{ "Event": { "published": true, "date": "2024-04-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-16", "timestamp": 1713312181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "94984bae-4c9c-4cf4-9347-c6d73e73bb84", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52aaf6bb-fbbc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713249675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249675, "uuid": "29be885e-8e2c-464a-bc8e-4979207b0a30", "comment": "Malware payload (AgentTesla)", "value": "b5d07543b88a9e386677f09c94358015", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249675, "uuid": "14bf5dad-a567-4f74-a8a0-d7601b762fcd", "comment": "Malware payload (AgentTesla)", "value": "00b7f87aa55d071201362f905d1eabb2d8c6b02c448e232e3f77b1c006da9950", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249675, "uuid": "50027b64-1c8e-4b22-b9be-2e6d780334f1", "comment": "Malware payload (AgentTesla)", "value": "427be0e9dfa56bdffbc60fcb9ed0cf432e0969ee", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249675, "uuid": "3fcc0981-60e2-46d5-b975-bea312995e82", "comment": "Malware payload (AgentTesla)", "value": "d22d04bae37718fe7a407fbf502a94f27db1abb09fe1435940ee4d9bf7f355a6fdc44692f7eb382931a6dc6c375671b0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249675, "uuid": "95241dd8-2468-4702-bb65-751fd0bf599c", "value": "T10CE2E1380EE603363017540E8AA76A65DF5E41C6FD98C49146743F6C0BFBD4A1196AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249675, "uuid": "a5b6cdac-02e2-48f3-a705-7bc46b543783", "value": "768:LW0HZ0DxdcsHCxe6tHJYTedPBUEzfCVwQdvzxkVY:JHODxDCxnzdmEzfeJ6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713249675, "uuid": "e9dc0226-cfc9-40e9-86bb-767a51a3290a", "value": 33033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713249675, "uuid": "6af40369-7e1b-4ae7-9fc6-c1f961ed4671", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249675, "uuid": "ed5288dd-f1fa-49d6-a9bd-a915ef34f27b", "value": "DHL Receipt_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b151200-fb8b-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713228617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713228617, "uuid": "4b794a7a-456d-4453-98b4-c0609a0c3b48", "comment": "Malware payload (DCRat)", "value": "15f8f88d44ec2721c7554fc7912816ba", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713228617, "uuid": "7eb5f8e1-3021-47b6-9860-6947a18a7a16", "comment": "Malware payload (DCRat)", "value": "01320d1faef902779c1387841ef15053215ecdae54e3861c0ee3a0743b59e181", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713228617, "uuid": "26d55196-db8d-4f5d-9a49-7d4a1de571fc", "comment": "Malware payload (DCRat)", "value": "cb6145827d64e805b77db11d82b3e0756dc9a9a4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713228617, "uuid": "d7c4029e-aa5d-43d5-942a-a1ea4b14b1e4", "comment": "Malware payload (DCRat)", "value": "b90d569cd4e5642406fd6ba0dfef156f3fc5fc2d254d2622b33fb8c67bf6acf9b7107a68dd9466e04fae2fbe8951756a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713228617, "uuid": "67c072d4-eb62-4e8f-871b-2b8976cad9be", "value": "T1AF0507017E84CE12F0192633C2EF454887B89D516AE6E72B7DBA376E15123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713228617, "uuid": "c6a24c08-91a6-4f65-9e6a-e5a338245f01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713228617, "uuid": "39ab7269-35f4-4ac3-918e-1f069aa77a37", "value": "12288:2pga+E+r8tsOrhscI94n8dcx6fvZ+DJ86u7KI:bE+r9OVscH85XZ+DJ8T7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713228617, "uuid": "5e876a46-a571-44e9-aa70-e46ea03a0d72", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713228617, "uuid": "ec4a74ca-8d79-4cb1-9452-010feb45d775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713228617, "uuid": "97de97fd-e2b1-4e7f-83e3-db6587d350c9", "value": "15f8f88d44ec2721c7554fc7912816ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d99709-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (RevengeRAT)", "timestamp": 1713281627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281627, "uuid": "43e0c4e3-3d84-40f2-a73a-3447e295ce82", "comment": "Malware payload (RevengeRAT)", "value": "7e0c3f4ee3bb201339b0be1e73142374", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281627, "uuid": "ecd4ed9f-f6b1-415e-a18c-075c8773e71f", "comment": "Malware