "196608:91OlqCTsCfQLGpl+vONZyQeC+XcVQWfXIOwR:3OMNSHjPyQGXunIOwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700237854, "uuid": "f4daad97-0b6e-44c8-bdd4-8a1e8b9316e8", "value": 7546460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700237854, "uuid": "6d09ebc7-1be0-452b-8368-ff1d37852648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237854, "uuid": "b369bacc-ee68-4fab-91ae-da85ccf35e67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccaf1b6-8519-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700205313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205313, "uuid": "22e5a889-53ca-4090-8686-baffea597336", "comment": "Malware payload (AgentTesla)", "value": "ddfe91f7cdf26a72c2f0c92d69a8fb6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205313, "uuid": "c5c7960a-7c5c-4ab2-88dd-529f2bd2525e", "comment": "Malware payload (AgentTesla)", "value": "28ecb6d1b09a39c5958fafc00f93c274e840832fe300643b38584f028582c49d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205313, "uuid": "77fc9ef4-bd32-4695-b123-05bdded8aaaf", "comment": "Malware payload (AgentTesla)", "value": "82b013d136d7c873508a5364709e5a2d3e379113", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205313, "uuid": "9ee58073-7652-4865-b67a-1c31baf2c829", "comment": "Malware payload (AgentTesla)", "value": "bbce236ae12a59ea98c5d2c90789bab98d0335c2556b6a6036183c233167af6c7b1c1d671ee085b3124f9101d89e95cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205313, "uuid": "511910de-b35f-47ef-be45-9d1e30171658", "value": "T16915282C21296F8DF7A492FCB2719CFF13A4682F50BBF5F7894CA0D746A97D05502622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205313, "uuid": "e38eae3f-061b-4b1f-96fd-f3e0cf253fa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205313, "uuid": "7ec3f401-e16c-4136-9cb9-d8e4df5d1a0e", "value": "12288:DOcGkuPUpETxWHP8FgESeie4NXT5GLz+l+8aY6nLSO8GtvFXsNPW:DJG3UpE9WHNeyXT5YSlz6nLSO8avh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205313, "uuid": "0bc2a6cf-5366-4fc2-a155-1037e0a7132a", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205313, "uuid": "bf4c618e-0237-43a2-97b1-de28505b2065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205313, "uuid": "9c5b9ce0-c46d-4b6c-80f8-c49197a38fd5", "value": "Shipment-55019318A.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d67a79-8513-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700202719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202719, "uuid": "cef16f8f-bf38-4c46-90d0-93708cbbaa2a", "comment": "Malware payload", "value": "0b1d1bbc236b05095a076ebf6516954c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202719, "uuid": "5e2a8331-7fef-4b98-ab28-c93bfea7fcde", "comment": "Malware payload", "value": "2a1ef41bfcfc9e279b7586d87f7d6f3778be75199f00d931779bae1de881ead3", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202719, "uuid": "7b508b00-a80b-4f9f-9c80-740330f7ce50", "comment": "Malware payload", "value": "2a39e3ae051c000eeacd460eb89e8897391c594b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202719, "uuid": "8ab5041e-f9c9-4946-a9f9-f0d5733b6853", "comment": "Malware payload", "value": "f4c6daa2e7f687798a25554a0479dc151ecae942a2a5e74b760ef11edb7808160ac6b524360a4fe8259233b60e25b34a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700202719, "uuid": "9b56cd69-0bf1-43dd-ac60-178371784eb4", "value": "T1A194235D4796AD1FEBF4430756F01CAE004EAC8E1CAA7C21754AF1273BBA9D48C47E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700202719, "uuid": "07744798-078b-496e-a345-f5b6a5db9e40", "value": "12288:3opUbEokjEeMxlP4mWwD/fHZ94Pi/lQm+:YebEoAErPm6h94qet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700202719, "uuid": "63494601-6c7c-480b-bceb-12f93473db6c", "value": 417148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700202719, "uuid": "6eece841-cc5e-4fc9-87cb-4b10b606b0ea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700202719, "uuid": "527458ba-da1a-456a-896f-9161a5671c2f", "value": "AI Family Doctor.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dd2d6e-8559-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700233060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233060, "uuid": "d276fb66-5728-4bbb-8951-3fda33992b29", "comment": "Malware payload", "value": "3c3a8c6a192e0cd46d68ab369480aad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233060, "uuid": "9899b051-8e7e-4323-ba54-65c0edbe922d", "comment": "Malware payload", "value": "2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233060, "uuid": "1de82cba-d492-4a28-bea3-e7426312ea04", "comment": "Malware payload", "value": "faad8f2de0d5e991f0c617b71a613e7b77c69fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233060, "uuid": "f8790f8b-3887-47dc-a7c7-c32d7e2ad315", "comment": "Malware payload", "value": "ea2d6f9dc3094bc96d2e014c2bc541a8e470acb90909674fd56f1af8f663115e3b746aa932ea4f1c54d1c927c95b4554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233060, "uuid": "4bc86203-0111-45e7-be2c-56ef70d20337", "value": "T1A0F3285A778A4B11E57D1C71D1EF592003F19E837A32E28A2FC4759D8E022E75E4CBCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233060, "uuid": "6495d1db-a4ee-49d1-ba19-f27af4da1453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233060, "uuid": "605f2c59-f49c-411c-a47f-adfdf8086b31", "value": "3072:Yyyq/FjarKOyyXLh8FPxQUJz9wwE1+t+JkabAtl7j9poJZR1Y:Yy8ydeXD16+JPb9JRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700233060, "uuid": "93602dd8-f9d3-4c02-85c8-5baf66bf10dd", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700233060, "uuid": "dd8a7cb3-ba83-4c5e-81e8-2e7c314083fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233060, "uuid": "4a5be58e-f857-4ce8-af29-8f6490f042af", "value": "gasdpgjasdlkgjasdg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268dc308-8511-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700201920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201920, "uuid": "b1d9b5b7-2129-4479-9779-061f68aa53e5", "comment": "Malware payload", "value": "e78db5c1247950724801e0c3420e34d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201920, "uuid": "eec7a970-daf1-4981-99ea-c4f2b0a9d296", "comment": "Malware payload", "value": "2e0a0ac5a8eb802ede007f35aaf814543f510ef8458f3642a0ef19fa800832a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201920, "uuid": "d0220af3-600d-4d5b-b87b-157733d4a06c", "comment": "Malware payload", "value": "b3a27c9012c853a109a352b986d2c1ee577e7683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201920, "uuid": "7721cdf5-8bcc-45dc-8ede-21174f2e09fb", "comment": "Malware payload", "value": "80a078a657e6412938e70dc8dc7362260b708d27338ec6c22a99264ad7b4db2d5de39c8e2ed2e1378438a50744797ac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201920, "uuid": "c1d33b0c-72c2-4b37-939a-188ae9ae3f68", "value": "T12121D7AB83A26161E06A99B8906342ABDB7B80188B65CDAD0C3551C9AE02B14FC870C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201920, "uuid": "6decadb4-f6cc-41b4-8659-d51260ca5c4c", "value": "24:/3zGb0RAFgyyWGdCiCq8oIv6DfKucJzaQKWKTngpjgs52maBX1a:P+0RAF3yeiCkTKuchaqzc/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700201920, "uuid": "d78ee88a-d232-4c0c-8e9b-e1959c9f5737", "value": 1242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700201920, "uuid": "103789e9-6944-4cd1-add7-41e6f3165417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201920, "uuid": "2972e120-371c-424c-8d3a-e18d33cf841f", "value": "SecuriteInfo.com.ELF.Mirai-GH.10477.12590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbf4c4b-8597-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700259751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259751, "uuid": "150dfd5b-77e5-4732-9323-56a93da6afa3", "comment": "Malware payload", "value": "d51b45e02719dafa0fdbccddaf9cfa27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259751, "uuid": "3e45d7ab-07bd-444b-8597-14ce07662e2b", "comment": "Malware payload", "value": "31681d6627ac9be76ef47fa30d5d9a55327080fb0ecc2c0952d38c295a0d0677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259751, "uuid": "52e7f0a1-2317-4a88-aeac-ef22c20bc280", "comment": "Malware payload", "value": "7cc01398aff5615b56ec1de1c969d7afde50ad8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259751, "uuid": "14f3870c-114c-4880-a6b9-985aba3e8964", "comment": "Malware payload", "value": "cbb5e52e9e2cf7054fb68767f303cfe0821ad98c484de4972c6a2daa9b644688f45ebe0d9ca8bbe865ae88f979e0a90d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259751, "uuid": "3a1eda7e-79c3-4abe-b71f-b2cab76a4480", "value": "T18E7633503AD4C8F6D66325BADF641EC1A3BA8B131E2212B7579DDC1D9F72CCCD122622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259751, "uuid": "15543d52-8cd6-4cff-a291-1e9b45b43ece", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259751, "uuid": "56de985b-107b-4873-a1b2-fb776bbad2b1", "value": "196608:91OWvUy3WTU8++iB4FfC4GmvBnFa3yDt/Rx+6Cks:3OO3j8++EQC4DFa3yDt/6BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700259751, "uuid": "e0c309fe-f298-44e4-a138-8042588ef019", "value": 7522036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700259751, "uuid": "6387d5ea-a541-4429-b330-41bcbf56cf77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259751, "uuid": "3b2d3ace-aae8-4ca3-bc26-a0f7983f6e6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4929f5d0-8555-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700231184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231184, "uuid": "bb23f996-440f-496b-9f6f-52ff1d12d9b6", "comment": "Malware payload", "value": "982688722d0d4e38978e9f1ea20e3a4e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231184, "uuid": "c52ff8b6-92b7-46df-b11e-b5a6b207f4f5", "comment": "Malware payload", "value": "318b4327dcbdff36cb1b5bd2eaa1b08e6f3da93a136656cd301fd6967f790f9e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231184, "uuid": "1a61c0f6-a5d7-4c3c-9c5c-80633c21df44", "comment": "Malware payload", "value": "501d8c7c6cb19f796bc8baa930b3080c1f9b817e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231184, "uuid": "8f076b77-2350-425d-afc0-4d230d85944d", "comment": "Malware payload", "value": "5052f88b45f4a4a0de5f938cc2a6029bd72a1c4a49095caa53a30443e64236f445efd27a8a7495b8279da2929df0aa86", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231184, "uuid": "68260e08-ba2c-4f57-8382-63c429d57bbb", "value": "T1C7773396A3B1C465F88A92B0AD6F4F0A0578AC677934EDC88AD0FC4C7BF36E15406563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231184, "uuid": "f051b31f-ac21-41a2-a339-728f9868bab3", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231184, "uuid": "fe6dbecf-8a5e-429c-b8ef-41c6780e34b2", "value": "98304:8GSKnZsB74itf/DaLLqMt2PcH5Gb8nu8mO6SESBtLh7e1SHU5Je8t6H:8G/nZsV4cUHg8uUt7Lh7el5Je8t6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700231184, "uuid": "c2d5bf20-869d-4834-a8bc-23ece677ed8d", "value": 34393095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700231184, "uuid": "0d2b1cd3-8e34-4880-91b7-4e36dd8d2553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231184, "uuid": "f01077aa-6b52-4309-9b10-1d043720c642", "value": "Midnight.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b751a71-8562-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700236771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236771, "uuid": "ed036140-ef8c-460e-9058-382b3194ab35", "comment": "Malware payload (RedLineStealer)", "value": "827b2cc72a716678a9440d9902e8541e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236771, "uuid": "c9689c7c-26b0-430f-a0e3-2ebcab848e48", "comment": "Malware payload (RedLineStealer)", "value": "333a7d06e134514eb8d545bb76ca32480ef18431b796fecb323c4fac78708905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236771, "uuid": "77c2eb79-8f50-4faf-8899-36fecdef1386", "comment": "Malware payload (RedLineStealer)", "value": "782c3cb1a135c0bf366f48db22d07d64cd5cd921", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236771, "uuid": "1714eeea-e151-40af-859f-d1404813153b", "comment": "Malware payload (RedLineStealer)", "value": "41d0ec10157d5f9f8dcdcfcf5bc63aaade5ae59d71d70932173a2b5fe5151ef1620ab349156158df2133266d6efa3cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236771, "uuid": "97fe46b0-573e-4309-9585-6034a0728f07", "value": "T116365BF12709D7FFE28A38B49042ED47962C4BE4431A11D3C868E4BEA9D2CD6D0B755E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236771, "uuid": "434c158c-0f47-40ce-8063-a629915bbbc2", "value": "5d163cd4f5f08cee80a27a9bc79b77e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236771, "uuid": "199ee5fb-348e-4d73-b825-837769808364", "value": "98304:wfco+oC7NqvmDI86h/TGla/A9xEgakE2QYn:w0SwCSlaY9W29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700236771, "uuid": "b7527998-f831-4f5b-a2c7-2b354f959f00", "value": 4908144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700236771, "uuid": "780be398-c4d0-4c7f-8290-70cb105d05f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236771, "uuid": "e88dd30b-831a-4e6f-9bcf-108f2dc3293b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0d1ecf-852b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700213442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700213442, "uuid": "5de3fe12-0191-427b-ad57-f229faf1d7d2", "comment": "Malware payload", "value": "55eba6afbb6a5123fb11252960424d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700213442, "uuid": "1f94f443-d563-4390-8581-271527eed892", "comment": "Malware payload", "value": "34fb49847105091abefded78102a21b9242302b190d6a121df38e7a17d29e642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700213442, "uuid": "e5d19f34-a83c-4794-83ce-5cdca724cdf1", "comment": "Malware payload", "value": "794a681deb26de4d9a21699f72ad4d3127e19762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700213442, "uuid": "d017692a-4004-48cf-9d19-31a02c5f2852", "comment": "Malware payload", "value": "a7a37b51a0fbe7e1b834414d98cdd31fc15019fe3b9dd1ea177810ed6b4973495c99e1d4722df1b6552bf49e277478aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700213442, "uuid": "73cbe580-254d-4d2e-8ee3-c04f536a7794", "value": "T1DA763325B3B00CF2F9A7297AD482C515D671FC650B24CE8B435946FA0F2BA608D3FB59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700213442, "uuid": "c7aa2290-7406-4f9d-b278-185068cf5f50", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700213442, "uuid": "dc39dba7-63b3-4847-8ad2-47d6a8893743", "value": "98304:YGDjWM8JEE1r/amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeROYKJJcGhEIFWG:YG0yeNTfm/pf+xk4dWROtrbWOjgdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700213442, "uuid": "dfcec615-2f9d-438d-8fa2-334700e15280", "value": 7254196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700213442, "uuid": "5850863a-8b3b-4028-aac4-6d01cf2cb3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700213442, "uuid": "104468d1-59d5-42f8-9e58-52f2b602b687", "value": "SecuriteInfo.com.Python.Muldrop.18.32423.7935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe86ad4-84f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700191842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191842, "uuid": "24570012-be83-4d08-b975-6ad915026dd7", "comment": "Malware payload", "value": "fffeca9538fb591c0cac7eeacd927de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191842, "uuid": "359813a2-8808-43cd-8cc4-e540ef757863", "comment": "Malware payload", "value": "394329c7d7e4a32315dca5462c00b35c78fff9f0d04c5d5e4ad3667be28ee9be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191842, "uuid": "89b16c4c-3dd3-4cc3-b351-8f3fc891642e", "comment": "Malware payload", "value": "c41cd1a2879b2d08e5fb969b75a9c42e20695fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700191842, "uuid": "1d89b873-d65b-43fb-8e3c-534f4c3875ab", "comment": "Malware payload", "value": "e12897b2c71d3c78e8ac4d9ec6c1b12998ab39a623c8e01fe55aae693333ab27934a022d6946104a4b0de2f2d5e95b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191842, "uuid": "0eb6a273-bc29-4629-83ec-25aaf947569d", "value": "T15484AE4393E07D42EA218B73DF2FC6E8B61DFA508E49776D16189A7F04B11B2D2A3750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191842, "uuid": "3258b14c-4fb7-487e-825e-746eae5fccbf", "value": "4b036b1ebc23e5c5c9b73c2e7870fe99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191842, "uuid": "d821a773-91a5-47d7-9da2-eea0509f85d4", "value": "6144:xL0W/DeHhYIykFtWL07yEywDlWl80XzJU:xoWLWYIyeU0uEywDEHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700191842, "uuid": "dc7155ae-1b13-40aa-bf0c-ad6db2054b1b", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700191842, "uuid": "19485723-0a7e-4f0d-860d-df0370799621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700191842, "uuid": "aec89558-5789-4d34-aa4a-c7b999309585", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c557e5c6-8537-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700218507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218507, "uuid": "c809ef82-c2a4-46dc-89db-9b26d72e719d", "comment": "Malware payload (RiseProStealer)", "value": "32a18cefc967be372c28bd9fe4ffb6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218507, "uuid": "b054a8f2-b703-4342-b7d9-e6cfa156bf83", "comment": "Malware payload (RiseProStealer)", "value": "3ab01b2ae713f3f64d98e50cc72e066329b78751621d91b01f4b1736b69163fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218507, "uuid": "dc3859ce-a682-4ed2-9c5c-3d6779ed10ec", "comment": "Malware payload (RiseProStealer)", "value": "7a762c221810e8e450733ef0212a247a46d6ff8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218507, "uuid": "2a9e32f9-409e-4c44-ac63-880fef21ce31", "comment": "Malware payload (RiseProStealer)", "value": "838d22dc198b4fc3a0b6c2ba0f15489ddb3dbdb4fd6532d2a2e2bcdb18dbb1efa7638a1b6240c4997cd4ac89cf02f4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218507, "uuid": "65ee62a9-ee83-40e8-a523-3266508538cb", "value": "T1AB652342EBDCD977D07923302EF292431630BDA18D75527A2B96AF5B1D72A88743073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218507, "uuid": "3d38d802-c192-48ee-9340-94a76cd691ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218507, "uuid": "4e561b82-9c57-43ac-8628-1675350d17f2", "value": "24576:uyMuw5Ot7AFaLMZre62LmGTzKm4RXJjvgbmjF07QqTAk:9MF5ZASreR7TzKmIXhG7QqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700218507, "uuid": "c66eb5c2-613b-4bbf-b386-c7f155bd965e", "value": 1505792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700218507, "uuid": "d6bbcbe4-70f2-4f2b-bdbb-1093d0bf94f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218507, "uuid": "ac8df449-0071-4d9c-89f8-fb121590b714", "value": "32a18cefc967be372c28bd9fe4ffb6f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b9e595-8564-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700237535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237535, "uuid": "38ec2cc4-4615-48c1-9b3b-00539f61774f", "comment": "Malware payload (AgentTesla)", "value": "f72f18eaee8a7b92ec068b2424257778", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237535, "uuid": "5d3310d0-6228-4a50-b95c-dc35a315e94f", "comment": "Malware payload (AgentTesla)", "value": "3b6875a9b5a76d37087201c2514ad4b6a4235cfe0364c72370026d40ae90865f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237535, "uuid": "ca07a887-4606-44f8-95cb-ded3fcd6fa76", "comment": "Malware payload (AgentTesla)", "value": "6c30d6d9f2f1183a76c65ca902fe692e2616d6ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237535, "uuid": "c197b50e-80eb-4d35-8a6d-fed790150cbf", "comment": "Malware payload (AgentTesla)", "value": "7be8cfd8f74deac3ef5afd55978f191043302493de4926982e46b9d194483027d1d509db4c90f82f83553a233af80703", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237535, "uuid": "59dddc40-c020-497d-9375-11bcd5694242", "value": "T115D54A5B7A010C63CDCE11F1A7ED09889A90C866170CED9A36D367CEA78DAE3577D183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237535, "uuid": "cbeea789-464f-4f38-ad45-e2d640408e34", "value": "24576:DKD/LTIMswDDluMIolfGu1BOu5dMj3iyIxAVS1rVXHi3waN58xVbps13iIvnHWvV:u3TnDWolfGKBOu5dE3YxzRa8xVba3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700237535, "uuid": "e1d87de2-a708-4f3b-97bd-f43f6d7814e4", "value": 2964480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700237535, "uuid": "771d4d91-221b-4d4a-9b97-bb74feedf61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237535, "uuid": "f76c13c1-3219-4491-a375-cde8f3f9c361", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3023b9-854b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700226791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226791, "uuid": "b38bb439-9233-42cd-bb18-55e33a4a3622", "comment": "Malware payload", "value": "7f855fd8b463771737a5985aebc0ce72", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226791, "uuid": "14407d4f-4869-4640-9235-d86f5f8af149", "comment": "Malware payload", "value": "3d14045e08c93efc3c34122ffb16d51d7fb7e2c996fd8a64286c0cea4881afff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226791, "uuid": "451c5e06-86ab-42cb-9de3-f51f4f82255c", "comment": "Malware payload", "value": "781d48b56319a6feca9d3ff6be44d9dbad5878d2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226791, "uuid": "b4e5cf58-0f20-4d08-945f-4ec77f670370", "comment": "Malware payload", "value": "0d8f5aea4f9bcd9ccae0ec758d361e284b9375374533d47791d74b60fcfefe930f53860930ee0483082c4ceb9db7e7ef", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226791, "uuid": "2a8e6149-d5bc-4601-b2e8-eaf22819b470", "value": "T1E9D533A3FD116895FB3ACF1352C83E144568EC4E05A32B26DCEC259D60F3B1A45FA276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226791, "uuid": "37e44588-2e44-49bf-b637-a4be145a74f1", "value": "49152:Oqlsugo9CoDvILrRr+iacZTAg5pGAGB2kpZb4riFxwG/LUwGpSJQMgxdyk6:OnugoU+ERSqt5pGx2kpZbUiDwmUwwrML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700226791, "uuid": "22601436-3648-44bb-9103-663ca33be801", "value": 2946615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700226791, "uuid": "9556674f-77d7-4481-bcc5-bc5624fb6525", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226791, "uuid": "6682043a-a0e7-4bfc-87cc-0967493b9b88", "value": "formulario.PDF.9944067071.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55aa3fb4-8572-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700243660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243660, "uuid": "1edb6ff6-c0bb-4f1b-9e7b-adc5b025e92e", "comment": "Malware payload", "value": "22b6fb2e97afec315c96ae35145d24d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243660, "uuid": "493aa81f-1c46-400a-ab4e-75d42bf3ea6f", "comment": "Malware payload", "value": "3f0b50642b6727fc4105415facfe4331153b6acf295f751f03cbbf624cfb30be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243660, "uuid": "fff8be41-c1e3-4df4-8a99-40125436c92e", "comment": "Malware payload", "value": "d58e472d7e71b7e86c509b5913c3246917054966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243660, "uuid": "85d6c889-3165-4cc8-b670-04c15053facc", "comment": "Malware payload", "value": "c214bc06f13c4436f59bf0c4d3c0f26c93dfb4c3bd6682e78ab35910f8f8d6b119f7f5aafed8178e5dc075413e41e4e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243660, "uuid": "485d8d79-cfae-42a3-9a6e-0cfd1fe3b486", "value": "T1C17633A5BDF2C574EDCB153383382FD270E5DA644631C9E303A146EE47287E4A61E93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243660, "uuid": "c5f35e19-46da-4d7b-95be-1a43a06c1841", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243660, "uuid": "3632ba6f-d300-4dff-afb3-aa761995760e", "value": "196608:91OeVRGMxLNyzxhshZJ+CjfKWg04aj7F0Ad:3OkRGMxLUhshSJn0BFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700243660, "uuid": "041d6f04-c106-4148-ba20-9124bc345612", "value": 7486826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700243660, "uuid": "1d96f04a-6414-4cd7-bab1-60ab91ac0249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243660, "uuid": "096d60ee-dc81-4a45-b32b-3b621cc76330", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9fb1ba-8574-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700244641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244641, "uuid": "f7a3c4b3-a799-4d64-a874-72a3839a17e2", "comment": "Malware payload", "value": "2a42d97acfd504a4e15577f165f63a40", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244641, "uuid": "45ee74d0-dc63-49fa-b757-14b69ebf04ed", "comment": "Malware payload", "value": "3f26b871b1e556d19b67814d3a758316b655cd508be014a2eea2cf40e1371b94", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244641, "uuid": "779e64b5-c1e4-42ec-b719-c921b9ee41c2", "comment": "Malware payload", "value": "27e02a04a4772b3500f16348d3a6c28b60e346c0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244641, "uuid": "1539f76c-2799-4c6d-920c-cc2d868b4099", "comment": "Malware payload", "value": "9662da0dc5bacd505af559b1c57219a91b2a415a5bd0a0025281443ce8e9733dfec6bf911e335f20545ed22517cc5493", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244641, "uuid": "aa4b210b-b5dd-4940-b885-2564be7b7386", "value": "T19A251228A7CE7F62DFEC08B0F0D191108770C092A21BFB5B69ACA5F45E17F06D956267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244641, "uuid": "87a2b4ad-9842-4e6c-9c49-a131d7f96723", "value": "24576:hIFFFdzxPNuJtdzWU6INU04XH7yTOp0ee8rhQpLN99BiWL2lE:hI9FxVuJtdCU6O+G6p0niYLN9xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700244641, "uuid": "2393bee9-9bc3-4e83-8907-31d8aed7aa49", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700244641, "uuid": "bc90bce5-b927-499f-b837-53cf0cb96682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244641, "uuid": "c7985482-afee-48c7-8162-8095902d228d", "value": "2a42d97acfd504a4e15577f165f63a40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1108046-8539-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1700219413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219413, "uuid": "a4583f31-0558-4d2f-b692-00a94b451f80", "comment": "Malware payload (AveMariaRAT)", "value": "5b8ccae2e38e9dc1f5efabae08efba03", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219413, "uuid": "160c6af8-cb4b-4cf1-97d3-f2ec8a862b13", "comment": "Malware payload (AveMariaRAT)", "value": "41b6843f504506bfe5a47155873b5e8d4a10382e6bcbbaadf069bc5d216c8b53", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219413, "uuid": "146f071f-7f25-4c1e-8231-d5df2f134ee0", "comment": "Malware payload (AveMariaRAT)", "value": "1a852f1c2da85a3ef4cfff63ff9b49893d0b769c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219413, "uuid": "1681280d-e6ea-4eb6-b22a-74f86cc67515", "comment": "Malware payload (AveMariaRAT)", "value": "138f333645aff68f73b6bfe003e7b63bbde2113e5f48d3aec321afaa99aeba9774f9184fe5e87f090f50da531ac2f2ac", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219413, "uuid": "a0f94d08-1914-449b-ab4f-3bc245a48b8a", "value": "T115050102BFF184F3D17219361938A73199787B201E34CA5FB3D44A799A70792E622F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219413, "uuid": "e51b279c-57bc-4c3e-a474-8465865a7854", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219413, "uuid": "3211b669-c1a7-4d57-a08d-2dca20ac10c5", "value": "24576:XNA3R5drX+NrhkpASqgvvuEPITT+XHWT831uJOK:65Glk6wg3sHWYlhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700219413, "uuid": "3ac5f6c6-1f4b-4c17-8638-9f04e0eeddf7", "value": 846287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700219413, "uuid": "dae55927-ca32-467e-87d0-99e9cbdce89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219413, "uuid": "aa171b46-e398-4205-b15a-695d1de52c87", "value": "Comprobante de Pago.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb61610b-854c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700227617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227617, "uuid": "1ff15f00-73d0-4573-a7ee-6e2a90dad7aa", "comment": "Malware payload", "value": "130212583151f568e78324bfec90c7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227617, "uuid": "ae501096-2cae-4c50-825e-f2d3632c8237", "comment": "Malware payload", "value": "449a202893e77d929c180d920bc6c8ef1c42ca69a329263777cf2cfcd7933eca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227617, "uuid": "a5ccb715-899b-43d3-b116-343a45563cda", "comment": "Malware payload", "value": "97663c7455ace9da1538b02b4b70658998e3739d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227617, "uuid": "e6cce676-1841-496c-919b-1fdeff37e848", "comment": "Malware payload", "value": "7b696a26ac9e33f1653169a9d97cf56f2c0794c90ddc265b65bdec6122ea463e44a09fd550c81d1f5eb037b8a4cb04f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227617, "uuid": "3552e0cb-f78e-48d7-b559-03e80627a0fa", "value": "T11AE73385FA0A9957EC406A3382FCEBF1774D63C2F390DA835739E795A8139C8498427D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227617, "uuid": "ccd5e12d-fd5a-4fa4-a4f5-13e5455bf78d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227617, "uuid": "5099304c-0a47-41bf-ba6f-2032174bff6f", "value": "1572864:Am6+mMca8HPRNOMX5bXlaaftMz86v3T60E9J:z6+mS8HPeMX5caGzf60E9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227617, "uuid": "f232ec50-7303-4aaa-8cb1-30c317e262f1", "value": 64665208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227617, "uuid": "3235b8e0-b59a-42ac-a723-9abb07cb809d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227617, "uuid": "8ab318f0-9b81-4df5-a11a-1a9e716776cc", "value": "SecuriteInfo.com.Trojan.Siggen22.8942.21466.19269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd0220e-854b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700226977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226977, "uuid": "6c47a686-ae31-4ac3-a166-fb3d16c6c9f1", "comment": "Malware payload", "value": "e0b1ab906df57682a707839103bfbbaf", "object_relation": "md5", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226977, "uuid": "6f008203-c278-4de3-8872-93bb8e33a35b", "comment": "Malware payload", "value": "4612a9bca84a26562fb2b5da79528d4ff01362b18be9f2e95c12c8f59cc7dff1", "object_relation": "sha256", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226977, "uuid": "6d571c16-ba8b-46b0-92e5-8851839cbe93", "comment": "Malware payload", "value": "ba90f65e8564ac508ac2f3f05b9d5d3481732b99", "object_relation": "sha1", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226977, "uuid": "45470a27-aa85-4573-9a3e-08457816a5df", "comment": "Malware payload", "value": "a15ae95d44890449779354d1888fc0b4fcbd5ac8ee9af076b035f9eec785c8a4478f9edcd061efd923f74d2bae59da15", "object_relation": "sha3-384", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226977, "uuid": "f8589114-faf7-45d4-8d3a-f91e6e7eaacf", "value": "T1C8337F30FBDBD7891B8B5A4D857F3C73574581D442E84173403B8C0AAAA8F3A4A976BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226977, "uuid": "f751503f-06fa-415f-9bbf-804ee4cc6ae0", "value": "384:/6G55555555HRAIIHiy5nMxQ0H5H2eX8MPA:/6G555555551ICy5nMSfeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700226977, "uuid": "6a76bba1-cb78-493b-9025-4fd219d222ab", "value": 52618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700226977, "uuid": "5f50eda2-bde9-4310-bf79-3969caf1e2f6", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226977, "uuid": "67551f83-cf65-431c-99ce-ecd41922cae4", "value": "lnvoice-1597256897.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c4c4a4-856c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700241009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241009, "uuid": "ff9c63be-dfd5-493c-9d6c-7ad32aaa9811", "comment": "Malware payload (LummaStealer)", "value": "33238645e04c8c9fee65fdd2aabd4953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241009, "uuid": "51e8e2ce-4db9-4c27-9444-f8a2816ebbf4", "comment": "Malware payload (LummaStealer)", "value": "46f28066c02abc39d4f13b5370838c2e0b3d8471c8db9cc5079a41146edbfed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241009, "uuid": "1ac1ab3a-b657-4da4-a14d-eaa769f0216d", "comment": "Malware payload (LummaStealer)", "value": "0261a027a8f66a4ee80cf80b2dd59ef640de6fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241009, "uuid": "496b8e39-ebfb-4224-a1de-de587356bf46", "comment": "Malware payload (LummaStealer)", "value": "da9ca7bb252e8532df954dc797d9e4144028f5be31250de7cbb9a072ccc0fc3652d221817a4663af6aa58157f4d835d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241009, "uuid": "b2d8b2b4-6a92-4977-9d77-d1588fb5f45b", "value": "T138652356ABE48072DE701B705DF603C70930BDB29EB06B4B2660E99F4C71254D9BA72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241009, "uuid": "092ac916-2e68-415e-b05c-a5b6c0ceff9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241009, "uuid": "3c2f1a31-1cc8-4f5c-961d-7b1fc255f4cb", "value": "24576:WyFp7ZOeLESli9Yh/BzpPf/etIuoCPj1QKI1FLNFLODIJST4CqVeRHg8jQ6m:lFp7ZhlrBdXeWuoA1EDL/HST4CCe1jQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700241009, "uuid": "e6de23f9-de43-4423-9bd1-f19359ed64eb", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700241009, "uuid": "27005c9d-805a-4930-ab9c-3cfc405684bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241009, "uuid": "2a3a780d-572c-4555-9813-fc224f7164b2", "value": "33238645e04c8c9fee65fdd2aabd4953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bba7688-855f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700235510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235510, "uuid": "39ad7cab-1c77-42ab-ba91-2706f24dfede", "comment": "Malware payload (LummaStealer)", "value": "56cce389740a852da3f77ccd38a742bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235510, "uuid": "56347dff-368c-4690-a93f-5ec3dc248915", "comment": "Malware payload (LummaStealer)", "value": "47abb3bb4a3141078898a6bee161b07764856979ca662986a7f1c124dd1656f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235510, "uuid": "1acb4752-340b-4503-b2f8-2aec5a9408a0", "comment": "Malware payload (LummaStealer)", "value": "93bb013a541f1d91a4c04f83db66d86a8a03df04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235510, "uuid": "6895f0d1-a429-41e9-9042-902a7ec91068", "comment": "Malware payload (LummaStealer)", "value": "b48e65be6f7ac89d36f26ab082610ce4de5105b0a5631afd4f56da6367322ecf5d8767843b43511c4c0e555eb7a4853c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235510, "uuid": "1e60a7a3-a4cf-4e25-be62-c1896c028f95", "value": "T16744281352E13C54F926CB729F3FA6ED776DB2508F4977A912188E1F24B02B2C263B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235510, "uuid": "8ec294d1-0f82-4ece-b280-c280d0c2878b", "value": "5148e92f1190607a3db8b96a305e7ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235510, "uuid": "8969978f-b446-473d-a71f-3105a64cc2f9", "value": "3072:VQcw6i1QN/LVE2og/XeR/3IpidmuTZS9n6RsVdeybsr39iVR:qrF10h0g/MfIpivZS9TVdDsrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700235510, "uuid": "d583844a-7308-4b14-92c0-9ca114131fa5", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700235510, "uuid": "14389025-2574-4b14-bee8-f520e436df11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235510, "uuid": "7a4f39b8-711d-40d8-8ac6-2c9c9bffb3e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728b6cea-8518-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700205054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205054, "uuid": "7a5cfa17-0ea7-46f9-9f1b-c4d4d3079d7b", "comment": "Malware payload", "value": "06db095ad745f4d74172f4fba8f3627b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205054, "uuid": "70d20e48-a2f6-4b53-b81d-afbccd8b7bce", "comment": "Malware payload", "value": "48bcf2b8e6a7bd4a807cde942b014848dfc1a0e65fde4959f6c187ea547e659e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205054, "uuid": "b6c0dc7f-c7ae-48b8-a974-937db2d3a047", "comment": "Malware payload", "value": "ca7b62c845365ba6b89293c58b765ae6e583574f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205054, "uuid": "23cb7459-305b-4ff2-a4f2-cab8eb51b696", "comment": "Malware payload", "value": "c6ddbcd7768481404826ad7ef3d9f3f56f9a1fae760bcd0a0724f731d95dd1efa2b3f110c74fef96d4252b87b1e8b6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205054, "uuid": "ae01e858-d98e-46d5-905b-d9521f5fdec3", "value": "T145848D0382E17D56E9268B739F1FC6ECB70EF5908F49776922199A7F04B12B2C163748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205054, "uuid": "b3080da9-f163-46c5-af72-3bbf51df6b10", "value": "0a51b1dee43d79ab01dde11c015d41e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205054, "uuid": "c7c1f660-b64e-40aa-bdaa-c02e78dd6f5b", "value": "6144:QBILQwvGEKYPrXiR8vXkQlJIX6nIFI9he4jy1JKSH:QBI8wuXCXiRclJ5x9hly1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205054, "uuid": "8119b898-d13f-4a36-851c-26223bf13724", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205054, "uuid": "df81a753-d329-4574-adc5-e9f82b26cfa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205054, "uuid": "373e33a4-3ee4-49b7-bf07-80614090cabb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086804fa-8519-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700205305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205305, "uuid": "d3641bee-1437-49ba-be06-ca672001eaff", "comment": "Malware payload (AgentTesla)", "value": "39d5594058ec3b6f7171e12d624acec0", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205305, "uuid": "58a67745-62f5-4596-bf94-f815c678b5c1", "comment": "Malware payload (AgentTesla)", "value": "48f694cf2043cf20020e69e045994cd383bb53807958561fb0abad2222a1ca45", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205305, "uuid": "beae76db-9c99-458c-be0e-0657761dcda4", "comment": "Malware payload (AgentTesla)", "value": "3c8354d9eca22340f4ad2fa19457b6c84be024d7", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205305, "uuid": "414b0c17-8a57-4867-b592-48d8b979814e", "comment": "Malware payload (AgentTesla)", "value": "742d4e2b7cd7aa41eaa5df4ebd2d7679baf2f51915e6cfc080d9f7063d24558ca6dbbf8d9af48ed99ad7c03d170e0b11", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205305, "uuid": "8e5222f5-f546-476b-8ecc-dbafab46ec30", "value": "T190E423313A1BEFF103D2BDCE0DAEAD154EA0947F0234A9E71D016451AE676FB550C92D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205305, "uuid": "52415c53-1deb-472b-a18e-097466386622", "value": "12288:/oRL1LGMul7C+siNIoc4ZXQaZXfmYJbJyGySEHR4DCd/aPTKj70Oq:/oRLpEZsiVXjZXu+bJyyExbCPzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205305, "uuid": "8f49cad5-37e6-409c-8e13-5b391566a166", "value": 673064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205305, "uuid": "eb89f2f6-6325-4eba-ae20-665c22ad1d35", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205305, "uuid": "708b03e6-6880-46d9-93bf-ee3d389c0f73", "value": "Shipment-55019318A.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8a8fc-8527-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700211698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211698, "uuid": "d26f45c1-21f8-47aa-9a27-4c10e438103a", "comment": "Malware payload (AgentTesla)", "value": "249c6f36c6174f68f3d5c61bf404851e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211698, "uuid": "6010af6f-eac0-4224-8c1e-c9bd343effa4", "comment": "Malware payload (AgentTesla)", "value": "4936c3088bfd5fa66f157dc62ceaf62a879f3c2ba16fc30eada44c74cee617c7", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211698, "uuid": "304f1772-0b60-4eb5-8ee6-76f38aa1921e", "comment": "Malware payload (AgentTesla)", "value": "ff28b2fd4b9d64802765abf92752cc7adb87a730", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211698, "uuid": "f94eccdf-77ee-412e-91f6-57afcfd71b0e", "comment": "Malware payload (AgentTesla)", "value": "f862ad570accbb245169eff37d1199be3c5ffdbc28de7578798ed7bfece34a6e2f2733215896607b5c680eef356ef893", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700211698, "uuid": "6f03016e-aaf1-439e-b579-7f89a173e5d4", "value": "T1163533A0DE40DDD545C9BD8AE2F43A8D5869BC9944286F0693B3F14FEFBC61144E32AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700211698, "uuid": "a23466ce-1e63-4907-9b8d-c8b1d720060c", "value": "24576:nTP30nUEhTGylzigWs56kXP278DsBenC6R4EYLpznyqtup9TL:4tRznR56176AeC6R92pbyrr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700211698, "uuid": "d6f4cc19-67b4-43d0-a7d2-537034eca5eb", "value": 1123131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700211698, "uuid": "bbb6877c-007d-4ce5-9d6c-ebb101e46820", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700211698, "uuid": "c5953954-bcb7-4eba-8817-a0a9bf8757bb", "value": "Outstanding Invoices.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542d4532-8539-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700219176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219176, "uuid": "913baf06-3d1a-4d7e-b6a3-e8878bc02bf9", "comment": "Malware payload", "value": "3dd11eaf218465b036c75966d20dbfd6", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219176, "uuid": "0f08751e-34de-4463-9d03-4517cc4d616d", "comment": "Malware payload", "value": "4ac4db567341f3d6d2b6275edab057bb3e653f932c2906dbdeaeff5f38de2ce2", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219176, "uuid": "e0e460eb-3faf-45c5-9b3f-52fe9b84e80a", "comment": "Malware payload", "value": "397914c4a676a76489f197484f29108fdaf37a42", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219176, "uuid": "502fafcb-5016-4e66-b13e-4c555c886d8d", "comment": "Malware payload", "value": "d65c376a6b89b5e5c5a1d3cec061a9a0e943b13d971713b87e5626e55edd652ee4b046f9c674015da119534141c9b8d7", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219176, "uuid": "1c501c65-98cb-46e9-957f-4564d941d29d", "value": "T1310723C77AEED298C0430F541AC623DA35C572DE98FC8D1D39CE5C06B422D6A8ACD676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219176, "uuid": "9c4f2526-98cd-4fc8-9b50-0495a01a9e2b", "value": "39ca3ea6180bdec1c43734b0269b7598", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219176, "uuid": "b0ffbf0e-aaa1-4410-b037-9043aa98e95c", "value": "196608:Ljn8emZyBStmDqCLSj2wuuf21jpaHmN78SszN6Y6VYJn5qYZy3+KKr/TOx/0FrJr:Phm6lNAPzN6Y6IXZIlKfOxMLz/IgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700219176, "uuid": "c0b239da-c9cb-418a-b1bc-3f4439c6555c", "value": 18350392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700219176, "uuid": "34cf12a3-1c9d-4299-bbde-406e24f52a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219176, "uuid": "5a777eb8-cdcc-49a9-96da-b567dc027a6b", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81170f42-854b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700226982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226982, "uuid": "1981d1be-39e4-43ea-b078-d529893df795", "comment": "Malware payload", "value": "6ad3ba5c57ad42f2915166df9b09417d", "object_relation": "md5", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226982, "uuid": "1be95cab-3910-4c03-a96a-3b6cbb0fdbfa", "comment": "Malware payload", "value": "4b908a89d4b36d13f8a39f7c9d464d19b1378cd924f0e2319684fb77ffe8ff0b", "object_relation": "sha256", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226982, "uuid": "0d8a0625-2466-4e75-b568-a1fb4e7ca85d", "comment": "Malware payload", "value": "b24e0268f97de481f65827a8604c21dfaa598839", "object_relation": "sha1", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226982, "uuid": "ec02de27-c291-4fd5-8b95-54df59d843cd", "comment": "Malware payload", "value": "f21fb853c29fcea6c172fe1523292f8e2d1beca1164ce2129ffbb7476eecd9f50f1e651452c59d3aa4ce59e71f316290", "object_relation": "sha3-384", "Tag": [ { "name": "bo0king-blogspot-com", "colour": "#111B46", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226982, "uuid": "37e0d161-8ae7-45ba-bed6-c82f6073c985", "value": "T14983F51E47755F9B0A22AA08AC5CC4297DF40889C1D7B2D2FB9DDEE47009B1191EEF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226982, "uuid": "d6c4faa1-4df6-4028-9a87-8c53138bc418", "value": "48:/bH8kOofHb/hyWdawjJuF7ejZVt2LGLKY:/DOofcWIwjJuF7itmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700226982, "uuid": "c37d2636-28b4-48d8-b988-957110237306", "value": 81409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700226982, "uuid": "718fb42a-3c53-4017-9c1d-d03915e68632", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226982, "uuid": "5ffc7d29-343e-4019-a6f3-d554e5629c7e", "value": "lnvoice-1597256897.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da364e1-8561-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700236452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236452, "uuid": "8e7d369b-1073-472a-bf57-24315b98484d", "comment": "Malware payload", "value": "40aa6273f0e603b60d16469255e0778b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236452, "uuid": "4a08caf1-fd66-4bae-8638-1d72e2383c57", "comment": "Malware payload", "value": "4c30cc4804651690a1fc9e71f00005bb0732671bc41c2674cda388bba172ea85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236452, "uuid": "737d1384-204c-441d-a95c-a891202623a9", "comment": "Malware payload", "value": "e5d4e582a61cc43885424d6637c039a9ef6b6fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236452, "uuid": "af81df66-1e53-4634-ac36-92f4af35f2a0", "comment": "Malware payload", "value": "f82824b960f6a5baa3cd66480126b15571cd7ad6b941f27a4f8bb0a23a98f8814fbeb6cc7184cb86b4c89d3c29152a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236452, "uuid": "bfc0ced6-b811-4b4d-a837-4bc894adf2d0", "value": "T1D4F5171176F90B59FAF34EB416BAA215083EFC699B01C2DF1551AB9E4C21BD28970F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236452, "uuid": "7a5461e9-7ff6-4532-8080-8e18533fde17", "value": "4e4a6bcb0a4d906241efada3b9ef82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236452, "uuid": "25425076-fcfd-48f9-afac-114a254da8b5", "value": "49152:7M7wMc13tn/rx+h6a3vHsmnkakNOdqDDY1:gux+ormf0Odx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700236452, "uuid": "44585143-804b-42d8-b797-162d3da3e056", "value": 3394104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700236452, "uuid": "f5e236e4-0598-4c95-a531-2e0f97c74951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236452, "uuid": "7ce1a87e-50ff-4d7e-a8ca-b47414b99ac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0072315e-8577-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700245665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700245665, "uuid": "b8c6c053-788b-4036-96f4-b5f8c735c1f0", "comment": "Malware payload", "value": "6c4274cb181fb85c3f8f9190c15f4220", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700245665, "uuid": "1489f6c5-d85a-49ab-9ee0-1261ca7d578a", "comment": "Malware payload", "value": "4c9dbf8ad11b96a8638b4476a73534c4477f6b91610b59476348a36fb0650de5", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700245665, "uuid": "11e0dec0-0e80-4783-8b96-3a029e625348", "comment": "Malware payload", "value": "c7b85a4705a634c1bdbd66fbcc49c1e5825a1563", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700245665, "uuid": "360314eb-ffd7-4016-a32f-caf75cca9b2f", "comment": "Malware payload", "value": "309607e039dc4222347654641054aa48de14157f1dcd23c5c1fb80f6843672bddd675eb05a0b7cb4c6c98e9183c8eb45", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700245665, "uuid": "ce614752-e087-4a60-827b-f8f9f5477ca8", "value": "T1CAC63326BA01979618560472DF530F1C021016BBEB4C9F9E6C6D4FCCEAD5DA4AA7332F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700245665, "uuid": "cab74bae-0294-4d9f-bf9c-d61dbfe4c4cb", "value": "196608:tNmAccoFmU9kCsikk6rt3OtrIc7xXjsXInAFclZ7f9vbARgwM0Hvyve1a0APW0om:WAIFmri4t38Ic7xFnA2NRARgw36m4P5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700245665, "uuid": "aa820ab5-7e80-4a66-b791-77359641fc55", "value": 11569104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700245665, "uuid": "7df2d3dd-5809-4cc4-9f11-32a36afbf4ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700245665, "uuid": "4fe438c9-d949-4cc0-a5da-12ee652bb9a9", "value": "enelfacturanopagada.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ecf796-8557-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700232114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232114, "uuid": "4fcb8a4d-fc55-4f4b-8a6a-ef8728ec1ecd", "comment": "Malware payload", "value": "34643560a215ce876bcae133b5ba2ccd", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232114, "uuid": "be4b6c56-5dbb-4554-867b-10ef41a4e570", "comment": "Malware payload", "value": "4cb531bd83a1ebf4061c98f799cdc2922059aff1a49939d427054a556e89f464", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232114, "uuid": "014d514d-0a97-4ea6-80e8-a73c714d9dcc", "comment": "Malware payload", "value": "24698fad7ff7c316e68a4fcb4c18e12157b25eed", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232114, "uuid": "a049cc2d-27f7-4e1b-80dd-d4a437932c26", "comment": "Malware payload", "value": "f175b555ba5676c86657448ecccc111e5efd4522edd06c6b72f9e59ce8378bfa6fbd1e3cc7131a036664c5ad3751580f", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232114, "uuid": "840e82fc-8d47-437b-8a94-8ab50dab4716", "value": "T1E07533738B4A9265D9E4397F4A341C60ACADE4D74B4ACCE49857EAC87EC61DC28F041F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232114, "uuid": "7237ddcc-e9f7-485f-ad51-9795f81fb50c", "value": "49152:2lyESHNWRJBpPI23cLp93M35ZelShur771f:2lyvG3Nck35gEhur9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700232114, "uuid": "32487640-7743-4631-88e3-c80fa7e5a617", "value": 1617499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700232114, "uuid": "b176bc70-4ea4-4e3d-810c-3595a4a72c8f", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232114, "uuid": "b1c633b7-9130-42c8-aa39-c6889a21afc6", "value": "SafariUpdate.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50d72f7-8559-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700233136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233136, "uuid": "13b8a7f1-12fd-4a8c-9dbd-87aeb0a471a0", "comment": "Malware payload", "value": "68eaabff5b40724c9bdc65112a673256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233136, "uuid": "edee2c04-2953-4cc5-890a-e7363cc1397e", "comment": "Malware payload", "value": "4d69b6e0a0d60d320d68185884dc6d0170cb580e3d1a789b5d844e020496d00c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233136, "uuid": "8a065806-f51f-42de-9a3b-724f2dacf985", "comment": "Malware payload", "value": "3a9a4f7fba434d20dc9a1500d62952aba645378d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233136, "uuid": "7752b1dc-4149-428c-9f1d-7633ee3e60c1", "comment": "Malware payload", "value": "7f874f56d9d63af4226a5e6f56beaab5d7a00681b1c428ad38e273ed293de79c9f693a6432c1f29e4e63a686d004c3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233136, "uuid": "02e33b38-a8f3-4074-a8de-3a4167a7afbc", "value": "T1EE93E74977E56524E0BF56F79871F2004F74B48B1612E39D48F219AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233136, "uuid": "e777234c-9402-4e75-acea-04d5ea11859e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233136, "uuid": "93248e8d-f2dc-499d-8b77-ff15b024d249", "value": "768:3Y3JxfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3IsGdpngM:0x5WhIUKcuOJ2PhBjEwzGi1dDgDngS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700233136, "uuid": "ed4a17e3-dd24-4c60-9054-1383b4c35b44", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700233136, "uuid": "9b9f25c1-b353-4db3-888f-7c7030722cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233136, "uuid": "ad240ee0-b1e9-4edd-a527-2d31bc6bfbdd", "value": "fve\u043fr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f98241a-855c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700234228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234228, "uuid": "5c0ec70a-c12b-4967-854b-9347df6d82b4", "comment": "Malware payload", "value": "f73dc89fe29830e92487ea221d82feae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234228, "uuid": "5b4d7b12-1456-4af0-afa2-24fa46868dfa", "comment": "Malware payload", "value": "4e04f2edfc769dd3447fa3c3494719e48f125725495c0844e191700a4b989456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234228, "uuid": "112f48b7-998d-4d4e-a885-6c877d5fee3b", "comment": "Malware payload", "value": "75a0cb2819857cf220a2fa4dcd1ce617641f59a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234228, "uuid": "0997a2ba-8d99-4f4b-8628-4e19602fd9fd", "comment": "Malware payload", "value": "09bd986a884a0b80898b947fbbb1a5e14c39894cdf726ea43ab5f9e9926463ceb208f74384416bc8e0883e6d1d5f3365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234228, "uuid": "02572914-2e40-450e-aa9c-f21f2fce3065", "value": "T109E533B07A2C65F7D1DF5174D312C9385BBAE0508DA4EA78393B51F70ADC4A09A9DC07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234228, "uuid": "a4d70541-6dff-4894-bca5-6c751ef4688b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234228, "uuid": "30fa531c-3840-49fa-bf3a-0e53bce04cc8", "value": "49152:CVgSlq858FptL/4POvwZCuF3pFHC33wSwH0hajAIQ3NbyQfrSbXO/F:CVZqHp8mvwd343wSW2ajbQdbyQjSbXqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700234228, "uuid": "892c46b7-819f-4b0d-b9c0-afe6441ca8fc", "value": 3298968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700234228, "uuid": "53c197ed-74d5-4e04-9608-c4523ca21c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234228, "uuid": "35e02d83-3c9b-4b5d-a3c9-7e97c1a4be01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39efde8-8527-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700211713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211713, "uuid": "10971d17-1165-45dd-bd89-7c88ec8956d0", "comment": "Malware payload (AgentTesla)", "value": "6859b1c708c45ee33ace838027800977", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211713, "uuid": "0c82b59d-7b4b-4a8f-b250-879a6599cda5", "comment": "Malware payload (AgentTesla)", "value": "4e9869213e582a8e92d9404c2d74019b550c4363c5855bb6d8a6698a417bc64c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211713, "uuid": "6d9d159a-df00-4417-bb59-2616860279d5", "comment": "Malware payload (AgentTesla)", "value": "4b1110d82646d75ffe153f3b0d13c41d2545aa5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700211713, "uuid": "0219d2ff-d7c0-4b96-9b5f-104886ed910c", "comment": "Malware payload (AgentTesla)", "value": "d37f31b8c7a5c2072e359ef22acbae73850f18c1986ab96a0276246d080e90574139a94235b6aa7725537f5dc47ca50e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700211713, "uuid": "7be6e7b5-02b4-47e7-9c32-47f216dd2a09", "value": "T161654A385B9A0667FC79C7B6DBD09027B260AEE7B119DD28D8D233C54732B0265C523E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700211713, "uuid": "4cccb58c-bd0f-4848-8a11-0c0ac37ee83a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700211713, "uuid": "e24a6f28-d931-464c-a599-9af439526a33", "value": "24576:hMlEin9FwhTcyZ3AAwk5t/sDSbFEenUiJkSh:qEin9itv3P15NMSbFEeNkSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700211713, "uuid": "70e169a8-cada-484f-aed0-b17c45317814", "value": 1537024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700211713, "uuid": "fadca13e-78fc-4b09-8c43-6d84663226b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700211713, "uuid": "4d3af65a-ea86-4e30-a5ed-867126d8eb80", "value": "Outstanding Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77f9b3f-854c-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1700227584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227584, "uuid": "d594a992-1e65-4b0c-b90b-1ab8fd0afa60", "comment": "Malware payload (RaccoonStealer)", "value": "66b045bac49f6e2c487b456981cc6477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227584, "uuid": "ba7526f3-a91b-4be8-b859-62567e22ae54", "comment": "Malware payload (RaccoonStealer)", "value": "50ca22bad815ec837e9145bb7322e13989f2dd16a236268627d9098df28e68ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227584, "uuid": "1a09667b-3a5f-48e1-b701-7b2bf7a91654", "comment": "Malware payload (RaccoonStealer)", "value": "834524ab40413290c9ce6d16b9deaa443e3fe307", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227584, "uuid": "71af5c5b-5c6d-441e-a238-0d4a0aaf8a67", "comment": "Malware payload (RaccoonStealer)", "value": "8b00d2f6cd4ccc90dc8a79564dbcc8ba73e31a886b36c1f3b319814d485b5075ebd7420560d6480aeb0cc9f13ab84026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227584, "uuid": "922c5af3-33bd-4fc8-ba47-d029453cc659", "value": "T1E0A4AF13B6AA86F1D2D61B77C9DB45000B74E2816393E71A79CE23E958C37F6AE01347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227584, "uuid": "836c00cf-d389-41fa-b3a8-29dda200e0a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227584, "uuid": "32f5bf07-5333-4b04-9ad4-07310c7f89c7", "value": "12288:Z0y/kAtFncvbzomo4mJy9xDqLh+a4dEs+N:ZT/kAtdcvIim2DqAa42s+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227584, "uuid": "07326dfa-d4de-4cfe-b7f2-6f18097304b9", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227584, "uuid": "6c8ba97e-b6a3-4cb8-a88f-b35ae227ae5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227584, "uuid": "a10594ff-3b26-46c3-b23d-daa9fca3176a", "value": "66b045bac49f6e2c487b456981cc6477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde2587c-855a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700233554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233554, "uuid": "e83b71f5-7044-40c9-807d-06164e021749", "comment": "Malware payload", "value": "dda678539369d0d4fc979911955da11f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233554, "uuid": "5f4760f4-3beb-434b-b21c-bea383e2a9a3", "comment": "Malware payload", "value": "557b24587bc0dbeeb8f6d610cef94c2810cf1662a40217e5a3584d0dd5838ef1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233554, "uuid": "aa3ec05a-abb1-4c24-8120-8c92b9a3bd74", "comment": "Malware payload", "value": "9fc8b20673e4557575f5795c907d760257dd5ed7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233554, "uuid": "10c3425e-3db6-4cc1-9bcd-8b9be6c30d78", "comment": "Malware payload", "value": "e365097c028bac3aec21e2d94356e9e79c5a498af5550a2ea37f7a8bfdc25dd9e88659c1055fb716a6eb4db0fc40084a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233554, "uuid": "d5877052-ffa1-46d7-8918-dc1b216e13a6", "value": "T1B2D47DDAFF0474795B272667A2EF11C9B23E770201228054F40CE5E417ACA1D53EAEBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233554, "uuid": "aac3a27e-1195-47ea-8e5b-05a4939fbfd2", "value": "12288:0kl8lSp0fUj8ed10PYPclrGYiGHdxZorUuHujF:0blSp080orUuQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700233554, "uuid": "e340ac3f-bcf9-4ad1-8348-621cb26a7a2f", "value": 643382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700233554, "uuid": "cbd53c27-5694-49d4-9750-912d9a8b4c1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233554, "uuid": "225c076a-3f3d-4557-81ce-07f4dea20121", "value": "HRO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01725dcd-854d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700227627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227627, "uuid": "125f0388-10de-45d8-b9bc-5bd328410fde", "comment": "Malware payload", "value": "0b6975201f18ec6269e8292fa12a373a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227627, "uuid": "d1a36cfe-7926-42d8-b57d-2ac863124030", "comment": "Malware payload", "value": "572a570bfbd6673cf69702aa278d5bd676c3eac5b0c7bfe40f9e21f5b7878ae6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227627, "uuid": "aeda2d15-8854-4102-bac9-c37c617a2886", "comment": "Malware payload", "value": "c62f84ad6dd6d061bb8506a711fd95e6e01d25b5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227627, "uuid": "52294b6b-65f8-469f-ab11-c050452dc381", "comment": "Malware payload", "value": "4dc4c94a3f8d003c508210720de8d06f8e274d13ab743978c07d35fdceefe0077f2dac2bd0c9f81835ce59f83c46745b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227627, "uuid": "bb84f369-c958-4607-b8f2-13dc09a5910c", "value": "T1F3F73322B4E13DF971A6AFED6CB9D708EA0295D920817BB6B0D3C03F5DD15929F24C12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227627, "uuid": "49889082-b19b-4643-951b-ceaa1cc4584b", "value": "1572864:+QP0X4pgY11iN/jsEkgsxVoS4u/jdjychzbv7kyITkoS:pi4pgYLMrVkTVoShZ7vekoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227627, "uuid": "2394c553-86dc-4056-aa60-3a09dc7a62ed", "value": 70752986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227627, "uuid": "6a5233e7-7b6a-409a-956c-6015781aa8aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227627, "uuid": "3bb14433-8afb-4095-b10a-12f2acf40e4f", "value": "Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159ea407-853d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700220789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220789, "uuid": "29b2b717-2c82-4f38-94ea-4a92891d8cc2", "comment": "Malware