payload (RevengeRAT)", "value": "013fefe1917cdeedc66a5e4bee5417894491591296a91a507224ae5af9618cda", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281627, "uuid": "10c6608c-8250-4280-81e3-6d01067225b4", "comment": "Malware payload (RevengeRAT)", "value": "bb1dbdfd0cbbdb0f33dba0502d896224ba567680", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281627, "uuid": "fee2d3b8-3a51-40c3-a2bd-555d4b17612b", "comment": "Malware payload (RevengeRAT)", "value": "19ececa67820104ac6bc87a66e41767ee4302a668df6cadc2e33819feca6d3286fc28e239bf2bb37ec3b08164b9df16f", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281627, "uuid": "4fd7dd14-107d-415d-a421-714095391c08", "value": "T136D2E13EFA369044E02B7CFC95FDA66A928A05A74FC2C20E3D90C45C0B43C5E66D015E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281627, "uuid": "5ecf8b42-c50f-45b0-b70b-0dc620f25fca", "value": "768:VPKiNgILNl1pb2GdSXlWEsusK+oCx7oho6n7vtxUkO:VC6vgIS4tokyH7lmkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281627, "uuid": "c69d2e8f-8a90-4f1e-a9c7-c8ba647f8603", "value": 29554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281627, "uuid": "4789f94a-6412-4adc-9f02-aba82ce176fb", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281627, "uuid": "31a2deb4-42ad-472b-9cfd-6025632ab3a6", "value": "RES094464-2180.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d885b1-fb96-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233623, "uuid": "193bbe83-0e1c-4ba3-b433-c1a90ba40870", "comment": "Malware payload (Gafgyt)", "value": "c2e71590d1a16c2de5092a392a1a95a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233623, "uuid": "d68ea82d-041d-402b-86da-7bc908bf65a8", "comment": "Malware payload (Gafgyt)", "value": "01c2d7ddea73bff28ee4209525c6d969becb66d17b15ffd0a7ff1a7f555d75d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233623, "uuid": "3291eb51-c010-4a14-b9e4-b7978876550d", "comment": "Malware payload (Gafgyt)", "value": "b78b82ef78207cd13baa3fa308ececdf57b711dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233623, "uuid": "fb75ed76-b766-4733-9d67-7425f5484015", "comment": "Malware payload (Gafgyt)", "value": "6bb016edd078a577c2396f46ae6936246042a938acd647291b222d6fe1fa39dd854a173fea07e7ccc18213356bd11eb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233623, "uuid": "4b81d438-5115-4f31-b3b7-cfe9a80f9760", "value": "T1CFE32A09EA408B57C1E2277AF7CB424933339B64B7DB33095928ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233623, "uuid": "58cad6be-405f-4f5d-99a5-6d54b23bd1bf", "value": "3072:fuNaNpF4uVN++dkhnxbQen2YYV7OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnJQen2YYV7ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233623, "uuid": "0847c010-0cad-41a9-adf0-bbb14474270a", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233623, "uuid": "f6dbb671-7841-4c7d-a436-a119153a6981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233623, "uuid": "8ce8e28d-6149-42ba-8638-9dffeae494b8", "value": "c2e71590d1a16c2de5092a392a1a95a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76c8d43-fc32-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713300551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300551, "uuid": "a207d318-8459-4f96-a66e-286756b1db0e", "comment": "Malware payload (GuLoader)", "value": "e8157a8aa203df743e90d23ee6196051", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300551, "uuid": "81db6680-5676-447e-bff7-b8270368b081", "comment": "Malware payload (GuLoader)", "value": "01ee6cef71cc84b09951e9ccbc18ae96c876a0b4767c80283815e7b4984e1537", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300551, "uuid": "e45ea726-2a0e-44ca-ba15-b001deb9d10c", "comment": "Malware payload (GuLoader)", "value": "8f719226ae3c914a2d667c22b9e8e1181f8fcc4e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300551, "uuid": "b428b104-5c49-4e50-8701-79d8412b7f50", "comment": "Malware payload (GuLoader)", "value": "dc4c0ee70172e7918201370b427dc89c9ccf931090f05e85aa234eb654d242e6ccfced63ac6f892f708eaa89f44e1972", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300551, "uuid": "650880b3-e58f-495c-ade3-8069c41edb66", "value": "T1AED423112A108E3AF6654A3664ACAF579BFF3910A471681373AE7E473F63B42903E340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300551, "uuid": "b816586d-aeb4-43cf-85b0-b163e41ce63b", "value": "12288:D9gnHh6aKgrxlF34fglEKH5D4g1x31UrnA0yESmLjPLoSBH:6nHHxlFIfgltH5D1eA0xSeoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713300551, "uuid": "777bf408-9b48-4af4-95a0-1bb4dcd030dd", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713300551, "uuid": "cc9e5ff5-05ba-4e54-8a0c-0e9cb9ceab30", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300551, "uuid": "3b214a9f-e7bd-4571-8d06-16c935687d3a", "value": "n202416484675.