payload", "value": "ae62e440e31035531416d7abe45ff2f7", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220789, "uuid": "b705e653-6350-4a08-9098-176d738646d5", "comment": "Malware payload", "value": "5a61ca09352b35b4bb4fa9c09cd549af13390787ebe844065a50bb9b48c69376", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220789, "uuid": "972cbc18-ebe5-41c7-887a-9cfbca665546", "comment": "Malware payload", "value": "4e1ec62fcb4ad2d01d24ed097caaa90808023433", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220789, "uuid": "204c0789-e22f-4a4e-903e-873b34da3294", "comment": "Malware payload", "value": "61eeaa9564e70d4fe5fb9c05c5473b8467547390a216dafe5f6e71b7e457446f57ab5efccd065bea7a0fdbb9f41a176e", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220789, "uuid": "d93b5279-70c3-421a-a7c9-e2929c34422a", "value": "T184D5BE2A35CAC637EB7E82306669D77A61BE7EE00BB104DB63C42A5E1E305C14275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220789, "uuid": "904df1dc-a6c2-49eb-8fca-74cf7d566230", "value": "49152:jlDUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZKeOOsL9:630ZnqKzFnWntuxbsLRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700220789, "uuid": "20d3ea79-53d4-484c-a699-0e72d61c2482", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700220789, "uuid": "d16bf98c-541f-4251-a111-c48b2850fada", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220789, "uuid": "c21ad31a-4c89-4427-95dc-dd62b9b5c7e4", "value": "Cheat Lab 2.7.2 (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d9ab81-859f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700262858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700262858, "uuid": "fd26de8b-4901-4806-8049-cd728afcd691", "comment": "Malware payload", "value": "d795962e8bdae676136a508f00cccbf2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700262858, "uuid": "a181fb3d-04a9-413b-83aa-ac14ecfe972d", "comment": "Malware payload", "value": "5b26827727d9e334fe55289b235312cec3fb968276c270fffe32353cc89d19d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700262858, "uuid": "fe73b30f-bf6f-40a2-9ee4-db4ada2bbab4", "comment": "Malware payload", "value": "9940838ea65da0be4f3eafdd4c32989aa8ff141d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700262858, "uuid": "b2037b67-c511-48ab-88aa-223575a331d2", "comment": "Malware payload", "value": "c1803cbb7730d14dc0f47c937653a978fa3221c0a27cc598e068978f2da03ddd6cca81ff856cfdfc9f92d8097103aad4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700262858, "uuid": "836e6e01-7c22-44a4-ae0c-706a883b57d4", "value": "T19935519C765076DFC857C972CEA81C64FA60B4BB930BD203A46722ED990D99BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700262858, "uuid": "3acdc3a6-ad3d-4dc9-98fb-0711a0a4d92d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700262858, "uuid": "55ce0d08-e98a-4031-bcd8-c46e1a0a6523", "value": "12288:KdM3ubYqqp6zvNKuFXTNWBCYeyo1qt30lWy1LE4BIohL8eY9Pqade1kFkAZZ/swb:rqNTFXTNdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700262858, "uuid": "cde97aba-95df-4c35-b28e-046d77de2d91", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700262858, "uuid": "7cd7ec88-f153-452b-97aa-bcbcae28ed6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700262858, "uuid": "11f7038c-0a7e-4ea2-928d-1cdb7b8e144b", "value": "SecuriteInfo.com.BackDoor.JanelaRATNET.1.6647.18592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76faa6a-8516-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700204418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204418, "uuid": "053d2adb-ae2d-495e-a943-caf7c0607acf", "comment": "Malware payload", "value": "a500ea249448203d94acd281180a4730", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204418, "uuid": "9b84383b-5807-4151-bda2-89217eb75d94", "comment": "Malware payload", "value": "5c9fcc5ccfd5f47aa0d3427e0ac01c1d2b6365cec259b8f78fc8baf564137f99", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204418, "uuid": "d9d61973-5ccd-4033-8076-528e2d5c36a4", "comment": "Malware payload", "value": "740a72aa777f44ea74fd5140fe470665e84559eb", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204418, "uuid": "8eccf9b8-4288-4eb1-92a4-f581f34459d2", "comment": "Malware payload", "value": "20c6101c9c65c9f6d4f1d3b688e9a626205a2ee8e192a0db0db136f35b0375052b6988cadf14d7dfa76a9dc977e19239", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204418, "uuid": "0142599d-249b-4d17-bb1a-c400d4dddefa", "value": "T124D423841EC487BA0B71BB6E37797DF68C02E7627464B11C6C5B4B82CB80DA775688C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204418, "uuid": "70ac9caf-0b8d-4e75-a4db-18130709a278", "value": "12288:kktzzIZM+ELyqU+UKEo6hGjiX47Xtx9Halra9YT6jd5S0ILwL6Ss:Btzz9LRrjiitx5yraiT6jdk0IK6Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700204418, "uuid": "b0a0672a-3650-4e75-bf65-f486d6890b00", "value": 612497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700204418, "uuid": "aa89398d-ee58-4557-adff-a5c141173a6e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204418, "uuid": "fa7ab1a4-d97a-406d-a8ce-4a97d6003c56", "value": "invoice pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8830c906-857e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700248899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700248899, "uuid": "480e86b1-2e6a-4464-8ed4-3376e384e78b", "comment": "Malware payload (AgentTesla)", "value": "0632629d79ccd2144930524e66a4767f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700248899, "uuid": "77b26583-a957-482e-a913-12ac2b7acad5", "comment": "Malware payload (AgentTesla)", "value": "5e01a8249a8b5d677764e8390abb59bc59656149668951dcee38442d03b61935", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700248899, "uuid": "b1b25eec-130a-467a-aa5a-09cb3aebb5b0", "comment": "Malware payload (AgentTesla)", "value": "c15bd2885a5c79728100f46ab3ca2acd2573653b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700248899, "uuid": "779211c0-c32d-48a8-8286-f93a5a486f2e", "comment": "Malware payload (AgentTesla)", "value": "8185c75ad80d354da49a4c88283c6b71d797e3b7d472b3f1245cb9797a6c531078d716c844288d752ef79d9babeae91b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700248899, "uuid": "ecb41d94-988e-4fb6-b082-a39c9856f9c3", "value": "T1A305053C1B9E0667FCB9D6A7EFD08127B260AAE7F119DD24D8D703965302A0274D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700248899, "uuid": "b089d9de-6c89-4883-878b-da690d0fe69e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700248899, "uuid": "4203b1e3-d0e7-4027-9c18-21870a9d889d", "value": "12288:hgh6IBa/mFiTEJ0+0OR8FCkojzkmiLtRYESHRmfnTXCnbOej+R0ah2fVWEBomqN:hXQYmibGmfnTgOeyR0ah2YEBom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700248899, "uuid": "63b41617-aaa4-48ab-b674-e9fb18e30418", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700248899, "uuid": "15d72b12-c183-42c4-9fbb-72bf013b0771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700248899, "uuid": "234b551c-9f3e-469f-97d9-fda064d53285", "value": "SecuriteInfo.com.Win32.PWSX-gen.1933.14873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1afde97-855a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700233560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233560, "uuid": "692988c0-d866-40fd-9079-6a3a8252919b", "comment": "Malware payload", "value": "7692f2a72e44e0784d2efcc0bc14428d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233560, "uuid": "44019cdc-c65a-44cb-bf51-550b9e8893d3", "comment": "Malware payload", "value": "5e12c313a6acc3324af1a3e8edf060338b3e8432e031e4fda7d3787b5119683f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233560, "uuid": "78d842c6-3e1d-46df-89ef-e673e656f6a3", "comment": "Malware payload", "value": "a45d24c73f7d24c256f811d180d58ad7471a7faa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233560, "uuid": "55f78013-2eef-4b63-8b09-d943b8cfb6f7", "comment": "Malware payload", "value": "f1a409eac885ca5a3cf82fc3f114e70aa7813f3999169334a7a66df9d55a38132f811112a4e7423dda42d5cfcc0dd680", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233560, "uuid": "a8bde75c-a557-4b38-8b3a-683e81ea5083", "value": "T12685D01EA680C4B1D68A01F593AFD7BA5D3A82325335FAC3D9B65C4069911E087BF34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233560, "uuid": "056bda1f-069d-4685-96e8-7c4fae75b629", "value": "36e8ac6721d0a4dd8fdb068d4c1ddfee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233560, "uuid": "ebfb3798-3263-45c5-bb50-6f3a68ce0da7", "value": "24576:JeC6d4Qm5o9dF1rT/ygBLOiaucihUZ5tU80IYabEnNSeyPUFrPmnrw13QiGGAK8Z:IvZ9djrT/HLlvIYabSymLyQYGAHgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700233560, "uuid": "769e21a8-4bd4-4a41-b377-0274b02dfca8", "value": 1713664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700233560, "uuid": "f0410fbf-e456-4062-be14-620aeeab25c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233560, "uuid": "828ed754-1c8d-4f95-ac0c-f97f5f21104a", "value": "unprosecutedProportion.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b317d912-8502-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700195713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700195713, "uuid": "5fc6249d-01f3-421a-b697-43ff93cc3030", "comment": "Malware payload", "value": "4fb9314b70c173f8569011efc7a98d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700195713, "uuid": "9d6e2b67-7fb2-4929-b216-6bddd0671012", "comment": "Malware payload", "value": "5e14a56ec2a51eafe98e9bdf632000b71c28d89ca3f73d03121445c8bead4042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700195713, "uuid": "662b0704-7262-4670-b9df-5e9d237dce7c", "comment": "Malware payload", "value": "79fc7f8a64a662120ade006a67f34c63e2f8a5d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700195713, "uuid": "6a07a1df-3bac-47ea-80bf-7b1e83b3c018", "comment": "Malware payload", "value": "ce7eb22426037cf826dd0b8e9babd42d60ecbdb069a5e1b982cc1a79b35516ed1f764a2fa9d0bbc47dd862aa8e098a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700195713, "uuid": "7365eb6c-e3ab-4ca5-887b-b8df788f9e67", "value": "T16C249E13A2E0BC51D51F4B739E2EC6E8BA1EB991DF59772E22185A3F0B701B2C163315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700195713, "uuid": "9f115eb0-d3b0-4905-a94f-d972e6baf855", "value": "4b036b1ebc23e5c5c9b73c2e7870fe99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700195713, "uuid": "8c50309b-50b0-472b-97b7-b922ac30a33d", "value": "3072:KK05QL//b+mWSA0ZkH2NbjWk6wfPuT1mhmdfKRO9Vo1G/ziU:WuL//CtSNZkHG8Sa15x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700195713, "uuid": "240c1de6-87ee-4543-90db-58a0a058ce41", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700195713, "uuid": "60fd6553-68b4-4d97-bcef-3ba7c3b58e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700195713, "uuid": "2ee0f190-8d29-4881-a61e-cf311e5696c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6b4770-8516-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700204396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204396, "uuid": "27486585-71a4-4eec-9cab-672edc4170e6", "comment": "Malware payload", "value": "fce227f02e286e923cfe261e20025437", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204396, "uuid": "1dabcdb1-977f-4c9b-a269-21bb7c09f78b", "comment": "Malware payload", "value": "5f45520ad9bc06d7b33e6800f1ed3afa75f80d71590578b585744013f98bd898", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204396, "uuid": "d0e4b03b-d8a0-4b49-bba5-f8f9c99f6461", "comment": "Malware payload", "value": "2469079e810ca90618654a891fd5a7b99cb91a3a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204396, "uuid": "e1b648d0-0544-471b-8c33-d956fe1f4ff8", "comment": "Malware payload", "value": "6651e0e125155eb236584dacc03426842ce6da599974e28538ac46c64226eca7fa6ce0c7c00b12d96498d5fc771e2add", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204396, "uuid": "fec68260-b205-476e-8aa1-38e31d5a574a", "value": "T16FD423841EC487BA0B71BB6E37797DF68C02E7627464B11C6C5B4B82CB80DA775688C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204396, "uuid": "acc0ce66-6c90-44e3-a1bd-7b14c494dde5", "value": "12288:FktzzIZM+ELyqU+UKEo6hGjiX47Xtx9Halra9YT6jd5S0ILwL6Si:Stzz9LRrjiitx5yraiT6jdk0IK6Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700204396, "uuid": "a071d903-f10b-449a-a30b-b3fdaeeaa385", "value": 612499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700204396, "uuid": "c18280e7-55b4-4197-96b6-968ec4777f53", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204396, "uuid": "e95c1eb4-3b37-4bc3-87ff-8d1103121570", "value": "SHIPPING DOC.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281deb01-8568-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700239289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239289, "uuid": "1e4ec8da-795a-4a66-b2da-424a78c535bb", "comment": "Malware payload (AgentTesla)", "value": "fe9248da6b2c906f903252d6e4063286", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239289, "uuid": "5d178cd2-ee24-44ff-8a51-a8be17021136", "comment": "Malware payload (AgentTesla)", "value": "5fa5a6b45df59e9fc4e65b5b56371e7c920716c2b2373233c3af9f2676797d36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239289, "uuid": "f2822680-4ea7-4996-a60b-1982eec34938", "comment": "Malware payload (AgentTesla)", "value": "956e2ab03cb1f862f642a2f6f2e859b1a40edb1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239289, "uuid": "d66d2f2c-7e1d-4f98-a17c-f2515c1e8f2e", "comment": "Malware payload (AgentTesla)", "value": "ae8a51e4c03aeaf7e2f1fd7bc8739f0d79be495d0b1ff8ca80e204fb14e607f797d68454ecd2b07e10a601f571e5388c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700239289, "uuid": "b34e9f68-58cb-4bce-9d54-6208b7bfebcd", "value": "T11205F53C1B9E0667FC79D6A7EFE08127B161AAE3F219DD24D8D703955302A02B4D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700239289, "uuid": "4eff239a-e9d1-4589-8c1b-5a4158393bbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700239289, "uuid": "cea0a00a-b6f8-4cc0-9699-f04b230b3843", "value": "12288:lbWoBa/mFiTEJ0+0OR8FCko17apYxr5zXe2QtKC47b1ec5sKXL/0QT+BRTYaW:lqS7apYhNO2Qtth6oysSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700239289, "uuid": "82d9ccce-0970-48b0-89ab-a4465dc9b9a3", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700239289, "uuid": "f5653dc9-94c8-4512-abcf-e2ccf5fb122e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700239289, "uuid": "e8ccd66e-e432-4a75-83ff-9a1548e4f2f9", "value": "S25C pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64c2650-8508-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700198322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700198322, "uuid": "9ec9a323-e6ac-4fd1-9281-5ef7de9aaf0a", "comment": "Malware payload (AgentTesla)", "value": "6170c17ffd57d9d4610a25c86d1f3bbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700198322, "uuid": "32940dd7-e40b-4e0f-8f55-e1941b35e03f", "comment": "Malware payload (AgentTesla)", "value": "6259c72f7177bd82ce39f46c99f6daac55cfdd4ba27a56f13bf29c3aa32a26d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700198322, "uuid": "a0e41874-714e-4839-af7f-42f83e293cb4", "comment": "Malware payload (AgentTesla)", "value": "aa00b5328655d739886146fda8da0bfc52128c44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700198322, "uuid": "81743507-1791-4c7b-9bc9-ff46025a5ce7", "comment": "Malware payload (AgentTesla)", "value": "7222116eda21580b1d1fc56b34c6a77159e08853794ea42926ba8421df4f35245ebb7f420de82e5c3a46db67b8192d6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700198322, "uuid": "a706bb2a-6c73-44a5-97b9-9f10051508e6", "value": "T1C535173C1B9A0767FC79C3E6EBD09127B661AAE7B119DD24D8D213D65B02B0274C423E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700198322, "uuid": "7de8b808-589d-4443-b253-d3762e01ac71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700198322, "uuid": "e32aa210-a1b4-43a4-b137-ef556b82f9f4", "value": "12288:AozLqBHj4cx3Ba/mFiTEJ0+0OR8FCkotH3fSyGXBtl09QKi5WzRY9x5JTEyYzDt9:T6lE4nPJGXBtMfi5GaX8tQkphXKKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700198322, "uuid": "d66832ca-9781-40f2-a9b5-1a25d1ba5591", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700198322, "uuid": "ee5fd0ec-c109-4ab1-bcda-825fbc749a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700198322, "uuid": "d9a65e79-83d4-4a6c-bd89-214af130793c", "value": "SecuriteInfo.com.Win32.PWSX-gen.17075.9697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1470b5b6-8573-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700243980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243980, "uuid": "afd799de-8e7b-4aae-94f4-0992256ae8be", "comment": "Malware payload", "value": "ba8b386b87d6d586c37192a1cb96886f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243980, "uuid": "63891ec7-0226-4579-8a24-342d591bcdfe", "comment": "Malware payload", "value": "6503300b2dd8c4f441918d168a423dea5e342798eb112e0296757fe14e649d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243980, "uuid": "3280da6e-2bed-4825-84d9-9866acede381", "comment": "Malware payload", "value": "afeea18ab4538f8eac48384c9aaa60f95b92ee9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243980, "uuid": "86af2605-fd2c-45e2-a120-d99c1231d351", "comment": "Malware payload", "value": "92bc532d9c13ff15869e550385cd62d59dfce7b9e84e9d683418c80d177e4129ae5440b5a7f6106f9ae0f0f49ca697b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243980, "uuid": "6384162e-81af-4ab7-9ecd-ed376b5ab466", "value": "T162348D2362E17C61D9278B725F3EDAEC7B1EB5604F56672E23984E1F48702B1E263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243980, "uuid": "b59ef9ae-1648-495d-a1df-4c1d715c335e", "value": "3af1886f786e2122c71384398144c402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243980, "uuid": "9fa39405-f433-4cae-80ae-45d6d892519e", "value": "3072:T4IGh26NDEpI+z2jjQY0hE6YqwPfSj5Q0rRMqkJ0ex/p4CC:cJISDl+zSNDPakqkJRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700243980, "uuid": "4d520227-7ba3-4a0e-bc36-0ee7da15c948", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700243980, "uuid": "c4c36926-7d3c-4ce2-855c-1fa8c4e60dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243980, "uuid": "a7e1ae19-4603-4eb8-9e18-41d65ada9334", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c950d7-8517-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700204732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204732, "uuid": "73c1d9b7-88bb-48b3-8ce4-55c4c12a760f", "comment": "Malware payload", "value": "fa37dc7a99eb2e6f94c5b84d9db371f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204732, "uuid": "4f7a4ab8-cd89-4650-bed5-18102b8b39b5", "comment": "Malware payload", "value": "6bdfb620003859b5a5318fda333a8950d7d0edf266f297b8e3ae62b6018a07d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204732, "uuid": "36c06e56-6e12-4ab8-8252-d72aaef4f229", "comment": "Malware payload", "value": "21e66948cae5256a4dd1e6bb9d2394b429e62510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204732, "uuid": "f86b7248-de91-42b9-99c3-17aad112f443", "comment": "Malware payload", "value": "504ec705cad93e3794fdd67100b7e482030746f5333b9170e5362f40d81cc3016836b97f379889b050aeb5189a604b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204732, "uuid": "d871c1df-be90-44a6-b09a-cc98a5114a66", "value": "T1D834191392F13D56EA364B739F2F86E8B71EB6908F59BB681119DA7B04F01B2C163350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204732, "uuid": "a5c62c72-9b4e-4d43-b44b-91c743ca3b22", "value": "0a51b1dee43d79ab01dde11c015d41e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204732, "uuid": "2ac28415-e9b3-4b4b-bce6-d9eff02466fc", "value": "3072:sqIjfLDcadk0Vrzcd2k5O81JEX1N5imWcB1GaXRtRcfG7eJ21ls/zvl:kjfLQvMIkk0SOXX5fWcvG+RUG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700204732, "uuid": "3fbf0978-9ae0-4ca1-98d2-73df4a43c64a", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700204732, "uuid": "ca86c5b0-fe6c-4a76-b41f-dee9e55621d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204732, "uuid": "9e863779-aca6-4ac7-a411-83fd2267dda1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbfbc9a-8547-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700225311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225311, "uuid": "6b1b3d2d-7896-419c-b352-88d1a146cb8a", "comment": "Malware payload (AgentTesla)", "value": "1ff0f2d8838bab1d052908709ae4d37b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225311, "uuid": "62fed249-53e7-423b-aa35-0523ca6a4204", "comment": "Malware payload (AgentTesla)", "value": "6cb36f0f7e413667ee3a0fbc42e6c95e08853e1025f8382270e63e91dad0a0fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225311, "uuid": "bfc28074-b011-4a59-8c47-e6ffe6fade5b", "comment": "Malware payload (AgentTesla)", "value": "9499f91fdfe212325d190509d357a44d6e2b26fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700225311, "uuid": "3533cf3b-ac3d-4cc9-a74c-81272955d1f2", "comment": "Malware payload (AgentTesla)", "value": "2bdf0e9fbe4313fefaa56843c86fab7673bc975f0747deb0a7b6112732211cd05b894f87035ac930c6f47e795216e806", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225311, "uuid": "665e2fee-5b59-4d47-8e80-26def909c055", "value": "T1CF15373D1B9E0667BCB9D6A7EFD0812BF461AAE3F2499D24D4D703559302A03B0D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225311, "uuid": "82301348-a25a-451f-bc98-441d92a57afe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225311, "uuid": "cfc183be-fe59-4bf6-9264-cc4b95828998", "value": "24576:D1qiuGPkRxjps8E+1vQixH9sI5HUW3CM:D1qiuGPOjps1ivsi0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700225311, "uuid": "77f0070f-bd6d-4c0f-85d6-767ea4c3e7aa", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700225311, "uuid": "c68526ec-4d86-4a24-bc5a-4aa0b00f1b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700225311, "uuid": "e791511e-40a5-41eb-b6f5-68ab3dc298cc", "value": "SecuriteInfo.com.Trojan.Inject4.59820.32080.32599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c44277-8563-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1700237223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237223, "uuid": "6ca00336-25a2-4d77-8df8-09b4b19b221d", "comment": "Malware payload (RaccoonStealer)", "value": "5eea3c3e6eed0e15adffe67740046beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237223, "uuid": "bb47f346-65dd-45c1-b065-974a1be0dfda", "comment": "Malware payload (RaccoonStealer)", "value": "6edc4cf5a676d8592ad06a2fd42f1153b093e2a8d4e1bd13d8c0ad2ef88d51b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237223, "uuid": "7d4700cf-0be0-4395-90ff-6e7baf1d829a", "comment": "Malware payload (RaccoonStealer)", "value": "a280848b1891466015cb065e354f49d5101468d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237223, "uuid": "5ab9f43c-c4b0-49f7-a29e-27b0d2c7518a", "comment": "Malware payload (RaccoonStealer)", "value": "ba478c945a8605c7744694472444718cff0333bcd5247e90706fb909ee5486c1cdb5a344f3e1b854a1b1dafb0ae349c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237223, "uuid": "894d8356-71c2-467e-9091-cb327277f82d", "value": "T12B24C567E348595DE83A433DB41C38709F70BC52E16ED32E55BA7EED283BB098A144D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237223, "uuid": "b7398e4a-e513-42e6-8cf5-229f6e86e942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237223, "uuid": "d94d7853-8206-4fc9-8683-d8bb11d69650", "value": "3072:G8R+sV7KNgczVC/TrP0JakjSlJjRSdm11S3weY2KSY:dR5V7KNgcJ+rP0TSlJ0g11SAbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700237223, "uuid": "1b8eb91d-10a6-466f-a938-036e19d7448b", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700237223, "uuid": "e4d5c1da-bd2c-41ef-ab3c-8d5405b1f3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237223, "uuid": "1e3316a5-2f20-49be-aa33-0b5848880ae5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dfbf0b-8597-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700259610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259610, "uuid": "f51874a6-f92a-4eff-b912-bf173f20edbd", "comment": "Malware payload (RedLineStealer)", "value": "5a38fd050fda5f392478698c1b623bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259610, "uuid": "2495385e-06a4-4766-8441-563d1904dcb5", "comment": "Malware payload (RedLineStealer)", "value": "6eedc33f633438f8e5b63150941b5356c3d2d5aae68e3d177200756305912c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259610, "uuid": "0f0b7a7f-979f-4658-b516-e123af66c7fa", "comment": "Malware payload (RedLineStealer)", "value": "bd82796b2c0210a147afe1b6dbb8a98a6acd57db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259610, "uuid": "0444feba-33c9-45e1-989f-e0d494d376d1", "comment": "Malware payload (RedLineStealer)", "value": "293ab5163b79cc63aaa4487030c0a4ab1075da124fb85b3dedbe8835209b242ba22049a1b6209f55b677f5187306f6f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259610, "uuid": "2d3ce655-d84a-40b6-a1d8-2dcdc1ca185c", "value": "T19275231277EA8077E95157B404FA22871F32BCA1EF18461F33999C5C19B3EC89A7136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259610, "uuid": "51a1ce37-ec96-45a9-a1de-3fb3c1afc0a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259610, "uuid": "73a2c204-f4b3-4d6b-a189-cb67fd6a84e4", "value": "49152:kzpn+XjLM2v2VKDRl3CR4eHpKdxHg5Rdi:fXjGKL3CvH21g5Rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700259610, "uuid": "f931e9dd-261e-47be-85e9-e0a39db5b29c", "value": 1640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700259610, "uuid": "f4b3724c-df44-4d9a-a97e-116b56b5f2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259610, "uuid": "31f313cf-3c81-4bd5-be78-7d1b947a61e1", "value": "5a38fd050fda5f392478698c1b623bb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be2ef1e-855f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700235376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235376, "uuid": "bab6ddcc-1bc6-473d-8501-bace73639d6f", "comment": "Malware payload", "value": "c9e26277dece15561ac1f9dae3701100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235376, "uuid": "0c67219e-04be-4827-b97d-3d7a865e5c65", "comment": "Malware payload", "value": "6f2bd0a118e3cb21a82c2cc0f4ae89dfc3187321ae34b39270c51f4cc0fe250a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235376, "uuid": "05e2f152-d713-4f37-8fed-cc0e41c923f2", "comment": "Malware payload", "value": "b167c838d4606aeee4dd0b154f26fa06c0c45b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235376, "uuid": "c689000f-1d87-474d-a896-3334109b1561", "comment": "Malware payload", "value": "b37813989a3c238358b494c9f21f4d044ff169e072171375ff7a8837bfa2cb02bf156cbd630bf2fc15d2a941f5fa18ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235376, "uuid": "92431605-7080-45e8-b59e-acf2a4f1bcfb", "value": "T1E075D02268D1447DE126A57F8A0B73685C537E601A2024C1FBDB25CC5FBF7C26B6B1B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235376, "uuid": "6ad8304a-17ab-40ab-8105-2b596160de6b", "value": "2c291df11835e52da9f182640588b8af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235376, "uuid": "3dc4f816-d7aa-47c1-9bb4-8e28d90a9ebc", "value": "24576:mLyGYcBUa0K30slpT/QCcbtz74shKiAPS9bVUp7620yjBUNPSr7aR:mL/BURW0qZQ4oKu9Op71t7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700235376, "uuid": "b16e8cab-e0e4-463f-b61a-ab3ad240c810", "value": 1688064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700235376, "uuid": "9ec5bb04-cb61-4218-b1a7-f2e6425b2411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235376, "uuid": "ff14a42a-d11e-4487-b78a-0a78c57181e1", "value": "SecuriteInfo.com.Win32.DropperX-gen.6034.20869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253864ef-8511-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700201918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201918, "uuid": "5a7cffc3-1b5a-485b-848b-5384b87958d8", "comment": "Malware payload", "value": "8efe6a0c73f3c5b5204acf0b74fdf60e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201918, "uuid": "b1626a99-e836-4c0e-8160-bac2c708b2aa", "comment": "Malware payload", "value": "6f39661a0c919438b6e7b120967cad674bda3aa935df4fcca3b4115065ba5ab2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201918, "uuid": "3da860f0-d300-455e-ae9f-78e638c46edb", "comment": "Malware payload", "value": "9f4c56c44ca309567ada36cc9e7f54998a9f075c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201918, "uuid": "5870c157-0e36-4ded-91e8-3ab9592e37b0", "comment": "Malware payload", "value": "1d3a357c0bf22b39cb63ec3f3ccb92c8e2b1af9f8782ab28fb6ab953027a10ace1d15acdb6109035741702f0bf57f1fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201918, "uuid": "00dcae3e-9bb6-4af5-bf43-baee37928b70", "value": "T1D872D0E80F4A80B4C222A479C33C4E7C86DF14756DD5C3255FF76AFBE89205E0AA9482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201918, "uuid": "b37131fe-e6cf-4488-8f05-841363fedb11", "value": "384:FgXc1n26pu369uciYuYyj2d35rVERXN6e:Os1n26pu3fciMLR5ZqXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700201918, "uuid": "5f5e7c3c-cb31-443c-8ff5-e99de6f20239", "value": 17170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700201918, "uuid": "d63a1f2f-2883-43b1-89fd-f859c348f578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201918, "uuid": "24007e5c-30cd-463c-b5ee-713fd88a4a79", "value": "SecuriteInfo.com.ELF.Mirai-GH.11309.10247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9159695b-850f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700201240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201240, "uuid": "f0fe73e2-d627-4653-8fdf-b86deb00252f", "comment": "Malware payload", "value": "be407d2215206315749a86c0c7ce41c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201240, "uuid": "3bcd435a-cb99-4224-94ce-610550a1049e", "comment": "Malware payload", "value": "6f44657e4711c10dbaa7ee19a38a5d327a9c3b8f0cd139cb416968a11ffd9ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201240, "uuid": "79b7bcfa-e82c-4824-be38-541e101757da", "comment": "Malware payload", "value": "e99a61180d8f4faa1b2f8abe4eccbda23adaae39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201240, "uuid": "1b80fc55-d198-4fb4-90c1-208c8ab2ac4a", "comment": "Malware payload", "value": "13033f2c8b8fa39486b19fcb30184cde7db446922387ed81826a0138e7e3b5d8d4eb1fd03d965b37625c892a5cb4f04c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201240, "uuid": "59526ba4-d36e-4169-a245-994e1c76369b", "value": "T1A9E24B487BE48326D5FE1FF53DB6D1050279E5178923DB9F0CD88AAA7B636C246013E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201240, "uuid": "d5efde42-4ae9-41d3-a2a5-037250be7292", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201240, "uuid": "3fbc3ce8-f3de-4e53-a8d9-894ee9a8f103", "value": "384:k3rVqCDweO/ace/VgFpLJPXwDs2ETIiqqR+gtFqBLTiZw/WNCvK9IkVuAxOjhL/t:NzT5gePqqZFr9RtOjhL/7vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700201240, "uuid": "7e087288-db6e-46a2-96b1-e613cc49db0e", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700201240, "uuid": "371a457b-5086-4c13-96c9-d07345977411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201240, "uuid": "028e986c-8ff4-4278-b7dc-d6dabfefcb85", "value": "bR8W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c97362a-8581-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700250221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700250221, "uuid": "065ac21d-dcd2-4819-8b13-456fbf69f656", "comment": "Malware payload (Mirai)", "value": "8a58dbd8cb7d7ef79a329859dda2bd54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700250221, "uuid": "71205be1-f908-48e0-8bb9-0205ea912531", "comment": "Malware payload (Mirai)", "value": "6f71abef48b3ff849d72c2cd742499219f1281ec665d6ae2828d2307857ab5c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700250221, "uuid": "8fa1e19f-a54c-4b63-9b4a-1e032058c732", "comment": "Malware payload (Mirai)", "value": "8476a03183f7effdb1a58274c613a72c3fcaba40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700250221, "uuid": "fd07ce63-d7da-4235-9e3a-e9ca4ec20302", "comment": "Malware payload (Mirai)", "value": "014cdb70bc9d1f6e97cf7cfbc534b05ac32fd79ea469fbda67c2257fe039a5ed71bd12d20ee12e2d6ec7488b00d9f07c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700250221, "uuid": "e210543d-f998-4c61-90ce-d5e36662d991", "value": "T153A2E0219169A633C390183B3794C993BA1946FDE3EF7135216012B8FACB28F317468E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700250221, "uuid": "1d4ff9f3-3deb-434d-934a-ca824e645984", "value": "384:4ooCkvTj9zz9F/ulm7VOyxSRBo0ASHe+XqV+BxnsPDRnHxhymdGUop5huUX:4vDTjhpluAhpsL9w+jnkDBxs3UozMUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700250221, "uuid": "0d073610-c683-4c95-b317-7c408da04591", "value": 22992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700250221, "uuid": "f71810b8-678d-42af-b64b-18a798da8da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700250221, "uuid": "aff20248-04f4-4847-be79-4268c0f50446", "value": "8a58dbd8cb7d7ef79a329859dda2bd54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaa8e95-851b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700206329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206329, "uuid": "b06e3261-14f9-4f82-a45c-daefedd49099", "comment": "Malware payload", "value": "67f5b58387a1a26bea121eb44ab6eff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206329, "uuid": "09103f56-e74f-47ea-972c-f059d06b2a35", "comment": "Malware payload", "value": "6fa87d0146471ff2954b68e5122d1ab272595e8b77443ccfb572d047e03d98bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206329, "uuid": "fab000d7-fc8b-4d23-96eb-6ef9e378ae05", "comment": "Malware payload", "value": "ab877a65cd067cb772c0992a7956a4f144c7c16a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206329, "uuid": "f16a81a8-3f36-4331-b4ab-b3903768de5f", "comment": "Malware payload", "value": "c4fed761a7105d5e4b5960fa048fc09f836369d3749b80c754f30b9455405d5bdb13c8c794bc4f3978deb975c3c97ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206329, "uuid": "9f1b475f-f1fd-49ad-ad6d-58a6cc7de909", "value": "T16F35AE51E2F0AA4DF4DA8A77CE3563E462722463BB12D65ACC04F549382C7E7CEC45A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206329, "uuid": "22873279-0411-4936-bb18-64af4b0383f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206329, "uuid": "f8ec380e-2d1a-4026-99ff-643c19e4e1ee", "value": "24576:CAhOKdlHl1+HHd7Ysh1unr9n13+gy+VznGMJ5IMSkGqsB:tZdlLi9ssh10r9n13+5GtEku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700206329, "uuid": "f8875768-7e77-4ddc-9c7a-d76ddb259617", "value": 1069968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700206329, "uuid": "4c6c7d06-5e3d-445f-a70d-3e2ded79feb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206329, "uuid": "75fb3662-53b9-4ce9-9fd3-10299d4577ac", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.30386.7065.3065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b02752-8519-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700205306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205306, "uuid": "08d384da-1815-4295-abaa-5a29c40c86e6", "comment": "Malware payload (RedLineStealer)", "value": "da8efde27c01de37f9072202707d1d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205306, "uuid": "a0fb98b2-7abb-45a9-9eef-09940884ee0a", "comment": "Malware payload (RedLineStealer)", "value": "741a509a0a46937736f7496cddf49f85d7400139bb673c49387800bd1b8d1fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205306, "uuid": "5ca80ae9-f869-43d5-9696-600cdcaf3bbf", "comment": "Malware payload (RedLineStealer)", "value": "4fa9c8d3913040b0424d3765c95eb667885e36ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205306, "uuid": "330d7f01-1e72-4f9f-bfea-08d768283d2a", "comment": "Malware payload (RedLineStealer)", "value": "f3f8c3f45a720b20c0935f10fd8290d5ab3dbe0ff2fa122ceb1098a0477d2873980b5d537fbee8b3ecfeb615165adeeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205306, "uuid": "a6a5bad3-828e-4c5c-b7c9-672dee8f990d", "value": "T1E0352383B6E98473C6F9B7B014FA03870F31BCF29D7463AF365568860A724589D36366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205306, "uuid": "be33744a-c620-44bb-92b0-c9da3edfe04a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205306, "uuid": "aa3e21a9-3634-4b1e-9f89-8e6ca7f8c40d", "value": "12288:fMrMy90zgzwcceug1981G83TSqdM5qjlGCFFkdGbp8HVAAqw4QkP7rmmGqyV2Fmy:vy6/GuG8jS8xL9ieChFV2AmnCtnm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205306, "uuid": "200d6475-f05c-42ae-bdca-62c944cdd9eb", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205306, "uuid": "34b8a69c-fa9b-4854-bfa6-56d157c4b559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205306, "uuid": "f17c04a0-504f-4422-b9a2-10955af00d85", "value": "da8efde27c01de37f9072202707d1d79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81c097c-856e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700242215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242215, "uuid": "f50cdb13-bfee-4942-9fba-e8bc6a262de3", "comment": "Malware payload", "value": "225fb3075cf11e0f27075326203f21a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242215, "uuid": "960e402a-a016-4662-87af-f50363016889", "comment": "Malware payload", "value": "7747004e33e1ce463c04eff2c919071d6f7c01b9de6a407381923a5c33a08081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242215, "uuid": "7520d9ea-2d07-4a81-9cf6-2326449c6cb5", "comment": "Malware payload", "value": "b71dd27f74daddb00afe800d04f87d0fcf14dde8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242215, "uuid": "2941ec11-fb8e-402c-aed7-6fc5e7ff9c9f", "comment": "Malware payload", "value": "196e1f8e8a88a0956e697a2f18496d9cf03ec7b80a37ac6fd687ada98d5bea7e2d0a145dd2e5a53b58bdb51b7f2218d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242215, "uuid": "7e3a5fbc-883a-4d28-b6b1-9745a9c25edb", "value": "T1AB347D2362E07C69D92B47728F7FAAEC771EF5504F59676E12084E5F49B02B2E623301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242215, "uuid": "03ce088f-e185-4d56-99d9-c41e760a2800", "value": "3af1886f786e2122c71384398144c402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242215, "uuid": "86f70dd2-2abe-4576-84e2-e66c4d14d7ff", "value": "3072:+4I3c4rCbgOSbCX9nl7IbfHCLKTJBTNQz91AIMQBrRMqCJcY09/p4CC:x0jmbgtSnJBEWznfjoqCJsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700242215, "uuid": "c0ae5906-8935-47e0-b6c9-f441d774269d", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700242215, "uuid": "86135b4d-f2b7-4f9f-9763-f322f5e060a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242215, "uuid": "89a962a3-fe94-4a64-b4a0-44669b4bc497", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b24c4f2-855f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700235375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235375, "uuid": "4619ea8b-32c8-44b3-ae68-93ac95fb630b", "comment": "Malware payload (AgentTesla)", "value": "c3ed6b4d3ecf377df0c5185b4ed013cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235375, "uuid": "8496169f-4a9e-490d-b471-461ed2b9e336", "comment": "Malware payload (AgentTesla)", "value": "77e7cebce0d276801a6804760b7fb57c1251f136831b0fe0b3360669cc273b48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235375, "uuid": "efa45c33-eeb4-4238-b848-f26222e03bae", "comment": "Malware payload (AgentTesla)", "value": "f7df5c0953cf59d6b6384a9613dfb7b791abc601", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235375, "uuid": "a9c0750d-870d-4641-bd66-66582f134024", "comment": "Malware payload (AgentTesla)", "value": "582a468a67bb595576592932e65903caa5001090dd564a308e4932c5891c064e54bf5e0cccd57d5da5b9fffbd23d25fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235375, "uuid": "8a740605-f41d-444b-b90d-1da8ff5966ec", "value": "T1B7F4F53D1B9E0667FCB9D6A7EFD0812BF061AAE3F1099D24D4D703569702A42B0D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235375, "uuid": "1b209093-ab19-469e-9a8e-00438cf869b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235375, "uuid": "1887fe6d-37c4-4c1b-b6e7-670a23f261da", "value": "12288:nyBa/mFiTEJ0+0OR8FCkolkPtfz6Av+VL4g1pfBZzgWWgZvT6wmYkTeN1r+3:akRGVLZfBZM0ZL6w2eN1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700235375, "uuid": "7271ef9c-80db-4cd5-bf8b-992b5b6371d9", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700235375, "uuid": "dbd6ed6a-a7bb-4caf-bcea-287ab6b93195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235375, "uuid": "e42db020-5b79-4ca3-8f8a-f2f7c43c68ba", "value": "SecuriteInfo.com.Win32.PWSX-gen.14654.10362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fdc1bc-8593-11ee-8907-42010a9c0042", "comment": "Malware payload (QuasarRAT)", "timestamp": 1700257812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700257812, "uuid": "ff87cb2d-ae65-4f23-9be7-841d4655ada0", "comment": "Malware payload (QuasarRAT)", "value": "ff95a13f992de30157418f6e51ffde4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700257812, "uuid": "520eef7f-a3c8-4293-bac4-4e458dd210f5", "comment": "Malware payload (QuasarRAT)", "value": "7cda27d67f0a949f2dadc47257b74d8e484a88670ca5705b190a0bed346fe7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700257812, "uuid": "98ec1a7d-6f44-4388-a620-4d1e231032e4", "comment": "Malware payload (QuasarRAT)", "value": "59b96a616dbc78b0b318ac56fba09259d203bfea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700257812, "uuid": "5d0a2e20-e38e-4bda-bf5b-29b56c40df84", "comment": "Malware payload (QuasarRAT)", "value": "a94efcb44d9fd17d309a54b4e767659b8278535527178492829ed0e9f7ab0c2db7dff194d84a522682cbb41a96d65892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700257812, "uuid": "2feee9f1-f495-4f84-ab47-5908657a8d9a", "value": "T1F1E55B1437F85F33E5BAE27395B0401667F0EC2AB3A3EB1B6191677E1C53B4058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700257812, "uuid": "71b63ebc-d1ac-4c6a-90fd-fd4a91e8bb30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700257812, "uuid": "abdb5ed3-b628-49fb-967a-56d90104d87f", "value": "49152:GvyI22SsaNYfdPBldt698dBcjHbW7yEA0Hk/TnEoGdn9qJTHHB72eh2NT:Gvf22SsaNYfdPBldt6+dBcjHbW7UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700257812, "uuid": "6bb11dea-84e1-4550-b0b5-87f5f96e889e", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700257812, "uuid": "641a4620-2de0-491d-b0e6-e3ef24657d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700257812, "uuid": "b6726b60-ce20-4270-8d67-b147d5ca04b4", "value": "FF95A13F992DE30157418F6E51FFDE4C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628746cd-8571-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700243252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243252, "uuid": "d15cbdf6-740c-4046-84a9-d09c33ee31ac", "comment": "Malware payload", "value": "4fab4b4da27b655937ad6b0b7c273f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243252, "uuid": "0e9b33ff-54c8-4c2e-a048-ecf6b5c30416", "comment": "Malware payload", "value": "7dd544e44b731a9fb4ee33390c223fda80608d3ac515299133d389a18818004f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243252, "uuid": "7697dc1f-934b-4d50-a4fd-ab322a5602d1", "comment": "Malware payload", "value": "936662d432037ec8813ac0a5b68ce5bf00cd21d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243252, "uuid": "3a3a22a7-f3de-413a-ac3e-e7c7b905506d", "comment": "Malware payload", "value": "9fd82a972bba33e76b254c786c637570cefc1dbe53e45c669145382c10a132ef983478aa5f61fea408bdf3d5c0692289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243252, "uuid": "750b9541-4bce-4473-9592-c86118dcba0e", "value": "T1CEF5E40076E97B59F1F31AB95B7A669208FEBC699B13DACF2155148D0D30AD08B30B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243252, "uuid": "58230a56-0867-4147-a95d-7cc41fa7401b", "value": "4e4a6bcb0a4d906241efada3b9ef82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243252, "uuid": "5d1a0710-0d37-4144-a836-4dde4c9ac695", "value": "49152:0xysLzAKJwEcm4f6a3vHX9lUjtL6D53aW3uOIbkiME0JjGTqjnc1:jc4Ss9lUjtL6D53aW3XoMrJjGTqjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700243252, "uuid": "d6463bde-3ee7-4679-a272-4f1cec0e853d", "value": 3394104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700243252, "uuid": "c1da72a7-24f6-4385-98ca-7fb611588a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243252, "uuid": "da0bdf1f-6d73-42b3-b87e-270d7dac7a59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9535a97a-851c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700206830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206830, "uuid": "d230f92b-52cc-469b-ae3e-7a35b6b95160", "comment": "Malware payload (AgentTesla)", "value": "8f1b0ae2f027e51796d07dac5ec7c900", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206830, "uuid": "38482cb6-6f3d-4b2d-ac46-b06694c7468a", "comment": "Malware payload (AgentTesla)", "value": "7e1bd795c1827bfc0577b4b14a6b1c8080b36c2943e24ed01586dbd82cc9a733", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206830, "uuid": "1687463b-5235-457c-9535-9f629f74f1cc", "comment": "Malware payload (AgentTesla)", "value": "ea44a52d8dc87fb82f1e80302a246f2adaf34ffc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206830, "uuid": "17d0de50-fee0-43ff-8db0-e428dde56ddc", "comment": "Malware payload (AgentTesla)", "value": "80ecfe090fe83ca7ffffca829bbad4ee08d56b6c4db0216e66a30d6fc946a90f4de4ac06b88427c6d66074504d9ce63b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206830, "uuid": "c30b4c9e-e10a-4033-baee-fba9dee8ed2f", "value": "T18E0533818355C503B27920ED6F7B2519D5EB1A229CCCDE22F37A4DBF769E273A402D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206830, "uuid": "6f81c386-8c2f-404d-83e1-a85e99c10401", "value": "12288:KYVy9HED3BsyG5BB+mM/6k+3ujlY93fJFEQYvDjQPpCSE4YB1woldlSs:7IkdbG5BB+mSd+38Ex8jQ6B1NlOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700206830, "uuid": "108b6b9d-9e49-402c-b2a4-a2dee01d68c4", "value": 829834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700206830, "uuid": "c4346b71-eb5f-4aef-9354-3b7283a12634", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206830, "uuid": "f6d128c3-fe03-4423-94ec-725ba73923ca", "value": "Quote 09052022-008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8dc202-8523-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700209847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700209847, "uuid": "5b69fbc9-16b0-4d92-914b-53e0165bbd12", "comment": "Malware payload (AgentTesla)", "value": "933906e31eed4d4ede37547d765992f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700209847, "uuid": "952a7a6a-c124-4680-9eb7-ec4f70ee8f54", "comment": "Malware payload (AgentTesla)", "value": "7fe2f1e2921c288ad28013dc88093fb145ea91b9e167321c78d53d8fdef0f6ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700209847, "uuid": "8972cc47-5dc3-4a20-9d8d-e15d3965a484", "comment": "Malware payload (AgentTesla)", "value": "5379553349aafcecf342c07be85094b3cbc3d3ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700209847, "uuid": "31038ff1-7c11-4257-a2e2-6c96ade7d392", "comment": "Malware payload (AgentTesla)", "value": "7d1146b6b97cd8aa5cc7e275a8cccb3d5df2d5abe19a94b911450814c1cc3d2cd7afc042350874a3a44e853ed62d2e6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700209847, "uuid": "45842514-e56d-43e5-8d58-00e7ce369be0", "value": "T15325583D1B9E0677BCB9D6A7EFD4812BF561AAE3F2099D24D4D703519302A02B0D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700209847, "uuid": "ce505cd1-f5e8-4e9b-b494-6ae4ce181b60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700209847, "uuid": "83647e29-ff5c-4491-bc57-b97e9a57202a", "value": "12288:+uWBa/mFiTEJ0+0OR8FCkoIs6B0MoS3K6AhZE56UG1De14ZAi29YUXrfOcjihE6T:ppS7hG5+z7cvQlpnx0cJ2LzXJFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700209847, "uuid": "841cd69f-7d73-43cb-80dc-995b0aa36ef0", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700209847, "uuid": "42c87dbc-eb74-40c5-b6cb-dd51526e35bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700209847, "uuid": "2edd9083-fffd-4dae-93eb-24752b0fa8c9", "value": "SecuriteInfo.com.Win32.PWSX-gen.26938.21674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc3b597-853c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700220558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220558, "uuid": "909b2de3-0488-409a-9875-607ca532046a", "comment": "Malware payload", "value": "bcabfc8a72168c9c59967950ba586367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220558, "uuid": "c078b7a2-4db4-4c13-86cb-7c33ea94272d", "comment": "Malware payload", "value": "8129a2a6764c59fdfbb1945be92d8452a9a6502c6047e39c5b8d9a3c982ca192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220558, "uuid": "9c5e5aa1-b76e-4986-ad26-823cf05a72d3", "comment": "Malware payload", "value": "4b11cde5ca21ddc2126c5dede0170f3afbeda938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220558, "uuid": "c11eba8e-e9fb-4e3e-8664-2b865f80641c", "comment": "Malware payload", "value": "4a4473960a549747ba85ace65f39c18bc31f6b574ae567c82421d2c7472f2cefec6c2387519742a18fd13a3fa7098d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220558, "uuid": "6956146f-954b-4f9e-9a16-e9674d41b7ec", "value": "T1F7D6239E69DB40E6D88108B09B27E7FB13F3AD9149898D3439C83D47B0B1FB5306E956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220558, "uuid": "293ac552-04a9-4424-802d-98c54c9e1075", "value": "52fcc5c1bcda70fa4759c08995c5a5fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220558, "uuid": "f70e93e1-0222-433c-bfd3-9b0b7991d82b", "value": "393216:Hrqs77+THrAQUSA1In5Q7JNp1ruYVOgDKg:HOsGTLBUSAin5qPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700220558, "uuid": "1e2da724-62e1-4f78-a7be-a4e08c667cc3", "value": 13659648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700220558, "uuid": "1cb9910d-6c18-42b5-9439-faf6d055d202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220558, "uuid": "a7436de4-892c-44ed-b700-c6ad11c9fd89", "value": "SecuriteInfo.com.Win32.PWSX-gen.30334.30951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ab737b-856c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700241008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241008, "uuid": "08cb686a-4696-47ce-8b7b-309bd2dda1a4", "comment": "Malware payload (RedLineStealer)", "value": "eb2cc244b048a5792522e354e73469a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241008, "uuid": "84f45294-53fb-486a-906a-74a209c3fa7a", "comment": "Malware payload (RedLineStealer)", "value": "82bbeab6df79ce1e7548ea3991e1be86689dac80ca58ed483bdddbc560dcf27d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241008, "uuid": "5e9e710e-d0bf-40c6-bd6e-d82369b94578", "comment": "Malware payload (RedLineStealer)", "value": "165b564e47285c5e3443e17e0f8b32aefa22996f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241008, "uuid": "d492fa25-8b52-4a8d-bd62-d71b7f6fa2c8", "comment": "Malware payload (RedLineStealer)", "value": "e99bb06dd06de013b38dcd974cd16d34451e39a850667e3b95f6e14a2182ba4488c1883d27cc941b34fe6c43bc419722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241008, "uuid": "5bcdb327-018a-461c-8273-ac34b74169cb", "value": "T1E8652306FAC099A1F6B21BF4A8F213831B75BD314E78D26F2258A9761CF7184B434797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241008, "uuid": "c70c34c0-29bc-448c-bdcb-e7f2dcd959e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241008, "uuid": "3ff79b98-9de9-4142-bef2-5af05204883c", "value": "24576:byXoAtrz3pe6ns9jbR21RHMjxYFlvjjV01TdIZ23SNEbGL/nzkVzwzDyJlHz3:OzdzZe6nP1RUOVB2CwGLPwCaJlHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700241008, "uuid": "446ecb4d-91f4-4a41-b720-663ce185ffcd", "value": 1490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700241008, "uuid": "3daed835-0414-4ba0-8a96-cf67299c378c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241008, "uuid": "541dc73a-c7d3-41a0-8b13-bfb7e3bb4682", "value": "eb2cc244b048a5792522e354e73469a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114d17f4-8596-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700259007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259007, "uuid": "4e19a841-2fe9-4991-9635-3a8d9dfc63c4", "comment": "Malware payload", "value": "17f7e745dbc9477f5edbb4a02df91b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259007, "uuid": "7c90c030-ed41-4d67-b1d7-09ea62276afb", "comment": "Malware payload", "value": "84e5c974047a59e9c250aa8e93a28b390267eea51a38a711bc28a229bf5eba96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259007, "uuid": "c8edc9e4-b8c3-43f2-8023-f46ea0f6fe85", "comment": "Malware payload", "value": "896216645904844e1c012a4ce76234d0c6795f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259007, "uuid": "a53760b8-fc55-4e7a-86fc-ac2d781c18c6", "comment": "Malware payload", "value": "e0e47136e2b1ed8dd715d42d9203ef63599a7467d95dc3a0f30a5acc3968d013b50ab8b36915401256ef44d6632776ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259007, "uuid": "575bd1e5-2069-48b1-8ec0-4e6fe9b92135", "value": "T10E347D1362E07E61E9274B729F3E96EC375EB1504F59776E22288E1F49703B2E263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259007, "uuid": "f556e888-9fa5-4231-a855-73dfada4fba2", "value": "d509ee77cb2ab9362fcadd2933f81590", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259007, "uuid": "077ecc2b-d19b-4c45-ae06-97a212e858c9", "value": "6144:h/1BvthPXgbdbpePeXYD4JFKtFF9duXI5:J1FLfOBsee44F9duXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700259007, "uuid": "5f761600-831d-4bdd-a8a0-f5e201050fc1", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700259007, "uuid": "ef4e0cfb-aaf8-4d28-888d-52a5505d563f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259007, "uuid": "86be2166-5da1-4523-9007-dc9d771d5f7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f51f6ea-8578-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700246173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246173, "uuid": "dce38f6f-e37e-4985-af4f-b6d701a25651", "comment": "Malware payload", "value": "1c227f66ba9be0d8b241855ab970469f", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246173, "uuid": "02dc9ec0-e89e-46a3-8ef0-36ab3218ddeb", "comment": "Malware payload", "value": "8580240bd09f39ae2da96ad133449e66203fa481bf786107e8be5bbb151c91b1", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246173, "uuid": "73db0afa-efb3-4f1e-8c61-78b55958b280", "comment": "Malware payload", "value": "dbf8abb10d8bc81bd6a8ff00c9e0da82451e9faf", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246173, "uuid": "4ed47644-d3c3-40e2-95ae-ef43586e6d72", "comment": "Malware payload", "value": "d570680e6b9cf8456afca89641617d731831991f2bb4899ccb9aab4da05b04fe6e8007f89d0a02cd7bd6a2efa6bb38bd", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700246173, "uuid": "765a24fa-4a04-4c53-b29f-3cd121c20956", "value": "T134D6235135CB80B5D49F05384A3BBBEB1271A7254BA1406B66C02ECF68F1FA063F599F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700246173, "uuid": "68693c76-b9e5-4850-b8fd-561ae6a19dfa", "value": "393216:VmEIdgNKOHxSwalZiYEn5ela+RCMuD7ay:Cdg0ORIxEcpRJOWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700246173, "uuid": "01e6f256-87dd-468a-bb6d-a75b61564e11", "value": 12636672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700246173, "uuid": "3da8b883-b79a-4bcc-adfc-feeafdf98b8a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700246173, "uuid": "37fdd6e3-5371-4998-916a-208a89a9efdc", "value": "enelfacturanopagada.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13864dab-8519-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700205324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205324, "uuid": "3027b877-df20-4401-802e-542708ae4ad3", "comment": "Malware payload", "value": "1586aeaa9eda2d45832b513f1402166c", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205324, "uuid": "608cf662-8f71-4edd-b4bb-d471ac8257a6", "comment": "Malware payload", "value": "85cb3767b22a0fe7280519d30663972557ccd681738baa855f70daf767dc6d42", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205324, "uuid": "d4413cc7-f9b5-4aa5-bb44-96e18355208f", "comment": "Malware payload", "value": "0d8fcd64d35d1b0809ca9da268c5bb7170d1e341", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205324, "uuid": "e84da029-10dc-40b0-b5b8-e986aa612e2b", "comment": "Malware payload", "value": "c381ac9712ea29ec3c96fed048684be46557bc2550c640e5baba68505cb5fd3d76585e867a4d1a672a2a46332c969a2b", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205324, "uuid": "398ab773-fd0c-4652-bed0-9d89c4c2664f", "value": "T1AE61BE932151B8EA415283BF3D496BFB807FC264A54AA044F78C4B98F9DDE63398D2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205324, "uuid": "cbe9c0bd-6ec0-403d-82d9-e482a68eefd8", "value": "96:oGt/Ag4qHuSnW1I5QfBZL0H1mAiBrVMYk:XL4RaDH1mAiBrVNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205324, "uuid": "7f2d4ca0-13fa-4b7f-86d7-dabb7aed2f41", "value": 3236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205324, "uuid": "8433e7fd-cb44-4583-bad5-2ddf4dce43b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205324, "uuid": "44e410f1-dc24-47cb-9a07-d641d468fe42", "value": "tKw0c9h7.