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73a1cd0-fc14-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1713287666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287666, "uuid": "decb2f7f-d26d-49ef-9d77-6f0d1c7b997d", "comment": "Malware payload (NetSupport)", "value": "9d3307dbbd73a6316ef07764e149c070", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287666, "uuid": "9ec51a9d-4f61-48e3-a1ae-dc1fef5fa7a5", "comment": "Malware payload (NetSupport)", "value": "027907076bbc64838f5e29979b6d7f9f8bbe6027c6c4a46c49659cd223ae089e", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287666, "uuid": "ee75d654-093e-4f71-a5f5-d604cb50bafd", "comment": "Malware payload (NetSupport)", "value": "451794a0de5f388d895dbf0463921f2fd4bc2e57", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287666, "uuid": "c9a00f47-ca47-45f6-9eb5-8a975a6d7fd7", "comment": "Malware payload (NetSupport)", "value": "578e05d1026ebf0608ead392811a486899bdf1b4abcfce1d2b32ab2609cae2e4d2e2950d5b8ca8d92b38875e1fc515c6", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287666, "uuid": "bfad5dab-8e55-4f5a-b241-77587580bc9f", "value": "T15E66334A87324371E23194BC91911E2305F07B79A2BFF8495DBE5CDBEC7A061A587BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287666, "uuid": "62cae421-3b08-4fbe-b499-59bd4e926b5c", "value": "196608:Z8oDmWKq7cLCuSll/71V/YxQtw44B2yZIgrv:6nyn2Otw4hyuWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713287666, "uuid": "c2919cd9-6a41-4c9a-976e-deacc16d6ef4", "value": 6969491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713287666, "uuid": "0501c3b3-c986-4c2b-8160-1ceff6beb246", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287666, "uuid": "d2344dc5-bdb4-46b2-830d-09450798bf6f", "value": "BB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382096ee-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713253066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253066, "uuid": "f27ed7e8-25b7-4965-a73d-d235471ff82d", "comment": "Malware payload", "value": "f3528390bd02ea1b50555ec12330f1b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253066, "uuid": "6d5ac64b-6ab8-4236-8e93-5b46b937423c", "comment": "Malware payload", "value": "035cc840c44ae3197c62ce8c4a1ad7186d57d7b2848dd8f87aa6e3fcbcc11466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253066, "uuid": "29ed5ceb-7926-4e30-9fd6-29b4a08122f0", "comment": "Malware payload", "value": "c4b97be568e6371f0da5f45096d145f1f0b7838d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253066, "uuid": "a5ac55a6-27d3-4465-ab49-e01c42919278", "comment": "Malware payload", "value": "b7cf08e34191ac18f84255dad702534c9742e5a5a227fe4c4924dc010f53ad146f5e21e51a5a5946094c2a57943c2a13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253066, "uuid": "842e4bf8-e266-43b4-a055-42af00bc4538", "value": "T1EFE40189397C7E2FCA2D14F04487181583B090256852F3D98ED6B9F72D9EBF05A61B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253066, "uuid": "0018cb6d-47c8-472a-a157-42c9924e9960", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253066, "uuid": "fe283cd9-5ef2-46dc-bdcc-c2104d86e8bf", "value": "12288:hkLHrhVZtuNMHS5vRr2krMWKipAsQQHufmVpl1ldSm3c1Ppvt1sui:A/OMHS5J2OMW10QOfapldSyc1Bku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253066, "uuid": "dbbfe9ca-144a-409d-bf96-3b5c7df562dd", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253066, "uuid": "daa9daeb-891a-4d58-a309-f122eb4eef0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253066, "uuid": "0e4cec2a-046e-4e8c-9661-75204b85e39e", "value": "p silp AI240190.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cab9036-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713281555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281555, "uuid": "b89cca6d-c70e-4738-af26-e1658475e5c9", "comment": "Malware payload (Loki)