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1007addf-855f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700235383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235383, "uuid": "1ae3caa3-ee7d-4874-806d-513b87b4c083", "comment": "Malware payload (LummaStealer)", "value": "ae9c2e6594d5d3cf864a9ab898384703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235383, "uuid": "48d8fe6a-23bc-4ad8-804a-ebe33648ce33", "comment": "Malware payload (LummaStealer)", "value": "87251d0a36f7ece7e116d9c0f05649a015f16f527ee1a083d0dd3d1c176e83aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235383, "uuid": "f5a15d9c-ad02-4079-92cb-5be02233f5ee", "comment": "Malware payload (LummaStealer)", "value": "09447788aa9e1b24119eff63bb5d3df2abcee2ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235383, "uuid": "b155b51c-afb7-4e7e-9343-43f6b584d96b", "comment": "Malware payload (LummaStealer)", "value": "07623192b2c89e9fae94c62fbf72d6ea3c54f413bb9e291b39622e0cc91cc61f3dc0b708dcfe85593610e13130a020a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235383, "uuid": "994a2fad-563f-4feb-ac3a-5304ed679929", "value": "T1AD85F161A2D10533D1731ABC8C2B27AD6C2DBE113938E49B6BE41CCC6F3979076592E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235383, "uuid": "4dc4a5f7-600a-472c-9d2b-507cb8a557a2", "value": "b4df0fe71d924ffbca8c466df2713cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235383, "uuid": "9b39514e-edfe-408a-a04c-f3a5c24d3dc3", "value": "24576:ZR12+pcZ1qmrtPqyilUMhWP/T32Sn8OKQgdtwvIErCi4rZVB0lgTYGnMESjKO9K:ZqZrMhWr22gDQIFDDEiYkHWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700235383, "uuid": "2ce3455c-13eb-4030-89de-a7edbc0d1a13", "value": 1715688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700235383, "uuid": "5ea81ddd-1772-4471-bb4c-d111fd8fd882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235383, "uuid": "ea95d973-29ec-4dab-a64c-d482bb2bec97", "value": "SecuriteInfo.com.Trojan.GenericKD.70423744.25397.14383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a6fc0b-8513-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700202779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202779, "uuid": "97de2d08-4e7e-4e10-ad00-8c6214e4e6a2", "comment": "Malware payload", "value": "3fa7a23338a3b8eeedc300bd817696e4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202779, "uuid": "abbf724f-4684-490a-9727-ca9384b4c4bb", "comment": "Malware payload", "value": "88ff49c0a53a4dd43a6706901fcc5a5ee2a8bce9d9015d2e39751c9df0403099", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202779, "uuid": "c720aa44-ba8a-4f15-ad53-62470a51f2ab", "comment": "Malware payload", "value": "fcfcb403b0a415a37971653a4b85c7b485d25c69", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700202779, "uuid": "1c6d2d4d-316d-4e10-95cc-84a4781f1c99", "comment": "Malware payload", "value": "d83950f2e9e167738589cc4c917ddb10568728be2ce00e59bcc4f70d5fcce014960b91f2fea11012d8d5659f03926037", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700202779, "uuid": "d5f92bea-fd49-4991-a8fa-f3d77af603da", "value": "T176F4C01176C79232D1AB033135BEA7A05A7EFC305EF0864B9394B69D2D712D0A365FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700202779, "uuid": "1acde0a2-3e64-4776-bc31-601a4d16c0c9", "value": "12288:YNDRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4kBrZac4PwXAw3gL2G:YNWOxtwYXNBrk8c2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700202779, "uuid": "7feef38a-b554-42b1-9246-f205d1fb6721", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700202779, "uuid": "5a1d6649-1cf3-4fb8-9ddf-f126fe5210c1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700202779, "uuid": "510e3c10-3e04-47fd-9239-629650182ae2", "value": "AI Family Doctor setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ee3844-851b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700206328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206328, "uuid": "0ca08f31-ec58-41da-a789-a208ff03681e", "comment": "Malware payload (AgentTesla)", "value": "ff57f77a2a572bc3f38f4bd8c0f771dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206328, "uuid": "426e9e4b-7f07-4217-b072-82bdb8f434df", "comment": "Malware payload (AgentTesla)", "value": "8ae37e64514578305fcfbf37797dbc25420da8a5421cbd9552858b1c026d2832", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206328, "uuid": "4027649f-3686-4896-ad51-95007c987779", "comment": "Malware payload (AgentTesla)", "value": "7f3b572b08055984ef91b298825e5d141d1e3bf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700206328, "uuid": "fb8a896b-d1a5-47f9-bfed-d9ae3ee7f0ed", "comment": "Malware payload (AgentTesla)", "value": "51597e172ff06085a285e8f867e779b0be6146f919ec97ff20aafb7dd74fd9cde54a58a870fe311d2a2c78604388157a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206328, "uuid": "e52cff99-d160-48d3-8ebf-18b9598e3fb4", "value": "T1E625E43C2B9A0667FC79C7E6EBD09127B661AAE7B119DD24C8D213C65712B0274C423F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206328, "uuid": "b3575995-87b0-48fd-8bdc-2589d20febc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206328, "uuid": "aa8e3852-efca-43a4-abbb-228503c6095a", "value": "12288:fozRQBHj4cI3Ba/mFiTEJ0+0OR8FCkotTkQf4/ZdTERfxOvbEAf7mn+Bg4/0X7XR:wClEdngQf4/vyfxOvf7OGQuR9ZQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700206328, "uuid": "825fa2f3-e5fb-42c4-a19e-bd24c8a80aed", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700206328, "uuid": "fe89f515-178a-4acb-b145-d9474362da41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700206328, "uuid": "76a0b78c-5d90-4fa7-bce2-db56165f4f6f", "value": "SecuriteInfo.com.Win32.PWSX-gen.23.26744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b9822a-854c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700227234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227234, "uuid": "625bd78b-d9e9-467d-9f49-a08bf833144a", "comment": "Malware payload", "value": "089b6c234f66d9fa04a760942acf6fe1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227234, "uuid": "64fb79fe-f6f0-4be9-ae24-eda1d46fbf91", "comment": "Malware payload", "value": "8d441460c0ead100fb238baf71938be06acad7686fc13ed817b56bf28e62d348", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227234, "uuid": "fa33c4d1-1fd5-44b0-a453-2a14fe51fb86", "comment": "Malware payload", "value": "4cd606d6317479757c31ba306039f6ae355cf453", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227234, "uuid": "0c7033d3-f386-4e2b-b092-db38486eba57", "comment": "Malware payload", "value": "1bea438d99e9210031669c1b0f98bad17365110dd31e14a580cf72503ae19f86e4c6d144c1da2945977cf3b4bf0ecf34", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227234, "uuid": "adbcb7ad-b6b8-4d66-b511-a2c8916fa997", "value": "T189E62326B287C622C55D057BE858FE2F15397F73533051E3B6E97DAA84F08C1A3B5A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227234, "uuid": "e9b20d10-dadf-45e8-9055-4102c62bfa5c", "value": "393216:QsxGws0tyZHFOSKsIZMgkMAQ1vqplwLkRyHuxVikJ:ubOSzSM7MAQYOLkTSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227234, "uuid": "7b8fdf18-568b-43e9-861b-cae5d3dfd7ab", "value": 14030848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227234, "uuid": "89c49625-4979-475a-b8e0-feedda7d1457", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227234, "uuid": "933e72bf-beb6-48dc-b2b2-d34cb3862764", "value": "BoletoNF0014217112023.pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19c3781-854a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700226608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226608, "uuid": "a56e5f6e-4ecc-4863-ac25-cceda6bb3f29", "comment": "Malware payload (RedLineStealer)", "value": "2d3d0a1083b3a21bfea02fe3361934ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226608, "uuid": "f79df400-98bc-437d-9e33-e1ac2044b204", "comment": "Malware payload (RedLineStealer)", "value": "8fec46411371cf91e278a23ffe59eaf966181b6d64f50af6b080b79c422fb983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226608, "uuid": "9aa9a5f5-f117-4942-ba55-f4c3a8c11f22", "comment": "Malware payload (RedLineStealer)", "value": "b6861e9943096612910e8ab043e49ea2265fd597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226608, "uuid": "46a19506-20ce-4ed5-95f4-4b78494632c6", "comment": "Malware payload (RedLineStealer)", "value": "6a45a4d9730f9ff672d00b531b7ecb1ac16614a9a8334a13421d33e290a424ef2d46f90d4a1e972cb4f0073d2a032f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226608, "uuid": "bbad2671-1828-4cf3-91eb-408a9db54496", "value": "T15435235BF3D98032C5751BB06CF94B830B36FDA48875CB2B66854A488C73786B136B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226608, "uuid": "b4bfb2f3-0894-4b20-a470-c2d4a6b10e45", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226608, "uuid": "47a1ae1e-eede-474b-b56b-272e9a3cf242", "value": "24576:4yKq/UN3I0NdacuE5wcoF6hBpeEffJ7s7Pjs89qVQFNLwp:/1sN3RNM85wcoFRGfJ+w88VQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700226608, "uuid": "6653f954-ca97-4412-a683-6dfcc3b7aa45", "value": 1141248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700226608, "uuid": "9362cb97-7e35-4784-8f52-ba4abcec9ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226608, "uuid": "966b600b-d608-4c7d-ac40-ecd9228621f8", "value": "2d3d0a1083b3a21bfea02fe3361934ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d936fa80-857e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700249035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700249035, "uuid": "3737bcee-3e11-4a74-abab-8e3bf829caca", "comment": "Malware payload", "value": "20cdfaea26dd4c6ef53014f55e168354", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700249035, "uuid": "ba5a63eb-9583-4da0-b742-83ca3a8f4087", "comment": "Malware payload", "value": "9098d4a135b6fa745893a83682d39f3d4309b4ca703927c4f2893f5d8ecad2a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700249035, "uuid": "f817435e-e069-4566-89a6-60f55d41124d", "comment": "Malware payload", "value": "a123925383733f0ed34d40122e717d08c4b4465b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700249035, "uuid": "eb9b3ee3-c036-4cf9-86a5-69cef158223f", "comment": "Malware payload", "value": "1b97a406bb35f0cda35e028e7a1dfd321481eb5c0ef47606f4cc0b8c28c6bd431ad9df0108ee56dbec6d6237abb6a641", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700249035, "uuid": "28459480-97fe-4c46-b6af-d8ed72e7b97e", "value": "T13D142C1076FE900C71B3BFA21FE8B5E58E5FF6726A39905D2448134A8B27D44CDA2772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700249035, "uuid": "3ffc8266-69c1-42b3-aa5b-17a6c1bab4f6", "value": "3072:wc2VpKXsIIIIIaIIIIITIIIIImIIIIIBIIIIIKIIIIIrIIIIIfIIIIIiIIIIIE:QIIIIIaIIIIITIIIIImIIIIIBIIIIIKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700249035, "uuid": "51ee31dd-7d6a-4a32-9aa5-c222cd740217", "value": 190678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700249035, "uuid": "4efcba88-1a66-415d-968a-1311b5026ba6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700249035, "uuid": "bb5148d8-8e08-45a1-be6a-14cf7146e419", "value": "2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b61cc3-8515-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700203932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203932, "uuid": "0646f9ab-2251-4162-a11c-27aedc661607", "comment": "Malware payload (AgentTesla)", "value": "4baf13042e339f4c202ab8378574d2a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203932, "uuid": "065d5968-5a9b-4587-89cf-b87a898fe4d6", "comment": "Malware payload (AgentTesla)", "value": "91cdf1387d40778489048144954f9c8c53cc419772f56e61f0f35a2b6d15d198", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203932, "uuid": "a13fc599-635a-4da1-9925-dc52af876b00", "comment": "Malware payload (AgentTesla)", "value": "1ad48db32c986a2c4405e5c52f3796183cc050b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203932, "uuid": "867193b1-ac5a-4424-8eca-8fdda55819be", "comment": "Malware payload (AgentTesla)", "value": "a8af2886e57d948e30b83ea8febd0184cf5660d69af587efc648d389542c07f4d8c914c7d4657faf86836caa8b802b37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203932, "uuid": "3a4edf40-c52c-46c8-980a-54b5d2abbd26", "value": "T1FCD423CA5BE5C2395032447C433DDE4CE0A59E9673A547D10EEB15E019ED2782ABFE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203932, "uuid": "5dbfa46c-3bdd-4342-abe0-1947289506b1", "value": "12288:WBW1z0GTbBF9vh9VQCM5WTdXp2g7Wk5iWf3NWq74XJ2Ljndo:91gibBTLu14dXQEia7Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700203932, "uuid": "1cafa3df-cc8a-43c3-a511-804afe59489c", "value": 613080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700203932, "uuid": "23d330b8-a03a-409f-b2a4-aa2bb61b761f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203932, "uuid": "8fba8e5f-de02-4915-a989-8a694ff6b3fd", "value": "payment slip & voucher.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a40fd9-8584-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700251302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251302, "uuid": "926195f0-1732-45b3-b5a2-847c2866b74a", "comment": "Malware payload", "value": "ecbcfec0bbf69c9aff0629ff8bf8528c", "object_relation": "md5", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251302, "uuid": "41dba7ea-b9f4-4c31-af95-58a07782ac52", "comment": "Malware payload", "value": "935a03b02976d0fde047530173d4f5c5b21f5e2cf000ef36d4e2cdd5c96e452a", "object_relation": "sha256", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251302, "uuid": "24841625-8518-4e51-8af9-fc641c475ad9", "comment": "Malware payload", "value": "f7fd96d3483438dfed157ca9f178b97ca686e8e6", "object_relation": "sha1", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700251302, "uuid": "7b622987-0f31-404d-ae25-37b57d8da8d9", "comment": "Malware payload", "value": "8b70882a51143988f14771bfabf5450d99582b79c4513df6aa8749b90932f50047cf49af84d9aa5d0e994cbdbd0ac422", "object_relation": "sha3-384", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700251302, "uuid": "a49287c8-a9fe-411c-ba52-04c517b8183a", "value": "T1B705334E878A519FFBAC06B5F4A2D07076418CFB83D715394E0D8EC8EF9E14E625B990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700251302, "uuid": "f7f62e37-2852-4f3d-a425-cce997e20061", "value": "24576:7EJYkhv4b+Ly0e+Bq8KFf4ryx4/CxvgFf3v6:7EJY+vS03B5cAr44/igFPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700251302, "uuid": "427eaf07-9eda-4b43-8b05-6503bedac8d9", "value": 813299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700251302, "uuid": "2a7b58fd-c298-48a8-b0c4-737f627d4591", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700251302, "uuid": "814e5f82-f68d-4c73-ac1f-335463d5a2b4", "value": "download_01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60287a5e-8594-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700258280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258280, "uuid": "1ca1c9ab-9463-4949-b0f1-9f1a1b4f682d", "comment": "Malware payload", "value": "2a3773e1dccb10a11d39139b2a3c4700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258280, "uuid": "f7003683-1e67-4984-97d0-3838acac089c", "comment": "Malware payload", "value": "95cc300618cf5a0abb4b36427d838ee00bc37e515bf527ecf24725d70610c993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258280, "uuid": "00ae29e6-a755-44b0-8c90-f0940830fbd3", "comment": "Malware payload", "value": "6d19664ed14bc2f1a8d06948c02105c489cc6b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258280, "uuid": "aa103b58-468d-4789-93b7-a15cce34b223", "comment": "Malware payload", "value": "1fdb4b1eb9a65e6ba2de4ba1f6d96838e2ec8301d3332a7f9667a7ff7b7137cfdfedb26cfb8dbbace8b862da4de5d164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258280, "uuid": "6ca39061-4332-4616-9c02-469bfe8e31b4", "value": "T1FE447D3362E07DA0D52B4B728F3EC6EC7B5EB5918E59776E22184E1F4870272E263315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258280, "uuid": "0d0d1209-8332-4f19-9587-58cf09e0fcc8", "value": "d509ee77cb2ab9362fcadd2933f81590", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258280, "uuid": "e8f44519-b603-4414-bd2b-92a3598e56ee", "value": "3072:B4VQxA8+X0F7Rq0iu2yUnF64XBqf0wKxF0EhMOR8F89pUpx/p4KCl:yyqzX0F9nZgF64XBk0wK7eF898x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700258280, "uuid": "7ac3f918-4e6d-49a9-a4aa-c87b22142221", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700258280, "uuid": "cdfdb6cb-471d-46c9-9953-e0389965f698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258280, "uuid": "3f097fbb-5c50-40e3-87d7-cdfb26fe5697", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0a8a97-8559-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700232984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232984, "uuid": "dd282190-4b7f-4a98-9095-22e3189ba4aa", "comment": "Malware payload", "value": "05f135b0d090d57c6644422d28265d62", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232984, "uuid": "b8127350-135a-4e71-91a9-089bbe045f51", "comment": "Malware payload", "value": "96cd2c662aac016badbfbf78754711578725ca5f206b5a6a37da1aa20521fea2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232984, "uuid": "ca46c453-bcf6-42b9-952c-d942a88f62a3", "comment": "Malware payload", "value": "b87db1f047c0a589d7b7225017894c62761285ec", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232984, "uuid": "448c59b3-766c-4adc-b593-654626af1a17", "comment": "Malware payload", "value": "cfaab2c157a7676856d9fac1098922b2d93b2827dbd04fbe008c44557d3589cd383bec9f6d87488c287f287debec17dd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232984, "uuid": "9cb59081-4fd2-4e43-b145-519854672f13", "value": "T1C806F1057592CF32C2681731C55741BD8694EE26AA52FB0B364F39D7BC377F48A322A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232984, "uuid": "e5a76077-8330-4eef-aa1e-29c21188069a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232984, "uuid": "b7de7085-d859-450d-946a-499de1ae9e67", "value": "49152:tBzApfphvAmMJwV1P/sWWsxwmna4fYBAtJBGf4tmnGICPFIu6134zYBRf/Pex:nKXTVBdWM5a4fYBAt3GLGrL6JJbex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700232984, "uuid": "ef9eaff2-1461-4a74-b3fc-977a119eab56", "value": 4004669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700232984, "uuid": "f281d3c8-2cc0-46dd-8a65-83e893b0d427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232984, "uuid": "cae1f352-07f7-406a-8390-3e9a94cdf05d", "value": "LabyMod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d7768c-8538-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700218672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218672, "uuid": "5ab10abf-fbaf-4ebb-9d52-da6d4bd30758", "comment": "Malware payload (AgentTesla)", "value": "b86674a5cb924fe5895029aa636d0b58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218672, "uuid": "14b91569-9c53-4d66-b4e1-7faf353c4932", "comment": "Malware payload (AgentTesla)", "value": "97fedb6d9e57b74b6d077d6430c28fb649c29f60f731acf87165232531182196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218672, "uuid": "1250dc94-5474-4aa3-8c51-74ceb60a4ba6", "comment": "Malware payload (AgentTesla)", "value": "273deb89fa7153693eaed57fceeae703c74dbd58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218672, "uuid": "276935ab-0971-4b86-9301-8279e01ba0b3", "comment": "Malware payload (AgentTesla)", "value": "4818b53deeb5d38a7dcb082ec600c681f435b822ea90ae1b81e8161389bd9dc80734e1afa6790c844e24cda0f1941e9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218672, "uuid": "03ea229d-7007-4a32-a3be-90023f4b2f04", "value": "T1BD35273C2B9A0667FC79D7E6DBD09127B261AAE7B119DD24D8D213C65B12B0274C023F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218672, "uuid": "3f31e214-8ef8-4343-a470-8d3894062df2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218672, "uuid": "110a1732-168c-4736-9baa-37bc0570b016", "value": "24576:OmlEanV45y5MQVQw1uYm1ci2fM/gVihgb+ZLOsLW:9EanV44rQ9Ym1YkYLKOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700218672, "uuid": "9a2c6ed5-7c29-4f42-9eb8-888fd564836c", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700218672, "uuid": "cd19643a-0401-4514-b8c0-8ca6e4425f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218672, "uuid": "7fd53c6b-d32f-4e0a-afeb-4264df444b9b", "value": "New RFQ - CO213538PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05d8438-8552-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700230041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230041, "uuid": "c0956e1f-e163-479a-8036-6de6c8e98ebb", "comment": "Malware payload", "value": "7f9385f6d43f92644396b4332aa92e03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230041, "uuid": "ccb0e85e-4535-42e8-8eb0-ce2125da179c", "comment": "Malware payload", "value": "9ac552edfd3efac284b13c278deb3c6341bbb391b02ed6b1db5ef427de656e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230041, "uuid": "0336bb61-6383-4434-b8e6-ad7b65cf4df7", "comment": "Malware payload", "value": "282d0a0a5a3e7777a5e688a444058b824aa48b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230041, "uuid": "f7439a88-8f08-40d3-979c-326688188703", "comment": "Malware payload", "value": "242ff4a5d0e4394882935ff69d133cd7715c8e6b5c81451e58e3bf8ecbdf49483383020b9d887938233974e076b270ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230041, "uuid": "82bf8d92-5410-4451-90df-d722f6399841", "value": "T16EE208467BE98215D6BC1AF88CB313110772E3478432EB6F4CDC88DA4B676D04295EFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230041, "uuid": "f941f917-f425-435d-b646-c47f778b864f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230041, "uuid": "a423f1ea-fce9-4efd-949f-47e0514d9e22", "value": "384:70bUe5XB4e0XspOjfqSjgkMXWTBtTUFQqz9jObbV:4T9Bu9jiSje+9bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700230041, "uuid": "718616fd-7f30-4564-be10-d778cbbcd047", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700230041, "uuid": "a8c4c34e-ffde-4144-9df2-b12c33b13532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230041, "uuid": "0dea46a1-e6ba-44ab-add3-508050416573", "value": "bRAH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db365870-8552-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700230140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230140, "uuid": "13610d78-2ed2-4a6a-8714-0cf35e18a513", "comment": "Malware payload", "value": "b56bae4a80b92481dfb956aa4f615ab1", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230140, "uuid": "f7556dc6-5742-47ab-b1dc-b34c3527809f", "comment": "Malware payload", "value": "9d1009cfb83c468c839a5200e367d1e65b11480108596320b8ae8816fe6563e8", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230140, "uuid": "6a816661-aefb-452a-9f07-5c7434628d54", "comment": "Malware payload", "value": "3b2393e9c4df726704051597ac5f93f60e4bb746", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700230140, "uuid": "3b529994-45e4-4c21-bf9f-43e51ad084ff", "comment": "Malware payload", "value": "ac118c217425c492c87e9252d486850c01101f013c6318dbcadbb7ff757a3ef570ef4563aa326d553d6f80c61e03ce55", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230140, "uuid": "63960e66-c1be-4542-940d-5dec9ba9dbb1", "value": "T17E1723C79AEE93B8C0C31B5465C613D620C171AF89ED8D6D36CE5C02B421E5A89CDBB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230140, "uuid": "c48d0c58-9ea6-426f-a93c-760a63e74e49", "value": "39ca3ea6180bdec1c43734b0269b7598", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230140, "uuid": "281c2678-2dfc-4c30-88c1-141552880dc9", "value": "393216:n8fJ2J7AV/XvRd8z24uSL7IPp0JtYwx71N:ekgvvR+z2BSvIPdk1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700230140, "uuid": "f00c4cb4-72dd-41f8-bb02-3d92549ee720", "value": 18827592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700230140, "uuid": "24d6a907-5af0-422b-a61a-0cee218792ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700230140, "uuid": "4825c1e2-4027-4941-817c-e07c08ca4982", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf48c4d-8599-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700260340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700260340, "uuid": "2da3631d-0b3c-47c9-8b64-f019c569d121", "comment": "Malware payload", "value": "394972db76cf8252fa16c4a321d1efcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700260340, "uuid": "f997dbfa-4844-42e0-b86e-532f88d141d8", "comment": "Malware payload", "value": "9e62a8d1e64661edd9446a2cfb63b47c0428243a67f0475b0d3d50eab23e8dd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700260340, "uuid": "282871ac-b167-4dc7-889f-87d6bbc228de", "comment": "Malware payload", "value": "111866329f8ab38736a215b27281f7db24a426ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700260340, "uuid": "b3655d09-0a69-4ef3-89e4-4e1289675f78", "comment": "Malware payload", "value": "daa9d3858754f751db3ea2ac09c56d7a23c6c6417985e26583cf2c9d96c9bdb4cc32cf8ce5a8de4e4b757c68682cc07c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700260340, "uuid": "a6fa60e4-0965-4ed8-983b-f4a42a413d43", "value": "T19D7633A5A77419FAF9BAD33DC502C906A771F13453A4DAD743D0822A1F236A15CBFB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700260340, "uuid": "d25c53cc-e251-44d8-bdfd-0638e2aeb104", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700260340, "uuid": "cccf633d-0772-4058-ba5e-489da2361c0e", "value": "196608:HoV13ayB6ylnlPzf+JiJCsmFMvNn6hVv60K:tyBRlnlPSa7mmvN+LK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700260340, "uuid": "de2676b0-c616-42c3-ae8a-97f921ee8917", "value": 7137043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700260340, "uuid": "9ba25b76-2a48-4438-92b7-93a5bcf253f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700260340, "uuid": "b9073dc1-eeef-41dd-a4ff-4bcac3a3a9fa", "value": "memreduct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b839d931-8520-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700208607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700208607, "uuid": "8bc97c83-5492-45f3-ba4f-15b7897dc5f0", "comment": "Malware payload (RedLineStealer)", "value": "a57d4aa90e51b5d57a6d6d1e6857dadb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700208607, "uuid": "081dceb2-1270-48ce-bb70-cbfaae49f0a4", "comment": "Malware payload (RedLineStealer)", "value": "9efa69e298aba38cdc05ea191b2e3f8cdc305cb9414e426196cf85082c1015d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700208607, "uuid": "11f44e55-69ad-433a-815f-ee29186532e8", "comment": "Malware payload (RedLineStealer)", "value": "9e713ca964bcdbbc72bec63178d3e1e38b6d2d45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700208607, "uuid": "b39860a9-fd0a-4d37-910e-b9ec669c0706", "comment": "Malware payload (RedLineStealer)", "value": "c0f8f36bc2530ab93c76c28fa510778e0e1828581d6b5c7cd41ed8b0db5c45dba383322781c8886c30749e8b255fcfd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700208607, "uuid": "04ab64b1-b8bf-4c02-b5d9-b229f2301884", "value": "T17E35234ABBD84072D9AA277158FB0AD31B32BD4198318B5B2FC1691F2DB31987870777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700208607, "uuid": "e4bd74a2-e79f-4078-9f1a-504fd4b15a54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700208607, "uuid": "8415a151-7631-4098-8f01-42ab93c2b9c6", "value": "24576:yyWxlQIQe13hA/Z5euU0ami8iIVXez3Mg+zD1hkPrS:ZilQ61RAx5euUmLXKM1zS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700208607, "uuid": "f93b70ce-648a-4bae-82dd-e4650e4befd5", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700208607, "uuid": "583ada3e-1331-4175-9371-e0dc641e5e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700208607, "uuid": "30db7ac6-c25b-4645-9369-e6c2e74350a1", "value": "a57d4aa90e51b5d57a6d6d1e6857dadb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f911a5-8563-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700237107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237107, "uuid": "8f98935b-aa23-4203-b71d-d25f164f3af7", "comment": "Malware payload (RedLineStealer)", "value": "dc62fa6400ed62c5dade12c984fb1ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237107, "uuid": "951c3e49-3d31-4ff4-989c-08d6a7ab5e90", "comment": "Malware payload (RedLineStealer)", "value": "9fe04c074e78b239c33060da79991d31e31c0d4115a7e5e954df096404c35bf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237107, "uuid": "4b499c51-40ac-417b-b431-9be1c777b0e9", "comment": "Malware payload (RedLineStealer)", "value": "dca996611f340befacb6a109cb7a73685db0f891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700237107, "uuid": "9fc576b3-92ce-4358-8209-68e37aa4c1c2", "comment": "Malware payload (RedLineStealer)", "value": "49784ba557edcfde1f30773683831acbbd25d45e75c72ab9aab962e1b4954766ba1e64c98c47116eb5ad7c65c70339ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237107, "uuid": "e10db34c-6574-4388-a2c8-2391bf7504a6", "value": "T1CB65230BA9E94033DCF6A73068BB13871B313CB58D7D536A2746995F1C629A0B1353AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237107, "uuid": "80fe9384-ecb7-4b42-8a1e-602ebd6a22dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237107, "uuid": "ebb29c48-3f35-4d2c-8e03-1abc193ab28a", "value": "24576:eyABpkkhAzHFKT2JuECkrzH/mG5x4WZuZWgbTY4HQ0ylodfMlE6w24Q7zplN:tkhAzHFKREtrL/mGXHuZWiTY4w0ylRes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700237107, "uuid": "cb71e108-dbd7-4a74-9604-018f88b83185", "value": 1506816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700237107, "uuid": "0acc9486-72d8-4f30-923f-50683a25a3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700237107, "uuid": "773e3b1c-9dd0-49b6-bd80-62d0d6e8da24", "value": "dc62fa6400ed62c5dade12c984fb1ffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92d64c3-8518-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700205172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205172, "uuid": "9785666a-0d94-4a95-9142-2bb47a9ddd9c", "comment": "Malware payload", "value": "28a66a9cbaf75bbdd8df736d7ec68e2a", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205172, "uuid": "ee4c5c7b-3c6a-42a6-8398-d4cb823905b5", "comment": "Malware payload", "value": "a40d65307e67af3f18246669957114fa5f5e8de3bd7e2178b86e6a78f644dcf3", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205172, "uuid": "9b9bf872-6149-42f6-a3cf-b8a8a6885929", "comment": "Malware payload", "value": "bd960cba671c6293008f73e8e4199d4620312176", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205172, "uuid": "1daf8d3a-2c4e-4a14-ad38-586aa5c178d7", "comment": "Malware payload", "value": "a7c292a18f3bc4b4c9cfcc8db72c732c6b147232ab8a18e9424a9b7875c4cbf199fdc5f7cf014217d96af54854e5138b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205172, "uuid": "400bdb20-ea79-477b-8c99-474e8ca9ec65", "value": "T1519533B6953F152EEF4184BF509DDFC64F4DACF3604B067C02AA9C58A0189ADBF64B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205172, "uuid": "e808d636-1ea0-43e6-90b2-cd5574168901", "value": "49152:f7R7zJqvtIZJqvtIKesgSKjrgYT8Wdub3227CMxPTs2cM:fVxqvtIrqvtIKeswgYTBgfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205172, "uuid": "4ded154a-f77c-4a41-a343-cee21b72d77b", "value": 1911309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205172, "uuid": "b299fb4a-e609-4b3d-9c6a-faac42a1ba8e", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205172, "uuid": "04bec25f-3ce1-4791-84d7-dfb833c100e8", "value": "Update.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509acd57-851a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700205856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205856, "uuid": "b3f01642-7086-424c-9418-3df58ee7e266", "comment": "Malware payload", "value": "0d4cb1be75ed7692e127e383dc9d1d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205856, "uuid": "a739ceb8-e30e-408f-9f74-c54a1b647dd3", "comment": "Malware payload", "value": "a5621a97a988975b5193f90ade0275eb08310d6f1356412f9b4e015b820dc54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205856, "uuid": "c5db419d-c0aa-41ba-80c6-cef715059236", "comment": "Malware payload", "value": "6c696801b5171f974a0bbf2b0c7e69c9c67a2e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205856, "uuid": "0934ae94-0f96-4e40-8ea0-f0ae1cc3103d", "comment": "Malware payload", "value": "4de06d4123223b6acf484d31012cda08c7770a03e761922a6f24d556006781c85654b59842b75a680973aec4ffd773c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205856, "uuid": "1b57fb76-d6e0-4c91-8614-ddcf2e553c45", "value": "T10734180382E13E56EA268B73DF2FC6E8778EB6508F49776912199F7B04B11B2C163750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205856, "uuid": "9a8e39e8-ce1b-4430-a50e-9e691ef5f6eb", "value": "0a51b1dee43d79ab01dde11c015d41e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205856, "uuid": "8445c918-a85a-4714-a927-4d252e17d268", "value": "3072:cddpzLbGODFWSf6Nr4tbb53R0xumBk9uXRtF5eJ21ls/zvl:SpzLKkSSxaK9SF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205856, "uuid": "8ccf6ed8-0e7b-4fff-b107-f077eaafc5c8", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205856, "uuid": "14f02fe3-37b2-4e64-b478-43dfc2f3816b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205856, "uuid": "1a2aa08e-7be9-4a16-a2ca-75798c2518aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961fb26f-8559-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700233031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233031, "uuid": "dc1ce2f7-0cf3-4dd7-aad6-f531be99a60f", "comment": "Malware payload", "value": "a11b520a2fe1634711daddaa0ec03385", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233031, "uuid": "3dda794b-f0c6-4d9b-b703-7c04659260e0", "comment": "Malware payload", "value": "ac2e7d896503de992cffb72bbefa229c574aec1c4eb9770a276e2a89f85e1d0d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233031, "uuid": "c2c68680-ee82-4b06-9def-4058b61afcf5", "comment": "Malware payload", "value": "bd052879a7374a71646e40450afd20d0508d2fc7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700233031, "uuid": "749109bb-1c98-4b00-9025-bca82c965e61", "comment": "Malware payload", "value": "75c71d69f5c48c18ce2d76048445623f55032c532ab54cfbf0569ed68e38720dcb9c11bb4dc1ea6560101a825d947c6e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233031, "uuid": "96296932-5559-44ae-b96d-122d7bab3242", "value": "T1D2C633E971B2E0BEFE4EA0F57157C883156895BBC8387D958D24E540BF33631A6832B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233031, "uuid": "7efaa928-591f-44bd-9f9a-35245e0accea", "value": "f724bf854d48d0d9304afe0d4a20398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233031, "uuid": "b1755909-5219-41c5-bc63-16eed227bfff", "value": "98304:uSWRZML74SV5/tehLUI5YvY/hIf4n08IOeGq6Tt5r1MR:uLRZM/4a6XU40K1J5r1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700233031, "uuid": "09d8ed89-f2d5-4e9b-9929-8f452de69e9c", "value": 11576672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700233031, "uuid": "98ba655a-25d1-4eaa-9b4b-6adec0497a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700233031, "uuid": "89c543a8-6d99-424d-bc2e-b7b56b51fd04", "value": "Discord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da449b3e-8557-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700232286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232286, "uuid": "800548c9-ec21-4e14-9fe0-0d7f9a38b432", "comment": "Malware payload", "value": "345e6d97979785eeb72f8abb68f702c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232286, "uuid": "afd2efd0-00ac-4f87-90b8-fe27934580f0", "comment": "Malware payload", "value": "ac619e70e1f674bb4cb371b25ecaf913cdb7acc9f4130a1ff301ffa84ad86f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232286, "uuid": "d5d61d22-4d71-4d1b-9656-79545bb7608d", "comment": "Malware payload", "value": "f83f1e11185e75099670dd2eeb640348a8d9fbeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232286, "uuid": "631ef8ff-1f63-47f3-b1f6-b4cf85476967", "comment": "Malware payload", "value": "b3c78b98e828ec18e0e56b99da7b72e37c2e5191d18511d7e413bb0504b40449c06e9418b9ccd25d4dd098c3d89c64e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232286, "uuid": "0d58739e-9075-4e89-b86e-ff6d549ed1bc", "value": "T16927BF1235848576DEA723B342ECF655C11CD4A007D25BCBF29D26EEDA726C13B32B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232286, "uuid": "1283dea3-6c86-49f8-a7ce-e36f76a236dd", "value": "954a638f7d616d50845d17dd2901de21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232286, "uuid": "048f07a0-447a-4c03-aaee-0c089c0a556b", "value": "24576:WzarymSD/6+sZsF9ywIHhTfH6Rvg9I5U:3SD/6+sZskTyFg9Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700232286, "uuid": "fb65e9bc-f2fb-4e7c-a5a9-70af20a1d342", "value": 21047584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700232286, "uuid": "16d73b75-fc04-471a-b9e9-fe83c6b5cecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232286, "uuid": "6f9414c6-142b-44cb-a09d-cc52e5720b14", "value": "Soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375510ff-84e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700184339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700184339, "uuid": "863af778-1d55-4faa-94fb-1c416629f165", "comment": "Malware payload", "value": "729d715b863ca0a46cbc7cd7b4cee959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700184339, "uuid": "879a0320-8a3f-4c73-b6e0-09f7c64a8be0", "comment": "Malware payload", "value": "addcd44ed648980e8bed20517c5fddf1dde5da3dac960339f4d049cd974daf5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700184339, "uuid": "e385e13c-d644-4981-b21c-3ae172cd98ba", "comment": "Malware payload", "value": "cd8391e13ae4452cec778dd3ba1b120030b6d8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700184339, "uuid": "c7055d12-3186-4955-80a0-69b3baab39ec", "comment": "Malware payload", "value": "016bd30d956d4e7b43132e05f59295f41bbbf33764d2bd1ab2446f0eada805bad51986006d2f7b8c8cecce27cbec97ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700184339, "uuid": "0d746cbb-a784-4754-add2-cdc31a7710c6", "value": "T14706AE41E2F0AA5DE4EE8536DEA0A3F522B36417B713E394CC44E458782C6D78ECC667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700184339, "uuid": "2d1bf13f-ab8c-4ea8-9d01-fe2af3059558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700184339, "uuid": "296ff630-a188-4397-b5c9-da0b2908a25c", "value": "49152:oeYVYlrGvqBpHQgPc4KojRWyHmqSLitYr/YYQSfGRjAwH:HYVQrqa1QgP/3MHitYrQY5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700184339, "uuid": "5221338b-a45f-469b-8b20-f3b0e2d189da", "value": 3716464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700184339, "uuid": "d20e465f-a516-4c96-8d3d-bbab326b87ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700184339, "uuid": "c63558c1-8c87-4512-98db-8ce6dab3ea6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ae23f3-8556-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700231822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231822, "uuid": "2ba5d965-2008-4074-835b-85730979ccea", "comment": "Malware payload (AgentTesla)", "value": "9d955290bc69089a22c5d55bb56b5bb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231822, "uuid": "0c044ad1-d894-4d72-a074-7b5670cd58ae", "comment": "Malware payload (AgentTesla)", "value": "adfc9e2a5a95ac5f6cc3f3f8d5438d13239bae44ff379fe89d2ecaed8f5557fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231822, "uuid": "02caf5ab-93e0-4d64-835d-1e16aec00e74", "comment": "Malware payload (AgentTesla)", "value": "230d3ac3f111cde0f71a3002631f51db64afcca8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231822, "uuid": "98673463-55fa-44f8-9582-1e983c01b93d", "comment": "Malware payload (AgentTesla)", "value": "37b739e065cc821c0dca1fe7a9c1bbce24bf75c10b03de7d61ff3f3f2594f40938058eb81d2bee891472ff2fea35889f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231822, "uuid": "439be5d2-147a-4837-a100-d9eb913b863b", "value": "T16735263D5B9A0667FCB9C6A7EBE0812BB061AEE3F1189D28D4D73351533294270D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231822, "uuid": "bd72f3c7-18d3-4919-82e4-1d64639a2a1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231822, "uuid": "0b558b4a-78c4-41c7-af18-9a341bd17125", "value": "24576:aiJgghC4ptbDUqgAsfB3mmOk4K4YPMgNRzNBsmC7:JOgAWbvgAsMmehYPB1B/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700231822, "uuid": "f08556f8-edc8-4fb6-99ea-23d958cd05ce", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700231822, "uuid": "150e052c-64ec-4946-b0ba-dd607b0ae52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231822, "uuid": "85de533e-df8e-4d0e-a7c1-86fcf36045d4", "value": "DHL_INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe6aeb5-850b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700199305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700199305, "uuid": "ff6e9fe6-9ccf-4956-aebd-ce614fa4e517", "comment": "Malware payload (RedLineStealer)", "value": "353ae50ec5367bc589bce1c0fbe8c672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700199305, "uuid": "a04ee878-de84-4d50-baba-63a0ba02207f", "comment": "Malware payload (RedLineStealer)", "value": "aeebd9d6617f6203323d39761ce1cd949cdb7b05ed4c8a1ddb5693c48606c9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700199305, "uuid": "544bfdbd-4103-4afc-af1a-11f83f727615", "comment": "Malware payload (RedLineStealer)", "value": "1478df6b458a6028e37639a33bd4d5edc0747426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700199305, "uuid": "8f88a966-e1f7-4a63-8f00-9834614fed2c", "comment": "Malware payload (RedLineStealer)", "value": "45cf227cac405cb771993867bb4f13716a42c79a3e3eb39b4bdedf09ad59b1cd904cb3c26b8cac91fe3c78b01e6ab868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700199305, "uuid": "1f2387aa-04e5-4bf8-a781-e282fb4bcf66", "value": "T1EC352306ABE8E039DC763BB92CF602832E76BC615D34578723455D4A2DF26C0D970B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700199305, "uuid": "83b2aa07-ffdf-49a4-9495-f72f944cf3e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700199305, "uuid": "ab03064e-843c-48dc-bb5d-862793bc3a37", "value": "24576:eyz/qydWD9nW2UGiefpbcCPWQ7oq43cTYeKVn3kwtwG8GsnQPSnZ:tbqFdWOieJbuQ7VqxV3kwKlGgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700199305, "uuid": "249861a3-43ae-421a-97a3-423f09d8e662", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700199305, "uuid": "49162ea3-f098-42a0-b785-e90cbc2a8ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700199305, "uuid": "2607c63b-186a-4037-abff-3fc91edd2391", "value": "353ae50ec5367bc589bce1c0fbe8c672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff67600-8516-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700204405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204405, "uuid": "a2a4616f-c02d-442d-9718-6397b806d438", "comment": "Malware payload", "value": "4f42491c67236f987f104332b8c9933f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204405, "uuid": "baa335b0-add8-47db-bb0c-2780da673909", "comment": "Malware payload", "value": "af641e3eba0480515e0d8593d248935015f446840bc741ff54aa5539277f74fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204405, "uuid": "86e0e4f7-29eb-47ac-9aa7-78e08aef5818", "comment": "Malware payload", "value": "190a7bd5eba5b5c8b4c134f05334938c76d5d832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700204405, "uuid": "08a42af8-130c-40d3-bad8-a80297b5a42a", "comment": "Malware payload", "value": "b63a51e9653cf3959684e68d80c77bd052f2ba1b8c1822b0e1854f94b040cd7b33c9de36e334b96ed46bcc90182a0429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204405, "uuid": "be5005f5-6a5e-4338-979d-9e999d5371cd", "value": "T1D7763321B7B084F7C6255032A9A8CB55DDA6C0398BFA98673FDA8F6D4C5FD40633062D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204405, "uuid": "6fba796c-600e-4456-b994-4ec76ea4c9fb", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204405, "uuid": "bc84cc1a-4a5c-4704-b792-ced504d78f76", "value": "196608:91OSm6Yz7+EdTZU+kmTTL/Bg25akDyNmffsuj1zQeq6ydX4N:3OdGEhOLmTnBXHzQeC4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700204405, "uuid": "506d7219-724b-47ae-9dd0-e18612ba7767", "value": 7507496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700204405, "uuid": "6b00d0e5-a5ee-49bf-9937-4bea7de7b03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700204405, "uuid": "7f8e8bde-c86c-4727-99e2-b5d7d146ba71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b395319d-8531-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700215900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215900, "uuid": "14830742-800c-4449-9028-4776a995ffcd", "comment": "Malware payload", "value": "948b3b9b444731029662621b55322e3c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215900, "uuid": "7de3724a-b0a8-4ae3-805f-3049731ee189", "comment": "Malware payload", "value": "b019ed0bb09bda78af75f941ba1bb88f3b3e3604a202309d8661fdaacb04d02e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215900, "uuid": "6836c13f-2f84-426d-ba48-8ddb813b49b0", "comment": "Malware payload", "value": "54ef6b79fae6b105f86c1c511389021ea92a79bc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215900, "uuid": "57e97dfc-917b-47df-8910-8bb8ce2e6383", "comment": "Malware payload", "value": "27fc00dcd4a13dc5e83ea85e10100f5e4e1d35b5a12f10a0e0afe2c9db800d600b974c8d7a6e93902526c22c07d6636c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215900, "uuid": "7e3be75c-e002-4cc1-ac28-20c20ec47659", "value": "T1D571FC1417E40224F3F35F3A98F766119837F85DEE228ADE5190C68C08A1628E835F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215900, "uuid": "0df93ea7-f178-473f-888a-2cb374adcc5d", "value": "48:8oLuaFktOWoLsLcK9Cn9e9+SLWcbEbxEqd0Y9XuHQBqiYLq4:8oLXkO9If9Cn9e9JabxEZY1um3YLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700215900, "uuid": "8b3c74ed-83e1-4c13-b14d-0b8e6ea5bbb2", "value": 3562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700215900, "uuid": "5698a27f-9010-4809-bd63-ac4bf9759d77", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215900, "uuid": "b5bdc47f-62d7-49f9-be93-21deb730da2e", "value": "Recruit1123.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363700fb-8537-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700218267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218267, "uuid": "8382e594-4820-4436-95a0-2dd82aac2f25", "comment": "Malware payload", "value": "bcc4f9d6e5d0a6f5f2dabfee7189025f", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218267, "uuid": "80db6e5f-22f5-420d-9180-7aee634b20f4", "comment": "Malware payload", "value": "b146b638e7606d79ca614e8e133e75c94a73cfd2e4924cf26761fe82a4fd9e76", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218267, "uuid": "5da10dba-8fb6-41ec-94c0-9b5be3c93a8a", "comment": "Malware payload", "value": "eee979fa6092e9e3d019b327db5806275cd5fbdb", "object_relation": "sha1", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700218267, "uuid": "c24051e0-2b79-4c8a-a563-92a9b6eb1d3f", "comment": "Malware payload", "value": "9360696e8a6a7fea9e3b489a43805eeac1a2968630fceba0ca657c30db204555e23046d13f427f9c3b3cf46044f86a78", "object_relation": "sha3-384", "Tag": [ { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218267, "uuid": "52d6c790-061e-48e1-855f-41b2bb481249", "value": "T1E9E533776F6880C79FB371E389629D1FF564160141AB30C7A9908BE1E713937A92E32D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218267, "uuid": "65c01834-391d-4727-b245-563e480cf78f", "value": "98304:I/TGHzSAohuKI86gLViqIqKqnCThoXu8BFWjwtF:IbGmhSeVidnTaXu8Bse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700218267, "uuid": "401e4579-2a1d-47c9-9020-a587b2b0e0fb", "value": 3297237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700218267, "uuid": "f80b695c-7cdb-4632-81fa-efc056f03b7e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700218267, "uuid": "0ff2c02a-e38c-4035-ab47-225a7afdd363", "value": "loader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0208db-8588-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700253039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700253039, "uuid": "f993fe0f-0825-4190-90a7-52b5a0a48d3f", "comment": "Malware payload (Mirai)", "value": "a1ddf0509ae2aeefff408f461c210905", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700253039, "uuid": "1cec2fde-45cd-4e99-addb-4d4a56e3a191", "comment": "Malware payload (Mirai)", "value": "b41c7a37e85d393f42ff62944b59ad7bcb592958cf5d4289c6c18cb1da5e6b7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700253039, "uuid": "06de507b-afc2-4786-a591-535ead8423e0", "comment": "Malware payload (Mirai)", "value": "f70ab04fcde966fd65428f393fccb15453f2503e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700253039, "uuid": "29aca917-8d31-4ee3-8727-3897d3936136", "comment": "Malware payload (Mirai)", "value": "9b2a1e1abc0031411ef81256a2f177595b0a91d43090a0c5b81228ef10dbbbed9cc4262c48e10be7dd716c2fdeed27e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700253039, "uuid": "e5eecbca-8e15-4f69-84c1-ead92457935a", "value": "T115534BC0B643E9F5DE020674306BEF324E37F6F6211AEA87E3E49573AC425419543A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700253039, "uuid": "0465d1e6-31c7-4840-9470-a74fd7e89b2f", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKjMaww2AXnt05HFEia:1jSwY4keBfrtOCQsnnFaCwF905l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700253039, "uuid": "1089a12d-c92a-4d89-a458-6bc384a3c35f", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700253039, "uuid": "bfaa0bcd-7bc7-41bf-924d-656a9cea135e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700253039, "uuid": "6c7443a6-6221-4141-8af9-0e1e3127d18c", "value": "a1ddf0509ae2aeefff408f461c210905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234189cb-8568-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700239280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239280, "uuid": "3d742219-8430-43a2-aa28-74e0a533b3b8", "comment": "Malware payload (AgentTesla)", "value": "9d5b16cec4adee050662fe393ba2b711", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239280, "uuid": "f36097a9-fb2f-4cf3-a988-4abdb02aa27e", "comment": "Malware payload (AgentTesla)", "value": "b4c242f61625ce4a80c3f99579bed1f25f876f0d28c2bc1f72e884704a168fd6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239280, "uuid": "54a6b5ac-f1a4-4081-91f2-7db66c7115a0", "comment": "Malware payload (AgentTesla)", "value": "52ae526347fe056623fb8f328cbcc58b69b2bb72", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700239280, "uuid": "a64a9ce1-e508-4419-8056-38895b8e0204", "comment": "Malware payload (AgentTesla)", "value": "4288d190d65489908d724e932e52fc3a913ac302b22ba62a18d851ada60ade18ffb321bb8c6df0534531ad6881f8a88a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700239280, "uuid": "bea77d3f-fad0-4f91-b9ea-015913f07efa", "value": "T17FD4238C6BDEDCE49373498E2B50D70635107C643B1C4AB39697E8CEA9C8CA4CCD65E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700239280, "uuid": "386bc448-cd9e-47d4-891d-171c9637b9b3", "value": "12288:5pc+Y7SPYQZmlKuskXrXqh7t5E47b1ac5Q0XL/++zqvRTXneVyl:bdY7SPYQZahqtOD6iweRDeVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700239280, "uuid": "539c5fde-e238-467c-982e-4f539d000ff0", "value": 616352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700239280, "uuid": "6e8fd2a0-36f2-42a7-a882-897999061bed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700239280, "uuid": "305fbbae-29d5-487e-b6bc-8992a6f3d086", "value": "S25C pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f108c9-8511-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700201919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201919, "uuid": "3bd1c39e-91e8-413b-bbe6-790eb56ae29b", "comment": "Malware payload (AgentTesla)", "value": "6ffe4bac4ff88ce75f0a33e77e552750", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201919, "uuid": "4e39dcbc-80e0-47b0-87e4-ae4ca1962b56", "comment": "Malware payload (AgentTesla)", "value": "b4e17af67f0a7a0cc41e2a97e2c4b2491592f72efaf1d61cca890c1d76cae089", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201919, "uuid": "13ad8861-43d8-4c24-a5b9-5314a77cd0d6", "comment": "Malware payload (AgentTesla)", "value": "96bd31273006a267b08c5220769fec0677250bd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700201919, "uuid": "3ca9a405-8c24-4785-8b72-adc1627e5931", "comment": "Malware payload (AgentTesla)", "value": "2dbc9e02413dcd78db8dd350bb9b4bb56af3a3fda0a972961a9f0ade4030843667ba6118eb40a1424c0220bc1f7f158e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201919, "uuid": "3cbecc19-c0d5-419e-9141-1f3d81cc1282", "value": "T1885516385B9A0667FC78C7B6DBD08117B261AEE7B129DD24D8C233C65732B4264D423E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201919, "uuid": "186d2df8-6e45-400a-9fdf-6450c8ca991e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201919, "uuid": "21c79aad-9353-4736-ad8b-2897e8c69bc4", "value": "24576:DdlEFnxn1I636fvNSGTBiQDNnA8PsnjF8i8xj57:TEFnY6qldDNnA8eF98xj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700201919, "uuid": "3d266144-cb58-406f-b52c-12649dae2d4c", "value": 1287680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700201919, "uuid": "231ab32b-7ed6-445e-98d3-70f8698a7885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700201919, "uuid": "8ce0e2c1-c582-43ad-b56e-f0f0e7cedcb9", "value": "SecuriteInfo.com.Win32.PWSX-gen.48.11274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de47ebec-8515-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700203946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203946, "uuid": "0d433d15-b5ef-421f-9e40-b26bbd1c72b7", "comment": "Malware payload (AgentTesla)", "value": "ff6d48f8b550eca5b793a8cdafb9c689", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203946, "uuid": "8181b80b-86d4-46a1-96cf-a2d89165e5e4", "comment": "Malware payload (AgentTesla)", "value": "b68d03062282d38f52d9c19540ec2e1ec85eb501fac42d5ac64c4f77b1e087c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203946, "uuid": "01fc5ea8-56e5-41b1-821d-e5afde215140", "comment": "Malware payload (AgentTesla)", "value": "5ba7c7aa3255ac0c3b2dfacbf7d9dc3d613a43ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700203946, "uuid": "6763ed42-acac-4744-9231-63c4985ba205", "comment": "Malware payload (AgentTesla)", "value": "6a9ec05f34ee6109c1f7b2987893b2f0e4bec4f82558eac2e59c68a2b81f9e3611f4043b3d753df971cd4f74b97701af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203946, "uuid": "5ba3c033-70cd-45b2-91cd-26e1a3e81175", "value": "T104F4ACB42169C786D37987FF286B90705B27AC199571D38C3EBE71C90DA5B830A01EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203946, "uuid": "db93fc75-a74b-4baf-8053-42e6461dabb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203946, "uuid": "61dc7026-33a7-4d2f-90e3-8f0ab51d6f05", "value": "12288:EXk/aAp2iNkuPF33L1odtxWuLuC0CGi1hKwaV1iOQSzaz7/Kq6qZjMwuHSlThuZ:tHp1l5b1Ct1LuX978tyS16IJrlQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700203946, "uuid": "1b5c665d-6e99-4bef-9e34-749d33282782", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700203946, "uuid": "7fb68c6b-a78c-404f-afe2-66974b633f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700203946, "uuid": "ffc9c35e-421d-4d99-8437-b5169152301c", "value": "payment slip & voucher.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477c62db-8557-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700232040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232040, "uuid": "5a8b8cf0-b6cf-424f-875d-acba62bd66de", "comment": "Malware payload (AgentTesla)", "value": "25e14638ee6c5b04008b3b50b99f576f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232040, "uuid": "7933a1a6-dde0-4e97-818e-197ffc0ebfdd", "comment": "Malware payload (AgentTesla)", "value": "b78001c65caffc4ff2cf300a7b2c2924a00720b34a38e5d021d115dfa419cbd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232040, "uuid": "b85ed157-a41e-498b-b654-0635e1b29c40", "comment": "Malware payload (AgentTesla)", "value": "5ee0d64b3f79aaa8cd62aa05d99cacc812a15452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700232040, "uuid": "070bcc86-ad63-4140-8705-01cd187654f3", "comment": "Malware payload (AgentTesla)", "value": "cfc931e1999bc6d69987e0f59f399dbcd8b90060282e2842bbf64abe906218fcbe7e9338b44f5d41a55f5e28ac73ca87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232040, "uuid": "bcb92076-540f-46c8-99d0-3f4ea6c52b1e", "value": "T14835077C9B8A0663FC78D672DBE0C537B121BEE7B1285C2CD4DA3B126772942709416E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232040, "uuid": "989d867d-c93f-44b0-a23f-d9ce6cbbcc92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232040, "uuid": "dc85bbdd-c22f-468b-9e15-f66db50630aa", "value": "12288:37dBa/mFiTEJ0+0OR8FCko7VOkILM/PgyiZc410j8y6Q6UTRPStxmVmiTPLR46qh:rbIHLG5iq4Ho6UTBStIwifR76Nt4J1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700232040, "uuid": "eb098c7f-017c-4fb8-9ef2-bd68e02760bb", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700232040, "uuid": "51d77a44-0852-475a-b02b-e9c02f42c9b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700232040, "uuid": "ccc8c30f-7294-406a-a26d-d4f7f4c9afb9", "value": "Proforma Invoice - Well Ergon 16-09-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f6aac8-84e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700183605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183605, "uuid": "d17b17fd-81f6-498d-868e-25da9c43bad9", "comment": "Malware payload", "value": "4282d31ad7ff75b2ea213749682f9fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183605, "uuid": "c7e263c0-42db-487f-84e6-de77770411fb", "comment": "Malware payload", "value": "b8dcd34b9fe90a14b158c98478ed0314eae481bbe7498655b5d119c3b830412a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183605, "uuid": "b6973c0a-89b4-47ba-91d6-ef6dfda6a643", "comment": "Malware payload", "value": "5d77d6d7331af62ea025c47895693be5477162b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183605, "uuid": "238087be-10d5-4c99-8a88-d5a3fd377d8f", "comment": "Malware payload", "value": "a3459bf6a5db989cf56db796ef5607c0485ef378665dda638f93e57768b2a3165db817bbc7851b101fdc78784c74c766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183605, "uuid": "b0cd2537-9330-417b-8551-1861d2cf3145", "value": "T1F7343A0392E17E53E9268B739E2FC6E8779EF6508F49776922189A7F04F00B6D163350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183605, "uuid": "ce2ea245-7cbc-4c28-9ab5-b1941f9c47ba", "value": "4b036b1ebc23e5c5c9b73c2e7870fe99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183605, "uuid": "fba3b604-191d-401d-89fc-ab6a94e89baa", "value": "3072:wWLiRL54+eAq4X0TtoV/rcSWUZpGUSKROtZeJN1u/z4U:lEL54ke8LWU/GUgtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700183605, "uuid": "809d3dcb-e778-4668-8a45-c56a1fa3cc6d", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700183605, "uuid": "2ba0c7c0-19d1-4791-9418-47e5c3ac4e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183605, "uuid": "8550c11d-5df9-43f5-919b-ed9b3234e444", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd108560-854c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700227620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227620, "uuid": "1f2231e6-1098-4883-9dd2-7b3c1b1cf74d", "comment": "Malware payload (AgentTesla)", "value": "18ff1162fef9d599bbcff7f4bc4a21e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227620, "uuid": "1dadfd63-ba12-4085-9753-e8395b559526", "comment": "Malware payload (AgentTesla)", "value": "b960e59e160d3b049843908bcfb05c00326a252a574de70d2126ddaa8f48a962", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227620, "uuid": "73fb41b6-9b8a-4511-8b25-7bde526137be", "comment": "Malware payload (AgentTesla)", "value": "5bf8dc2e057a079c2a2a2e2412dbe68790b1185c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227620, "uuid": "c2f3e40b-8823-49ee-ba95-5703a1d2a95f", "comment": "Malware payload (AgentTesla)", "value": "b8c77b10bb390e7e3f2714e9523878dcd6ad8999192481817ac71043de87dec6bda2802f372a55452f4144fa450b08fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227620, "uuid": "e70dce6e-e20c-4a88-99eb-65f7771a56b7", "value": "T182F4F53D1B9E1667FC79D6A7EFE0812BF061AAE3F2099D24D4D703569302942B0D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227620, "uuid": "9dd428b2-3b29-421d-b55a-ae1954a7bc73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227620, "uuid": "bb7e6255-55d3-4252-bbb6-f2c5d1150a5e", "value": "12288:c8Ba/mFiTEJ0+0OR8FCkoJrP46F+GZUTh1nGck9suFBRGK+VgSOP2aEP44v:coPv+Ge3GckKgBD+beBEPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227620, "uuid": "51fd12af-02c3-4425-9ffd-97d6a1f2fb17", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227620, "uuid": "a31a7fb9-2f75-4d54-b5c3-f36d0a9c21ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227620, "uuid": "403ff511-f1c8-4dd3-958d-d860e945312b", "value": "SecuriteInfo.com.Win32.PWSX-gen.31505.30455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37366dda-8524-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700210108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210108, "uuid": "cfe2f5af-be76-457e-8194-6774d2eb5864", "comment": "Malware payload (LummaStealer)", "value": "678ef91e7c6d2cb6e003a1b9e1aca2e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210108, "uuid": "c461b8e8-a989-426f-b1e7-37f61108a37f", "comment": "Malware payload (LummaStealer)", "value": "b99b1c631dbf1cb6e7f32dd148dd9a52c4128431af3d52144a051288e40dff68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210108, "uuid": "4cea6f44-d4db-45cf-bdbf-29c46b409f66", "comment": "Malware payload (LummaStealer)", "value": "e144792794b972238c22c808af72fe94eb07f725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210108, "uuid": "9f8ff633-18a4-49ff-a173-c2ed429a0f94", "comment": "Malware payload (LummaStealer)", "value": "30693b851a72a570b1150fcca9c925fef0b9d392416620187ef2f18497d106ac9c8192f5a5282102453af645cb4a3e3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210108, "uuid": "60484503-6126-45e3-a092-ecdacfb6e45e", "value": "T1BFB4CF43D2D1BC94E9618B7A8E1FCAE8721EF9508E1D37663219BF2F04B1173D262356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210108, "uuid": "a8703d99-f08a-444f-adf7-1a536f50d87d", "value": "3c071df9f91908eb18d041533a3c969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210108, "uuid": "30e80033-f14a-41a1-a2b2-59cfb0bfb43f", "value": "12288:SfdszJwdDYfygTZVq26HJ02/hR2FvcUtvy7SlN9gKzyl:BjKg2HJtpcUU6S1gKzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700210108, "uuid": "6dcd7a2e-190a-4fff-b72c-cd485e37872c", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700210108, "uuid": "3bdcd8da-80fb-4545-b8cd-81c21435dbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210108, "uuid": "48ad26f0-edc4-46c4-a3ed-97c72f7faf6c", "value": "678ef91e7c6d2cb6e003a1b9e1aca2e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b067627-8560-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700235831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235831, "uuid": "3967e1b3-4ba5-4c1f-9e7a-01e1e28182b6", "comment": "Malware payload", "value": "6b13a8ae290d32b179b33c288942d102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235831, "uuid": "da178b85-c98c-4928-89de-e16fe04c82e3", "comment": "Malware payload", "value": "bc842797c37278951f77869edbdb0d8f5f05c0eedff245e8c45e2a3f46ea0e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235831, "uuid": "1417e2b1-35a7-44b0-8e3f-d6340b660c1e", "comment": "Malware payload", "value": "1b2e528a6d362707c1925f571bb64096cde1b36b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700235831, "uuid": "c39fe9fa-b6e4-46f2-a863-4a601c32216d", "comment": "Malware payload", "value": "80a3dfaf33b88b6a6c639b511f359e2ea16397941dae80953f52427439881d17a4e70658d454bd9f278902a7fdf211c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235831, "uuid": "2b33d196-569c-43cc-9b11-d3b6605491a8", "value": "T1FFE533DF1F1903B3E12A6F31ACB3845BE2FDEDB688B0218E382F191650E5BD35965650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235831, "uuid": "2fa45e13-34f7-480d-94ad-5f9cefe17572", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235831, "uuid": "505b5830-d4ae-4045-ae0f-6ecceab312de", "value": "49152:4b6fR16dVcVhiWLGgbkMBEvuz2mZ440DCkPV0Z/C/emSm4pQxn086mQtpZOR2EBo:4ba/60VtGgbAuyx7DCk9x/e7QzIOR2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700235831, "uuid": "2cfb76d5-47d6-4700-870a-ffdb01a2519b", "value": 3265800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700235831, "uuid": "eac1aa20-7073-4d05-bdd8-c2228fdab5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700235831, "uuid": "86c41485-48ae-426c-afc6-972fa808a950", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e09ec3-856e-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700241909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241909, "uuid": "5ff93009-75a8-4f11-b5e9-f542a91bcdd5", "comment": "Malware payload (RiseProStealer)", "value": "8b57c69dcf82f6c37ebff395953075c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241909, "uuid": "4681b7ef-f35a-4069-8972-1372f48ac4cf", "comment": "Malware payload (RiseProStealer)", "value": "bcf0a5b47c85feb87d61913b364009ea43da0f7036d5bbf5d0f4c89493ff4f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241909, "uuid": "b38ab59a-3d7d-4395-9b98-e23e7e2d69af", "comment": "Malware payload (RiseProStealer)", "value": "c40b608b3b55e2fd7f8e48ff2405e48cf2a7c2b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700241909, "uuid": "b06dd0f0-bbc6-4863-86c5-d7c508daeb1b", "comment": "Malware payload (RiseProStealer)", "value": "d168bcced17c5fdf31b668dce26cdc10ea0c657b8ca767bf45539fdaa6eeb47c13a9077609dc6f4f3a9313e3c865380c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241909, "uuid": "5ae94e05-7120-4fe5-bf22-3a250b985b40", "value": "T1E1F5D42136EA0B49F5F39EB967BA66D11C7EBC698B11C6EF1151944F0821EC08DB0B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241909, "uuid": "699b0a96-b265-44fa-8111-2e66b19d7b18", "value": "4e4a6bcb0a4d906241efada3b9ef82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241909, "uuid": "041a9cb0-339c-4109-b585-01058d0c0070", "value": "49152:Cp+jMc13tn/Ge86a3vHMhjBRuztPnTjZIHRZnyaTSZVxv:die7vhl03IHRV+ZDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700241909, "uuid": "12972c75-ac86-438f-bb84-8c20db97fb3a", "value": 3394104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700241909, "uuid": "6ca9cb7b-6af8-455d-8612-1d05582bfdc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700241909, "uuid": "ac9b4134-5402-4f96-af66-8999dc587493", "value": "8b57c69dcf82f6c37ebff395953075c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d246dfe-8518-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700205125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205125, "uuid": "4dbca9a4-c18a-4446-b03d-c7f3ad227a2c", "comment": "Malware payload", "value": "261e1e343d520ffa8ac7d8400fcc0c91", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205125, "uuid": "515c9710-27a6-4b50-8c43-2ac2a739799a", "comment": "Malware payload", "value": "bfebbe076b3f8d880644a7f0d3e76d60e4be1234503bcd02f73319cf1999c64a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205125, "uuid": "04c87239-38ca-4f93-989e-f30c7f1f42c5", "comment": "Malware payload", "value": "7a03e54bf6a0be1d93e6be7b75f10e2a2bd7bb46", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700205125, "uuid": "f7447e7d-0dc1-4359-939b-a5a0830fe8a3", "comment": "Malware payload", "value": "8073aad15d8da6cca826b68d36d695b11fa9bf0e434ff5fcffbdeece82d243df286ee409ffdb4577fa5d6c916dd6ef62", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205125, "uuid": "cdd4f9f9-3b76-4b9b-bab1-9b4d6d6de71a", "value": "T1EE7533AD9E9C3B706DB923E8F1429AB7D400983BDF4825D21971974760214B2AFFE13D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205125, "uuid": "b2a00d55-95dc-4849-8793-d00b4e956d7e", "value": "24576:wrwRUPrQwtywUMtVYshOmI/mtXPc2qXDxlPnizWYiK2TrSgMcdG/zRiPAfthBPh:wrwiQwJVThY+tXE2q6cKI21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700205125, "uuid": "2ba05253-89e8-4251-80d4-15c0ba4db562", "value": 1660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700205125, "uuid": "d6a9f78e-a39c-438b-9483-742aa3531c7f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700205125, "uuid": "f865cf6f-8c36-4abf-98dc-b8f09ea54ea7", "value": "TVE050610MM5FA77098.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63390c7-856f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700242614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242614, "uuid": "3d51dc50-4880-46e6-aae8-57b5e98eb0db", "comment": "Malware payload", "value": "cd4e7d2c5bfc6685683b6fb1679e6dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242614, "uuid": "9f1ebb8c-e22c-4faa-9217-0dd81c8d1fea", "comment": "Malware payload", "value": "c0f406f22d89749d5d275f1ad876fd505607b32ccaf2d39a9690318cdc12e134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242614, "uuid": "3d2f265c-0cb9-4863-8936-36601c9e0309", "comment": "Malware payload", "value": "fd0227aa76218f150283b9ea98baa20e9704b8c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700242614, "uuid": "6f7c53db-d5b5-4d3c-920b-bc43b35b7669", "comment": "Malware payload", "value": "d91143b2bdc894ce4fd241cb68a8309166db520e1fed37dab59e6582d8710a5b862077333eb50d7dd462c04a9361d086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242614, "uuid": "9817a7c6-5ff2-4e6d-9680-1ced6fdbbd01", "value": "T1F8447D2357E0FCA5D9264B729F3E8AEC771EB5608F15776DA2184E2F44B0272E263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242614, "uuid": "180fb758-ec87-41bc-885b-206a8218d1aa", "value": "3af1886f786e2122c71384398144c402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242614, "uuid": "c221b949-416d-4042-820a-8b4d20de0937", "value": "3072:G4IB0ttWD4lafb1lb7Hlv1dBRmgoLzQQ5bcQrRMq+JgXjm/p4CC:pSykDs8bSgst5bwq+Jgmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700242614, "uuid": "f930c5a0-f350-4b62-9232-b71d21ac3a61", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700242614, "uuid": "8c1741c0-18f8-4c03-8ad6-cb0c30c1505e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700242614, "uuid": "b1f2bde0-35d0-486e-9fe8-6d321a2e6599", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74d0143-8585-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700252092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700252092, "uuid": "8466b90a-96f3-4a4e-8ca9-19221c5529c6", "comment": "Malware payload (AgentTesla)", "value": "040f9e138e1e4cd97b4e4ef067b728b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700252092, "uuid": "81cd33d8-ad5b-4891-9f14-9ee86ce6e7fb", "comment": "Malware payload (AgentTesla)", "value": "c3105671b44dbb43690934adc01bd2322763b6b9eaa8ca345f90a6c2de6bada5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700252092, "uuid": "77eb42a2-4c4f-45f9-a899-84e5f8c427e2", "comment": "Malware payload (AgentTesla)", "value": "054ba1e4601d8556950effea92eafa36a780eaf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700252092, "uuid": "28b53eb5-9303-438d-aa02-4dc016907dd1", "comment": "Malware payload (AgentTesla)", "value": "0a15a295cd581b7d91c4c09bcda6ce7d0730a4e265668921889b762534e6b7bcbddc006a7aef39bc8a0d4f11f9a0fa94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700252092, "uuid": "60094d2c-b36d-4359-8bc2-f2fc3ddad312", "value": "T1BB15373D1B9E1667BCB9D6A7EFD0812BF461BAE3F2099D24D4D703569302A0270D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700252092, "uuid": "9142cd01-9c4a-4f81-a31e-5f7e5d5ce6d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700252092, "uuid": "0fc385eb-da8f-41d8-a5d4-951443de30a1", "value": "12288:9ukBa/mFiTEJ0+0OR8FCkofdJqO3LBfqr1/Bka3VkM7uLvV+dP2lqEfzRS/xDhP:gUdG1/BkaSoeDdzw5lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700252092, "uuid": "e0872c34-377a-41aa-9072-36f838a9c09d", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700252092, "uuid": "e91702c8-8d9b-4a51-bcfb-d64bf66ccd45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700252092, "uuid": "4a9ea592-57c2-47ed-8b9d-f2111178c439", "value": "SecuriteInfo.com.Trojan.Inject4.59820.20999.20761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8afe9-858d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700255507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255507, "uuid": "73d617f9-8976-4e4d-a34c-4aafa41039b0", "comment": "Malware payload", "value": "fbbf0afe6f04d00af908b9c95a877bdd", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255507, "uuid": "e6996947-0e1c-459c-b074-8066ab9f1ef9", "comment": "Malware payload", "value": "c9187e5fefdbdc524ac4717a0ec388a666a8cabbfa271ccaca17bf9517e1aa94", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255507, "uuid": "fefc9947-df9a-4f78-99c6-c97d5ee048ed", "comment": "Malware payload", "value": "f562348d01bde3e3d4af3ebdf6cd74121222ad3e", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255507, "uuid": "bfd6aee0-0479-4ba5-a08c-d9025bd19fd6", "comment": "Malware payload", "value": "f69b26b35e1ec6950ae1937504d8ce66bfb75cb0700d2411b4c7e21402287890aa2ae7147fbcb8a55dc5e8c6e93d14e3", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700255507, "uuid": "2ef5634e-2baf-4b61-ac35-44092ad1d7cd", "value": "T156F43309E816BCC3F0FD277D5E0C1785D9DAB3E89BB96428E06D1A31B7224329F4656C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700255507, "uuid": "e0c706ad-91bd-46d9-999e-e24cc6aa885f", "value": "12288:E8D7cZg2r13BU23LkO7CevVPcP24PqfgrypfSjZXXTpgwD:ND7Kg613BU2oCFZFgeadzp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700255507, "uuid": "8cb40ebd-c493-4d71-b7a8-eb89faaa9da9", "value": 758805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700255507, "uuid": "787989ee-f43f-43ad-ac38-673b2a81b4cd", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700255507, "uuid": "048125c0-faa4-40eb-9d88-bb49f21e026d", "value": "INVOICE & AWB #5291760_pdf_1.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936f0758-8565-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700238180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700238180, "uuid": "92888d1a-3baf-477e-8632-e7349c5b9a4a", "comment": "Malware payload", "value": "26ad5d2fce802d95d95930da71edf1f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700238180, "uuid": "4afbdcce-3065-45c2-a5e2-272184382e8f", "comment": "Malware payload", "value": "c99d3d0a3d0d2ba99b089e1d71c8909a00e5876178c04db399afe57330bf615d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700238180, "uuid": "3e2d8e14-324e-4069-99b5-a91aff7cbb37", "comment": "Malware payload", "value": "3b5fb4025e7a52b76ceeeab3927c2bf4f831ed7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700238180, "uuid": "b8c5c82c-73f5-45fa-bfb6-d6643e62bf24", "comment": "Malware payload", "value": "8ca5d906fa25a90f3c2b51e1d1178d93e236ca9646da810285e7bc3be44be1650af1dd377ebac2eafc1d505df8e8ef3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700238180, "uuid": "71237dda-2a08-4d7a-bc51-c4532bfe179e", "value": "T12A443C1352E1BD90E9264B729F2FE6EC772EF2908F4977A916184E1F14B03B2C163B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700238180, "uuid": "dea55f93-e01b-4f23-8b11-da0a3592a563", "value": "5148e92f1190607a3db8b96a305e7ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700238180, "uuid": "2bd94544-5e30-49a6-b165-67fc4b719f5a", "value": "3072:0oqmkzP25QOLAGiwGu4fw/dqnnqqZMgUKMsooJlTgQ6RsVtpT39iVR:p7WP2vUG/5Mn/vYwbXVtZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700238180, "uuid": "6236a818-e8d3-42b7-aaa6-757ccbc7146c", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700238180, "uuid": "69897e95-892a-4f18-b635-acd205a32d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700238180, "uuid": "daf0f059-f7db-49eb-ba3a-5216971b65d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de660de-8500-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700194765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700194765, "uuid": "e60b1630-c717-4eed-9568-c6a4b00b53bb", "comment": "Malware payload (SnakeKeylogger)", "value": "cd3b89d70c6c3e69ef61043203971251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700194765, "uuid": "98c3cdbd-9e04-47ce-ac51-b92bc29517e6", "comment": "Malware payload (SnakeKeylogger)", "value": "ce19714fd8b8b9cb4f76411015264d61db6d9ffd534676df96627a3f06f75250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700194765, "uuid": "5ffc43a5-d824-4e11-8205-cf702e8d4231", "comment": "Malware payload (SnakeKeylogger)", "value": "808c5dfe3332beef56946e71c12e9aef8b261fd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700194765, "uuid": "a9e2e8c6-e70f-45fa-836a-4cb80c134ac9", "comment": "Malware payload (SnakeKeylogger)", "value": "532678f54f8351a3446381cc9c0ea5045ba6231ca30e320e3b1e14123f7ce313e666ef3f21ecd9d53e844ac6fdf9be3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700194765, "uuid": "fcdb1522-eaf0-4e20-9dee-a93762052a32", "value": "T17D05E0A632244F7BD27A01F591011D8087F26E2664BEDBC1ECC664FBB6C6FD616205B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700194765, "uuid": "136493c2-22d9-4145-af99-8890bf2438d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700194765, "uuid": "ac731bee-3565-4f3f-9845-7b23d82a1ab4", "value": "12288:nWuNuRe74QslMSwe5z/zAKkfGvu4TmCx21vqbBtM9ij23DFgx:NkISMM5b0KmE21vqbtj23DFgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700194765, "uuid": "a3b9ec67-033c-4d97-b1b5-5f0d326dc126", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700194765, "uuid": "2b0d98a0-1d55-4d5a-87f8-7355c27bc3d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700194765, "uuid": "c7dd3114-5494-4c63-896d-6096446ca43a", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.30924.10218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb40b1c-8525-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700210738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210738, "uuid": "6b168e7e-b954-4427-a734-c2286d5b12b6", "comment": "Malware payload", "value": "3cedd61842d8ecbe2edce64e0f129a7e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210738, "uuid": "c082fb1d-6c4d-4de9-9334-09bfcc3edb76", "comment": "Malware payload", "value": "ce83b8a87827462b0c1d4e5c388b2d27481e2a9eb49f398ca5e3a658a23e64db", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210738, "uuid": "3fb916fc-80a7-4993-a1f5-86824b78ef74", "comment": "Malware payload", "value": "d7b988a61b9a470206d71d908400716d3446e6c4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700210738, "uuid": "00fdc28c-6a92-4f36-9822-49248675ab51", "comment": "Malware payload", "value": "e8dbd21357e6e109428d21305cca62a211762c217c1bca07ea052e3f41cdf08c8485122a7eb388ed26dfd545009b2555", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210738, "uuid": "995ea3a7-84dc-4df8-9933-f93ca7b27bef", "value": "T1812522676BBD984BC3EC5434D2D06946ABB2C48AA547F752DFD884F24F033346C463AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210738, "uuid": "9abf5728-dc88-48a6-a567-4f9942045bf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210738, "uuid": "dba7d7e6-004a-402b-8b7e-628a47459cf5", "value": "24576:RDJYK8E4HV8NdeSJ17nytoLNGk8e1HNP9+pYy295NGnFb+oHxRX5x9:RDJT8rVAdVytWMQkYy29vuFjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700210738, "uuid": "7175ed48-fc99-4158-bc5c-1276c881fe3d", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700210738, "uuid": "9c442501-0aa2-44aa-9ffb-41e1d30738df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700210738, "uuid": "efb0d12f-47a9-4cbf-9c16-85f80c7abf45", "value": "3cedd61842d8ecbe2edce64e0f129a7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfafb292-8556-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700231866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231866, "uuid": "ed62b5ff-90d8-4422-bc3c-0abebd114ecf", "comment": "Malware payload", "value": "9039ec7e1fee686dd19770a8030d8448", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231866, "uuid": "ce467f2c-0c81-402a-a064-4caaada0edd2", "comment": "Malware payload", "value": "d018ef29ebf8308185828871818e6924bae31ccf1cc7cfef16150226f56456b6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231866, "uuid": "d9730f56-a3b5-456a-be73-693cbfd4527e", "comment": "Malware payload", "value": "40f47f2c4a93a334f27a2bf3104410041eb99995", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231866, "uuid": "3516c9fa-a45f-4ef7-95b2-4fea5d2c0b70", "comment": "Malware payload", "value": "ff456b632bd0c7b704e5bb631242bbbb87d24ed17ecb029942a698ba8f13c92ea6a02c0fd569d447206e5fdb4a026d28", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231866, "uuid": "a23792f7-bc70-4bf8-8b7b-16a538800eb5", "value": "T12C31C889F1EB109EC52396D1242F7514B41F95CF4EF3EE48298CFD3E1269709491193A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231866, "uuid": "96d24fa7-c9ff-44e6-81de-84a23b9e2ed1", "value": "48:9g5tl3pOIoBkE39XVW1w7c1M7I4AmLE5yYrIQH7LCwaJOr:O7fOIirXVW1w7WM7I4FcrIULCwaJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700231866, "uuid": "3fa4b000-7e58-4264-b4cf-11f916dc4bb4", "value": 1645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700231866, "uuid": "fa499ef1-085f-4e1b-8b3a-927e15e39d2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231866, "uuid": "5d82a9c0-cdb1-4ad6-9b7f-3293d28bc5a7", "value": "CDMX_null.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca54e39c-8503-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700196182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196182, "uuid": "2b02b96d-b35c-46a7-980d-6eca9ee6104f", "comment": "Malware payload", "value": "eb7eab428ab22055610be95829cb3457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196182, "uuid": "09edaa5f-7f65-4538-930f-d9f5772aa001", "comment": "Malware payload", "value": "d11cb28aa2618e76429ee7ebefb5c86c71374d2f8fdd58af946aee926c34615b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196182, "uuid": "bd2826a7-12ef-4323-b660-e720b8716ba8", "comment": "Malware payload", "value": "ed1dc2732a3cf6ff27f19ca09de057cfc948d8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196182, "uuid": "7be54fdb-d893-490b-8381-3d14903953b0", "comment": "Malware payload", "value": "30d4aea32ce8712933a5e1a3154a0eea2ff429152af25963cd6b90eaf84a2483d20cbaf7c15c8a3962f99a12aed2b076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196182, "uuid": "ddbb2a45-464e-484d-907b-fe7469d3bb45", "value": "T1A2249E13A2D1AD61D7178B738E2EC6E4B61EB9D4CF59673E22185A7F0C701B2D2A3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196182, "uuid": "658724d4-166a-4acc-8256-b1faa16595f1", "value": "4b036b1ebc23e5c5c9b73c2e7870fe99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196182, "uuid": "f6b55b06-0c00-41ae-aaf1-8970316bbbda", "value": "3072:FgVdWS2LDDvwSi9m96xVGQjiy4TSG0KROM31G/ziG:OfW/LDD1iH+GiyuSGCM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700196182, "uuid": "8f2f6bdd-342c-477e-84cb-73fa466ec237", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700196182, "uuid": "4258c30b-36bb-4dd8-8e65-9cf34230eccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196182, "uuid": "736db0ac-4dc3-4898-ba9f-9f4513685b6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6beb9548-84e7-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1700183997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183997, "uuid": "50b6c822-c220-4198-9688-10485455d944", "comment": "Malware payload (Adware.Neoreklami)", "value": "e00494ebd0846901cfd96d2186746352", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183997, "uuid": "fb2c83fb-6d38-4717-bc81-5ef6edcb72a5", "comment": "Malware payload (Adware.Neoreklami)", "value": "d15979a1a769e0e1b02a8d6821dc3ffc1923a7c88e178ca690865f73bc3e79fd", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183997, "uuid": "99cf2228-6466-48f2-83d2-ee2a1f239526", "comment": "Malware payload (Adware.Neoreklami)", "value": "70105083b7576a26a79dd1e87ae9821eb6ae4841", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700183997, "uuid": "093af423-12ac-4797-91d6-e8a40c5e3f6e", "comment": "Malware payload (Adware.Neoreklami)", "value": "b13af11cac2ce3924c17c581fc2faa2b549241da52a66bbf0b74116c2a7807bb3a2ad7e1381b89abaa73cc917766a909", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183997, "uuid": "7f4d6cf3-d72a-4336-b9b6-a51962793713", "value": "T1BB763335BAE3CDF2D7832F71CF682799A8FDE292263084676B952D7D0F201D58121396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183997, "uuid": "fadafad2-4eab-42df-927b-39a40a91ce93", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183997, "uuid": "66ce0c0b-bb02-492c-84c7-1c3bfb7ec74b", "value": "196608:91Oh5fyzlp8XAWgXx4rAFABtahYPA+Xf3xwhn9Dx:3O/yzlhWmxqAEtad+fxwh9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700183997, "uuid": "80e0b07d-9038-4313-97bb-fea9c62fb6df", "value": 7532940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700183997, "uuid": "a1e8d5f3-4ca9-4428-8d28-76a0224e0196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700183997, "uuid": "bd176782-fd00-45b0-a65a-36e84e13c4e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8246a5a9-853b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700220113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220113, "uuid": "4f36d8a5-93db-42b2-b28c-a70b6d72fbfc", "comment": "Malware payload", "value": "b585844cf2d43ece044bcb1ff3e6e8af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GBR", "colour": "#48DA2C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220113, "uuid": "d51ad999-fdb4-4582-aa48-834d718b5697", "comment": "Malware payload", "value": "d18c4cde9bc83592187f8a90e3f138c871a35cda49d4a0078ca9eac04cfc961e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GBR", "colour": "#48DA2C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220113, "uuid": "6f579fcf-edcc-4079-bd2f-eb5fc181488b", "comment": "Malware payload", "value": "666f1414f288407e70a7602f34d781a1967c0d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GBR", "colour": "#48DA2C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700220113, "uuid": "32c3f4e3-4348-44cb-ab11-bb56365cd82e", "comment": "Malware payload", "value": "6ba5a8fefea96bf5de447b69ff9c8a8ef140de5bcdf42db737ec58917c2d66baf17cd529f40b8095845937ea33d86802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GBR", "colour": "#48DA2C", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220113, "uuid": "e3698105-e2b8-41dc-bcc9-6291615ad40b", "value": "T1A294FD3C1EFB773BC2B9C7708AD0441BF41885AE7542D96982DA97B58B817E234C227D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220113, "uuid": "2e4f2e41-f777-4425-945b-2201b6cac6b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220113, "uuid": "511405f8-aa44-4128-ba30-c1aed057002b", "value": "3072:ukQKxK5lHpZTm9KvdDIHF/IP7tBdKPYGDwssmKyzyFKQypCzd51s/nUOIFZivG8n:dxeDTQCCefdKPYGDwsfLAXXAUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700220113, "uuid": "49ddfd87-2267-4d18-9b97-f705a37aa6bc", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700220113, "uuid": "8f06ea70-ce4e-4b80-b1f9-9ce227a75ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700220113, "uuid": "59e77546-c98e-4965-96ad-ccf9b0bd8735", "value": "WindowsApp27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21875e42-855d-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1700234553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234553, "uuid": "d4d62cc9-2605-4cb5-93a2-c4c662856acd", "comment": "Malware payload (RaccoonStealer)", "value": "3544e842d2073736ef9db7ae3cf85737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234553, "uuid": "cec80aa8-718f-4b32-a7d6-e9a2595cb501", "comment": "Malware payload (RaccoonStealer)", "value": "d2d518b616cb3376e8f6edba6ceaccb82ba5a198865a7c6b3def592b7a39cc79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234553, "uuid": "bd91d323-6cbb-4ef8-8ec9-4373a88c2d50", "comment": "Malware payload (RaccoonStealer)", "value": "d181da38bffb6d97e38b786d26fb3a504bb52d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234553, "uuid": "8cc56fe6-1e79-40d6-a2dd-c73b7994293d", "comment": "Malware payload (RaccoonStealer)", "value": "a858cbde1e99f31649c8cc8f0f420fcd9d669deeae37f5c48fa2330b314c09f58a7fb5ffe541bdbf6938be14996e008f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234553, "uuid": "b97d96e0-083a-4d41-b0a4-8f8758291052", "value": "T11466236753560185D0EAC83E4B33BEF471F603778B85A839B9AF9EC52591DE1E203983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234553, "uuid": "9926e885-a0ea-416e-a78e-a16208b6d350", "value": "372c5d18d541bfb9581c443bc011eecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234553, "uuid": "ac7dbd08-1dea-4cee-908b-91bbeb381d4f", "value": "196608:aMOmiYQUewscI311gWOWUJ4MNjQKlQqj:V7211NOWUtZdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700234553, "uuid": "77b04f3d-44ae-4092-aa54-1f8f1d32079d", "value": 6745088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700234553, "uuid": "d6b2395b-6eeb-4ca0-ad5c-b932006062b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234553, "uuid": "2b021e30-ef94-4d98-bfed-5306f0ee0f69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759955e2-8541-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700222668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700222668, "uuid": "9a5c631a-77ac-4fc8-84a0-ff8299d51286", "comment": "Malware payload", "value": "642b57b84e44b48223b80fdd2aa982ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700222668, "uuid": "399a70ef-58c7-42bf-bf46-f95bacc60d48", "comment": "Malware payload", "value": "d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700222668, "uuid": "ef572560-070e-4c62-ab86-6aa4216b5c55", "comment": "Malware payload", "value": "0d5dc3fbcb2c65e82db8e75182b8f9f96ed4e412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700222668, "uuid": "d4172c94-6e41-4c6a-8102-d194d96ee6bb", "comment": "Malware payload", "value": "dd48d725ec928079d6248449f0acdfd2701135b217ce69535a42539e7e3f74448558db3310182b7e6e0e7458f0c792c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700222668, "uuid": "9d2647ff-8f7d-4f5e-81a1-ad6618ca3ece", "value": "T17BF5D51166F90749F5F31EBA26BAB6114C7ABC29AB11C3CF155057CE0B26AD0A870F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700222668, "uuid": "cce4a8bc-ad8c-4044-a840-edf685f2f277", "value": "4e4a6bcb0a4d906241efada3b9ef82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700222668, "uuid": "0ab88aab-2d21-4ed9-9a65-d9e42cab79bd", "value": "49152:IM7wMc13tn/rx+h6a3vHaMl1nD36dczWC/7di1:rux+o7o1GdcKi7d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700222668, "uuid": "8ef0a145-88cb-4c4c-98de-22f29627295f", "value": 3394104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700222668, "uuid": "58a67cd5-4250-4e89-8c5e-00f870e0bff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700222668, "uuid": "06995e5b-9151-4275-ba4e-076e5a4cad1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd707958-8570-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700243002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243002, "uuid": "d685976f-cdde-4afa-b941-c0bb90b6ec8e", "comment": "Malware payload", "value": "1bc7db476c65862a7e0a82d9ab87a57c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243002, "uuid": "157773e6-5e74-4024-b90b-e3a88a2636d4", "comment": "Malware payload", "value": "d5b19bf933cb33f3d753f488fedac6d272ef1b15e6ffd1431cc8430c571dacb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243002, "uuid": "5d015ec5-7bdc-45fa-a9dc-cbeda1ebec8b", "comment": "Malware payload", "value": "979e6ee92578971d4d9f2452e6fc99807cc2ea89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700243002, "uuid": "b7c26876-0dba-41a7-bf1f-51a837417db0", "comment": "Malware payload", "value": "94032cd31291e0c84c9cc15a5e130bb7848ffd25dfba672849de93afaf8f406837fbfd1792980902353ecc2e6258136c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243002, "uuid": "2b45d85c-03a3-4af7-9739-41fa97f4bb98", "value": "T1D5145F117AFF540C72B36EA15FE9B6B94E9FF7B26575A09D1004020B4B63E40CEA2B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243002, "uuid": "e08855c1-6938-4b6e-af30-34febd82ee5f", "value": "3072:0YSYNYSY5YFYpYSYujYFYFYSYVYSYvYSYhYSYTYSYnYSYhYSYVYSYKYSYXzYKgYH:BHmHieSHneeHuHgHKHUHYHKHuH/HkG+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700243002, "uuid": "03a7ccbf-d46e-4a3a-ae34-9e3a2f6cf03c", "value": 191002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700243002, "uuid": "04a451b5-7959-4694-87f5-b682d6d08b13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700243002, "uuid": "59c3acfd-e2e5-4259-93e7-2129af720c2e", "value": "4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736dac4b-8574-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700244569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244569, "uuid": "e2891c9f-84ff-4f29-8d48-a73ae07aea92", "comment": "Malware payload", "value": "ca3021b254bae1e5ffd4030ca33da05c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244569, "uuid": "d02e0726-25cc-4671-b5a1-7345ce7ea811", "comment": "Malware payload", "value": "d632e2d866bfa1006d0051c0b1c19849de6e3cacddf7b627a2f41bc28abdcdf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244569, "uuid": "6378fc09-dfc2-48f5-8b0c-0926600de317", "comment": "Malware payload", "value": "dddcd7076a04f8a7712c70ad7572521ddda24f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700244569, "uuid": "432df93e-50a5-4f3e-9889-46603fc6249c", "comment": "Malware payload", "value": "e8a5b40e7ea98a71e7090f273b32667348cff40088a4e10803612bed5a241d10f92b41cf578b1979785f95a9ab4d89cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244569, "uuid": "ab3644d6-fc05-4266-9e49-32b42b51f553", "value": "T1F676233323963084FBF98475CA27FE6572F203F987829C7D76A66AC039518F5E602953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244569, "uuid": "3854027d-d6d0-4c43-92b0-3565c3a1c204", "value": "372c5d18d541bfb9581c443bc011eecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244569, "uuid": "53b9d70f-b9ee-4d92-87f0-71b7842dd128", "value": "98304:990toI05QFp8mmpBjBXT8/osjXGcwpQeRj39Rrbc+p/ljBySQB6EDBPDbqAwcMg4:0gkElIe73Rrw+tbDQhP1z79Yg64bWOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700244569, "uuid": "0fb12e54-bd59-491f-bb6f-93a261287922", "value": 7278904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700244569, "uuid": "ee1a529b-0625-46ac-8adc-abfce13bd06b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700244569, "uuid": "b5d7a6fa-817f-4c24-b9bb-d0e6d9c97c29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85549e1e-854a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700226560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226560, "uuid": "3ade6030-de5e-412a-b19a-dfb7c892bbe2", "comment": "Malware payload", "value": "c9d54906e576c720fda1e23871435615", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226560, "uuid": "fc2007c7-5256-410f-9379-c98d1036593a", "comment": "Malware payload", "value": "d6a0ec474c1a9be4762a34e045e12327301b0b1c70b25a0475572b138dfbee2e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226560, "uuid": "91d4ce74-76ad-447e-bb51-ddc8b26dac49", "comment": "Malware payload", "value": "b5ecb6f22678599320b29c67e3517981ee991634", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226560, "uuid": "ec821e98-a31d-4039-ac45-e8de5e7b58bb", "comment": "Malware payload", "value": "1239135de26d3be6bbbe8c8ec59a49582feabb60d23362a50d30d8176243bc8d776112ae19151399d53f2a19129ae1a4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226560, "uuid": "32acc5b7-3f49-423f-87d3-0690cbe3813e", "value": "T145648D0173C82275D58703762B5FE393E67AECA8961281169245790DBCF2698F7B33F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226560, "uuid": "27bd090e-802c-4632-b2d7-dbfe7bd3049d", "value": "3072:1kxU0X04E6DG963DjY5AFwgz88ereWn/7w05g0ZCHbfIdn7k9uGkEp29wybtE7r2:1AIK3DjY5AQ8er1nzTubfIoZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700226560, "uuid": "de79cabd-ae1d-4a98-b61c-49e502a73510", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700226560, "uuid": "c73229e1-af8b-48be-bba3-e3d240cba990", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226560, "uuid": "5763b574-0ec9-402a-b361-dc0406d547a4", "value": "bm.ADVERTENCIA.xW.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fabecd-84ed-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700186405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700186405, "uuid": "2b7007ea-5cfa-42eb-ac3f-baaf2691505c", "comment": "Malware payload (LummaStealer)", "value": "73715793312ef5eee530c5461900833d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700186405, "uuid": "e5a6a450-2fc1-4ea1-864b-33a0cde135df", "comment": "Malware payload (LummaStealer)", "value": "d714f4e239526bf43ea4122e515899a1bc017474fbc5becf14b4f8f3cd6fa75e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700186405, "uuid": "1c8dba6f-ab20-475d-b136-847ef6498ab5", "comment": "Malware payload (LummaStealer)", "value": "4a1a0901a5747f1feb34b30920e936f0ff3c520a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700186405, "uuid": "9164dc87-5faf-4b32-af64-3ffe0f6f19ae", "comment": "Malware payload (LummaStealer)", "value": "7d38b1c66dd975077b346f2494ce059531f53b351bbb58f5f016c82385497fb97d135a52430643153fc9fbe5b6419174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700186405, "uuid": "887cd298-2064-4ca6-b88d-d2309e0e418e", "value": "T102652356B7CC9123C8F527B094E216971F357C91EEF897BB2B42B1941C31A91B26233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700186405, "uuid": "4e813c0f-0c61-43c4-b9a9-012359614fd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700186405, "uuid": "df884692-cc40-48c3-8f4a-9a3242c1e874", "value": "24576:aydSUh7zFytlcyKhA3J//dvU/hpCvsAormYFh4tksmICguYfRPUpt/sPVy90SOA:hdSUh7ozcyKhgnOY2ItxjCguYfRUJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700186405, "uuid": "9bf3423d-3bb4-4cf6-95d5-a318f588d59c", "value": 1492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700186405, "uuid": "4add3f3d-8448-44d8-8b25-9ce3e5e9d368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700186405, "uuid": "a109e8f5-65eb-4481-97bf-b31a334fbbb0", "value": "73715793312ef5eee530c5461900833d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb24c74d-8596-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700259319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259319, "uuid": "8f92eccc-1156-4481-8c10-df368fb69641", "comment": "Malware payload", "value": "0569253c2d7bbd34d6576729c420930f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259319, "uuid": "120ebd59-e590-4d21-a9ef-cec01a9e771f", "comment": "Malware payload", "value": "d7383edcabb71dfe9407751f24c450aaa0f958b495d08dc1a47d63ee74215b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259319, "uuid": "4db8dda4-8db5-4291-9937-a28da0730eb2", "comment": "Malware payload", "value": "2fbc89f2984a2060d816144b4fb5cb8f2cb955c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700259319, "uuid": "b1f66048-9bf6-4461-a114-665d14176d19", "comment": "Malware payload", "value": "32011c3334389e5e1b3278ba7f7bc46cc0fe7473b9e46b61aac0be95a0d6783f2148c2580f6d5d251c163973a59eec14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259319, "uuid": "6a6b41d4-a472-4c4c-95b1-1a8def56a5ab", "value": "T1BD559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259319, "uuid": "de3bb726-8c92-4450-ad55-e181805dc919", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259319, "uuid": "42ec2789-864f-41c0-acb4-c8401ea01f2c", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700259319, "uuid": "81399171-c152-4085-bd56-4076ae9ee968", "value": 1321984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700259319, "uuid": "c1925b9d-ddfa-42da-8a17-33e44c16a575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700259319, "uuid": "7d1a729a-48dc-4015-86d6-7e1e93947cbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed03b084-858d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700255510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255510, "uuid": "7631cd6d-76f4-46df-9c51-dc4939c96d5a", "comment": "Malware payload", "value": "f7eedb6e90e886084fc33752b65408be", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255510, "uuid": "03a34296-143a-45dc-bac1-6ddfe89ffba8", "comment": "Malware payload", "value": "db10fe5f536d7b8ed82a72fe7706dff829584c395f5eade2fc41a76019d31adb", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255510, "uuid": "74e1aa93-69f4-40b6-b1a7-6b3016ce4f90", "comment": "Malware payload", "value": "dad124d9700e973dd9a7f654fe03783b43264cd8", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700255510, "uuid": "66afb55b-bfa1-45f3-a103-3f4e7477f80b", "comment": "Malware payload", "value": "283f8709c0e4830a8cefb42ea747b1855a3f0d849c071b3f1124c4fc9588e73b87a0adb0870a9f1890044a038bd3d9a0", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700255510, "uuid": "ea3af2a6-670a-4017-893f-168c4fc2d91d", "value": "T1EEF43309E816BCC3F0FD277D5E0C1785D9DAB3E89AB96428E06D1A31B7224329F4656C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700255510, "uuid": "fb855413-7157-48ca-a5d4-c7d279bf8d2b", "value": "12288:x8D7cZg2r13BU23LkO7CevVPcP24PqfgrypfSjZXXTpgwD:mD7Kg613BU2oCFZFgeadzp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700255510, "uuid": "0e3c752d-73d1-4f4d-a3e4-efa7eadb8a74", "value": 758817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700255510, "uuid": "8a6d2e7a-3827-4957-a03e-cea37247b776", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700255510, "uuid": "a7c81661-7e43-4153-88ac-52cc95e4f295", "value": "SHIPPING DOCUMENT_9871610T00077003_pdf_1.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8aa3875-8530-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700215506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215506, "uuid": "7423ec0a-6567-4d83-a5bd-031048946421", "comment": "Malware payload (RiseProStealer)", "value": "c8cb23e1282a5fb757878c09b0dd328f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215506, "uuid": "d5f98a2c-e867-4e19-b8a6-9e6feeedad44", "comment": "Malware payload (RiseProStealer)", "value": "dc500e216de3a1e373a7970a65c10a3195e0fcb10be52aff9bbac5858da2f4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215506, "uuid": "81afbb84-6a0a-4744-a6ce-8284c6398032", "comment": "Malware payload (RiseProStealer)", "value": "392583c79a96acf36008a38853b74a38aee62346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215506, "uuid": "d62d7c5e-0d13-468e-a448-91456a725cff", "comment": "Malware payload (RiseProStealer)", "value": "1652e5d81d989ad3135679790a87dfb49723f012a2fc661e0e8b7edd066973f1b1377dab026faeee23ccb1d95cadb294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215506, "uuid": "96a8d5fc-0146-42b3-be27-c68c6d75a905", "value": "T1D635236162D0D132D8B167B034B712930B387C6A5EFD572BABD158AE09B35E0E931377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215506, "uuid": "36ac302d-9179-4a92-b6b1-691499482e8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215506, "uuid": "56a678cb-4ca9-4b61-b0ab-c66f554f1308", "value": "24576:ZyDKdrCfoIizvo8mSc8UaRXfqiGyyGoEV:M9uo8mSvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700215506, "uuid": "77705b7c-b638-40b0-8c94-3f5204ac8123", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700215506, "uuid": "6a6e2191-7805-46aa-a9d7-3d52ab35b615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215506, "uuid": "ef7b566c-e15c-40ce-a034-55d3df5eaaf7", "value": "c8cb23e1282a5fb757878c09b0dd328f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d174b60e-8560-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700236137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236137, "uuid": "a513edf6-5da0-4996-a6b6-7acfc10f11ee", "comment": "Malware payload", "value": "76c98648f11970e09c160ae0224cb9f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236137, "uuid": "35809474-372d-4063-8360-f6c36880a2d0", "comment": "Malware payload", "value": "de3cdc934393a5e4065690686ff7042e51f89efbcd15ca4df1f08dfcca8622f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236137, "uuid": "16925394-a87a-4904-a47d-e232640a8c41", "comment": "Malware payload", "value": "a1c7aa09a9ea241d69b8d378b98b64a7132b8929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700236137, "uuid": "ce93d05c-8ac5-41a6-844a-2d8d3778e980", "comment": "Malware payload", "value": "bb9a429747431d19756fbef59bbe9eacc152ae82e0ed4c55f4dca2887cc0f6e2e39d7cac991ee451c93e3585952a1d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236137, "uuid": "11e8bfde-b4b7-4357-8f73-62a21ec74d56", "value": "T121544B1352E13C55EA264B729F2FE6EC771EF2508F4977A926189E1F14B03B2C263B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236137, "uuid": "5b4221fb-ca49-4815-b91a-6c91ae3e6b62", "value": "5148e92f1190607a3db8b96a305e7ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236137, "uuid": "df5542e7-47f4-4468-985c-79fa72da2c1b", "value": "3072:yks08uYWLa6HVkluiY+BGzF88GK5ydpRsIgtCT6RsVip39iVR:DvTYivSxYTWXKypVipM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700236137, "uuid": "1fbd5b80-a240-41db-bbd7-d25c40add124", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700236137, "uuid": "5904e179-9a4d-4c9d-a95d-e114c713f76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700236137, "uuid": "0575f865-b18c-48ce-b66b-d3112f2ff981", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad86b90-854a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700226596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226596, "uuid": "82ae633b-4847-4d68-a96a-3e303b6b319c", "comment": "Malware payload (AgentTesla)", "value": "5e6e36d17280b824c8bdcb2062125075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226596, "uuid": "ab8a4054-2607-4750-8dfc-ee37ef05660f", "comment": "Malware payload (AgentTesla)", "value": "e1b656a90b8082a6e386be4df78d0571c1c738704ee3393f8f3908fad7968bd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226596, "uuid": "c6c34158-125d-41c0-a01e-33e4598a806b", "comment": "Malware payload (AgentTesla)", "value": "d39db53058befdf591d64639dc015fee332babfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700226596, "uuid": "5f538768-10ec-4bd1-b419-a98471b899ff", "comment": "Malware payload (AgentTesla)", "value": "9001ce27f71dc051868ff5ec91f18d4048534fa3a18ef5648a76a4329e31352eaf782e8e57ed0d6d427c1cc17653c322", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226596, "uuid": "6984d7b1-f9e9-4bc5-9301-be10ceb6789c", "value": "T1D1F4F53D1B9E0667FCB9D6A7EFD0812BF461AAE3F2099D24D4D703569302A4270D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226596, "uuid": "0200b115-e469-481d-96df-d26256dfb0de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226596, "uuid": "9f99a408-0d52-473c-a428-239f863af703", "value": "12288:ZABa/mFiTEJ0+0OR8FCkoa6k4opDWAq/iNobieLuNSvCCweh6M6TEZFSFW8+Sx:j6+VWb/i8nLuNSfwOwWEW8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700226596, "uuid": "a529184f-6742-4a37-88ff-7f277943c649", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700226596, "uuid": "1ead7b4d-42c0-4dcc-a758-5799fd36922b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700226596, "uuid": "2b9e5517-0315-4394-9a2b-837111ae78ad", "value": "FRA_20235108_DB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010b8432-857a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700246954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246954, "uuid": "40a1b642-610c-4313-9e86-8787162c7f72", "comment": "Malware payload", "value": "2f82c537932c5033bbadeb0645889a00", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246954, "uuid": "d50f56d5-b419-408d-b865-423cd01182a8", "comment": "Malware payload", "value": "e335d891303b61d78a65a5758c2007b2aaf7bc829a9f5f436ad8d4d4d3262d5b", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246954, "uuid": "9f638b94-c8c4-45fa-a394-8771ad8aed47", "comment": "Malware payload", "value": "b6c81b488e634df58a6b7823d010a3388126c64c", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700246954, "uuid": "0aca5243-da5d-4ce7-906e-5f27941cd7e9", "comment": "Malware payload", "value": "56ad9f1cc7430db21a84652c22b573aff1cdc3d53ed2a520f5bd6b27550ebf202df52961c3f10629a631de973e7753d4", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700246954, "uuid": "e620387f-de3f-41da-89f5-5f4c2fd7ce97", "value": "T1A2D5BE2A35DAC537EB7E82306669D77A65BE7EE00BB100DB63D42A1E1E305C14276F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700246954, "uuid": "3f6f0e42-f941-4b52-adb4-46396f57dd79", "value": "49152:ilDUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZ4bv:R30ZnqKzFnWntuxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700246954, "uuid": "15823e56-f008-4287-b3eb-d9e18d64c0ef", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700246954, "uuid": "178c603e-f357-4b73-9ca2-9663a8996909", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700246954, "uuid": "f24c73bd-4f26-40b9-b526-649a5effc39f", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98f5d3c-84f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700188530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700188530, "uuid": "e37c40c6-5005-494e-8fb7-e88254d4367e", "comment": "Malware payload", "value": "6a1aa07c49cac48acd4a59cffd008d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700188530, "uuid": "b04acf12-ab71-46c0-8ce4-f33c63ffb6c2", "comment": "Malware payload", "value": "e52e7b7b19091fbed821e1cfea10d78f6b20cda9e6119da26be4e77798b14907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700188530, "uuid": "eb00281f-44e8-4379-a5ef-46fbe4ae37e0", "comment": "Malware payload", "value": "f53327385a661e01ba374fc6b64b052b7b4b99fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700188530, "uuid": "155457aa-680d-4ffe-97af-9965a13c9046", "comment": "Malware payload", "value": "95f3701366346d2ab6cf4e0498b548c6f0edf8adf0ae00f2f1ad0219ba1c8ed2e8c0e1a8ca4cb3337e3f69d923e2c4ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700188530, "uuid": "00923a7e-9d9f-4c9e-b313-ed4afdc0d9fd", "value": "T199344A0392E17D42EA268B739E2FC6E8761EF650CF89776D12189A7F04F01B2D263751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700188530, "uuid": "cd67dc01-ec59-4db0-b50c-b73872339c6b", "value": "4b036b1ebc23e5c5c9b73c2e7870fe99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700188530, "uuid": "06832f9a-b474-4e8a-883d-3a0e5d479f58", "value": "3072:b+rk/L88H6Zv0JGoaWcrkkMGuQPFRd+KROKreJN1u/z4j:vL85x08Wc/PndEKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700188530, "uuid": "1a7c0261-2b8c-493e-822c-5193e44b4dc6", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700188530, "uuid": "8384f821-ad29-4984-82af-8b9b6a206c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700188530, "uuid": "3d417ec9-342d-4d92-8659-ffe8b7381c6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f9c9a7-8556-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700231653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231653, "uuid": "9166536d-bb68-48ec-8d97-89a1cc961b74", "comment": "Malware payload", "value": "e7c802a697bc9c56abcdf3d5f8dd53a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231653, "uuid": "4d07e080-18a7-49d0-8b0c-59c5c95ed266", "comment": "Malware payload", "value": "e6edd6550600dafb8bfa1349b21026bbcfb9811888c105dc9672d6d197ae8b19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231653, "uuid": "723281f9-558c-4bde-ab7e-7108154e3cf6", "comment": "Malware payload", "value": "8fe01876a890ad448b52907d11bdd3e9c2822aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700231653, "uuid": "27b365b2-ac72-4100-909e-3f3f2e293afd", "comment": "Malware payload", "value": "241006514dbb27b9e57186a2625f2676816fdde25cf5d094b96519e57a6d0964ae85adee4c3b99207b1ecf64399c1225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231653, "uuid": "06335414-eb06-4870-bf39-25733f836a6f", "value": "T1F76533A735BBE246DDD0697E0808DDF4D26B5AEA553B60EEDD2C431224C2AC83570C6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231653, "uuid": "6c1e4420-dd8d-4685-9351-8961fa96cd44", "value": "24576:E4aNweg+U8fIa4OIwP1pmlXmiDozMAdXI5dtzm1fD8bhddZK21stOD:E4aNRU8fIa1pml2ikzMAcK1ah3nKt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700231653, "uuid": "41b660db-e9c4-4980-9faf-4b8fa215d468", "value": 1425088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700231653, "uuid": "a9fbeec4-7b08-46c1-8c7d-ff900c8f4cb0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700231653, "uuid": "3b61bf6a-f384-4764-b57f-73bffb4a10f7", "value": "SecuriteInfo.com.Linux.Siggen.5987.16737.21050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09d9cee-8503-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700196165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196165, "uuid": "fe91f84b-b5df-4c0c-840c-ab950f6e5df3", "comment": "Malware payload", "value": "8a5311cd91c99c7c9e3c4074bad2ce24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196165, "uuid": "64bfd1d3-c947-4312-aeb7-7320c2677d58", "comment": "Malware payload", "value": "e9e2ed140683ba8f499d3c79cc0737f6ef8533867749c0bd6a78fd61c2d4d7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196165, "uuid": "a10bf0a1-695a-43c5-9fec-3b9985edae58", "comment": "Malware payload", "value": "bcd16d0fa152ba6c949d71c449fb7f04499ed974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196165, "uuid": "7f288813-cc2c-4bb7-a374-aacd711b8c6e", "comment": "Malware payload", "value": "acf7089115c6ef8ab50d68e7662ee3b9b094e9d08758a67fce47f12e037a451df55f675178fcb90cdf8ff957a1e107f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196165, "uuid": "e20b6448-2af9-421b-8daa-5b71d91fac8e", "value": "T18F2512829EFADDB1DF34607F82C477661F3E1FA140A17ADC341CB8652EB8D009A915E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196165, "uuid": "483b77a1-0ec6-4d19-be6c-e63abad8a3f4", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196165, "uuid": "d6d5ac6c-24b7-4ce9-a8d4-fb0a90effc7f", "value": "12288:nXe9PPlowWX0t6mOQwg1Qd15CcYk0We1RS+S1M9UYOIRIpk+TrJX8lSHxxssefa:OhloDX0XOf47W1o6RR6Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700196165, "uuid": "c640d3ff-d572-4a58-bf66-39e4b2b54d8d", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700196165, "uuid": "998518f0-51dc-4c89-8dcc-d5c886cf561f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196165, "uuid": "67c95841-4759-4a46-b6b3-df74a7859c86", "value": "gry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7093174-8504-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700196606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196606, "uuid": "6c9871f7-9200-434d-b8f8-540df079234d", "comment": "Malware payload (LummaStealer)", "value": "743c26095f04ea6aa1771ae5895f0ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196606, "uuid": "67fd2ac2-d1e9-4b62-a78d-1cb4ac89bf70", "comment": "Malware payload (LummaStealer)", "value": "e9fea957a7956953411fbbfe6cbdfb405dfa2fc2e1e65caba9e9a4fdcbd07c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196606, "uuid": "9644e241-e7ea-431a-b5d0-ba0dce85fcc9", "comment": "Malware payload (LummaStealer)", "value": "488b71d3ccd6fd3f08f6099b3d8e391ffe11eb76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700196606, "uuid": "8537c3df-7774-4c9b-b135-5b6235bd3265", "comment": "Malware payload (LummaStealer)", "value": "30646e0dd4fccfb6b9af942eb3e37ae90fd89c45e24cc36871c2f46190a77e9e15044fe9721838fe74f9181660243386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196606, "uuid": "added553-da71-44de-838d-7f31acd92ab6", "value": "T190B4BF43D2A1BC50EA118A3A9E2FC6F8761EF9908E5D7F263219BF5F04B1172D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196606, "uuid": "ed9cf59a-797c-41d5-a7b2-7572cadea0fc", "value": "3c071df9f91908eb18d041533a3c969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196606, "uuid": "5fcae7f4-4b69-4b12-bb66-1ea745b13b4d", "value": "12288:NfdgtQ18R4S1uj1OkRnwYvnZ5T0fhHBP9:/1JguBOkRwYx5T0fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700196606, "uuid": "038b0f2c-810e-4362-8245-c70877d26cd0", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700196606, "uuid": "2b10c273-082e-45be-a0ec-13a9cb89e78d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700196606, "uuid": "7fc3959e-a953-413e-a972-6de54162e86e", "value": "743c26095f04ea6aa1771ae5895f0ccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ee08d1-854c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700227588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227588, "uuid": "fd92c030-ebf2-4b1f-b5d9-0bc1d26161b7", "comment": "Malware payload", "value": "11d16704ea0c965fdd8f11e80b115196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227588, "uuid": "2d513b8c-cc55-4dbc-a9ae-ed9803ec7a1e", "comment": "Malware payload", "value": "ea9091b9b280a8cfb2f1f49a6b80d8086c67d8681d6db7629dce7106bf1e354e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227588, "uuid": "1159887e-ad46-4e71-8405-d61dd5e98c63", "comment": "Malware payload", "value": "15f54cdb00327213be943148af652356f002ced2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700227588, "uuid": "b6f4dd82-1d3c-4ac4-8950-18ac4de0c181", "comment": "Malware payload", "value": "3c855cac4aeea7a9bb2e779bfc87f6739e5b62ba09124f18340cb0bcb58ac7e8284da522984b39dd0fb7add089d7598e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227588, "uuid": "c6e32a28-c99d-405a-aae6-f9f54ec9de99", "value": "T16FF5E611B2FB5B08F6F31BB99E7E6609447AFC658B00D2DF52525C4E0A60AD0D9B0B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227588, "uuid": "aa09cd5c-4ffe-4430-ac8e-0fc6c600643f", "value": "4e4a6bcb0a4d906241efada3b9ef82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227588, "uuid": "4063bd47-7b3f-4487-917b-07787250441a", "value": "49152:ON5/5aCvnw3DfTVO6a3vnmsLPM4KwsOwWVm1y6RuF:GyTVprZ4KwsOwWVCy1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700227588, "uuid": "6f90b0a2-f5c8-4b2b-bdd9-53b0bd604ba8", "value": 3394104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700227588, "uuid": "2ce351b8-be76-4335-9898-5c5871eebdf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700227588, "uuid": "c161d20b-1555-4c20-93bc-d2f5405b47a2", "value": "11d16704ea0c965fdd8f11e80b115196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10dbd22-853a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700219735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219735, "uuid": "4445b7d2-fa54-4f25-99cd-fbed55467faf", "comment": "Malware payload (AgentTesla)", "value": "cf11d3a64d8ea9fd79db10cc83d71179", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219735, "uuid": "97b951d2-1876-45c0-95e8-bbb347373119", "comment": "Malware payload (AgentTesla)", "value": "f8aa3880202328a119071117878db0c3b5dc03a5cae3cb16e00cd2353598a913", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219735, "uuid": "08a88889-84b4-464f-9eef-18deaf3a8d82", "comment": "Malware payload (AgentTesla)", "value": "6a6935eef567e89aeed45df1c4b353e142d06da0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700219735, "uuid": "8f090770-39d3-44c1-9b09-b8829e5afd24", "comment": "Malware payload (AgentTesla)", "value": "e9e370f946438e47091e95bc383eb99a9f057ee021c6ccbef49bc33e3871583161e05de331168f2aaea49ab3569d61b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219735, "uuid": "cf19f01e-688a-4a7a-a749-bb275d59ec44", "value": "T11D55C5B81BDB3612FC79C2F2FFD4401F6276A5D3A5199E52C482938B0E53A53648C27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219735, "uuid": "1535ad15-fd03-4ccd-abbf-35f4596b9e30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219735, "uuid": "6a286825-e923-483e-bef3-cd501c5cd051", "value": "24576:xKlE6nS1oQRNPjqD+xujqtTOD2+w1O15Yp4v+:wE6nS1oQRNOgujwOD3wQYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700219735, "uuid": "0c6dca32-48ad-4df2-8645-d1b57ab62910", "value": 1290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700219735, "uuid": "83665e93-42ab-4dd0-bead-d99ef809c385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700219735, "uuid": "f9b32792-c207-491e-9295-d56f34db7a21", "value": "PO -173.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9815466-8531-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700215937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215937, "uuid": "33914ab1-4816-4230-b05e-59b07fd976b9", "comment": "Malware payload", "value": "e9e330893cd376ceed642278c054d3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215937, "uuid": "1d3df996-1ff1-4661-ae5c-6e071feec5a3", "comment": "Malware payload", "value": "fa62f4cd6c7d69df0be3c31551088a2fccffb9d8ce6eff387c503dd038664268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215937, "uuid": "e880dc3b-87f8-4060-9068-f1892d6c01d9", "comment": "Malware payload", "value": "dc04bb294eab20fda45740c17e94518fc71b3701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700215937, "uuid": "d0cd451d-8ae9-44fb-a755-2406572001aa", "comment": "Malware payload", "value": "356f21e334e340e184a462a29249594217e99362baa1078177a2dae29851e643c18e0f49858a16b60d793c0d43b344d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215937, "uuid": "07abb149-bb46-4f24-85a1-4dfcedac8f03", "value": "T1DF26023FB268653ED9AE0B3245739320997BBA61B41B8C2E17F4090CCF665701F3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215937, "uuid": "44a42490-d6ba-47b8-a2d1-31a0dd03f704", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215937, "uuid": "928fe3af-3af6-48a4-ad4f-eca2456ddf2e", "value": "98304:FkL4tHhaD9ytBE508lKOECPWOl2aFnkOalfPICM0derh++gs:G4tBg9ad0KDEWk2aFkvfPo0KYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700215937, "uuid": "5ed6f29c-538a-4f99-b240-63b253533351", "value": 4658488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700215937, "uuid": "6c63c471-7079-44a9-af65-2c9d379e2a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700215937, "uuid": "192afcbd-8858-4d24-85dc-2a28583a6157", "value": "Temporal2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513c41a2-8595-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700258685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258685, "uuid": "e837463d-18cc-41ad-8629-c9d8230d0daf", "comment": "Malware payload", "value": "4648f1589e5b0adf3602bc3af6fdbf04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258685, "uuid": "208c7593-c687-4c5b-8686-c19fe0b47e74", "comment": "Malware payload", "value": "fe020db722c03ae5df83ddac43f3f4b40f5c351d59000a9352f9615380567aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258685, "uuid": "1fbbca66-c290-4b93-92b8-ac3ef556a4a5", "comment": "Malware payload", "value": "b8da6b6d23255fd64ad5ccc1ddbb146f17bb838d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700258685, "uuid": "3f5b4dab-1105-42ec-a1d7-79a6a83515aa", "comment": "Malware payload", "value": "c46f1afb08f2a1ba07b8349399e0ab9840ea51da1fe5b00539aebd7e85d7b627b2f12c5be6e246dc82210d2a9f9f86ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258685, "uuid": "bbf16641-3987-4dca-8f3b-d1ef2d168b7d", "value": "T1A5446C1362E07D63E5668B724F3EE9EC375EB1508F5D676EA2184E1F49B02B2E163301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258685, "uuid": "b0c98220-15e3-44ee-b56d-e72c5461a615", "value": "d509ee77cb2ab9362fcadd2933f81590", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258685, "uuid": "72b59ff6-56f4-4f05-a0df-f093f0418cb0", "value": "3072:h4VCOkZvt9OtdlA/dzUvsr23CCQUrCTsyCNIOR8Fv9oh71/p4KCl:SkRVtH1ss+zgCmFv9o/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700258685, "uuid": "baae9216-2083-45ef-b3ad-145ba92b2cea", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700258685, "uuid": "e5d26826-a258-4879-b3c4-cb8a4fcc514c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700258685, "uuid": "0e1cb61f-a5a9-4c38-8855-4981f2b42628", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb7963f-855d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700234867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234867, "uuid": "da561867-b5be-4883-a554-39f6d3071e5f", "comment": "Malware payload", "value": "c8b1ee9fb8c10cc5259a0abc2f0b82f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234867, "uuid": "fba83cfe-a9fb-4818-89d2-3e2a0b2203af", "comment": "Malware payload", "value": "fe737e46b1faff8183e6114d2e48d9e2ef7256a1eecd0ec5e7ea7dadc18b3434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234867, "uuid": "c3466ff0-9dcd-44c0-a535-c1edca51d6ff", "comment": "Malware payload", "value": "24f71741919c7319c8a6c100f2fe8b974891c75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700234867, "uuid": "d3905c56-2999-4d1e-80cc-3f05fb3e8871", "comment": "Malware payload", "value": "98d58eb17d1a80401e87123b43b95b8043eb5e1f432f5a91c91e4949e315fece1fff1c89ce23f6ae7a9757e10e28a345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234867, "uuid": "695da5bb-4a6c-4c9a-9d44-e7dfbcd75219", "value": "T153A55D1136F94B99F9F31EB85ABAA611093AFC698F11C3DF2250648E1D30BD09971B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234867, "uuid": "0f332785-d860-47c1-a598-52a5150aa7cb", "value": "4e4a6bcb0a4d906241efada3b9ef82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234867, "uuid": "8ca4127d-db52-4ffe-9aa8-c04e15c335bf", "value": "24576:25eMU2JApE013tn/g+/+LLnxBF6a9Dhvh1bKoZMkm:25eTE013tn/1+t6a3vHWoZMkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700234867, "uuid": "d0f8c15a-d5ba-4b1c-8e36-b17a51ebb6d0", "value": 2070816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700234867, "uuid": "41beb5df-4f5d-49ba-a1eb-79d7926ff948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700234867, "uuid": "7864dbbf-37e2-4ae9-b2ad-4987d616bccd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }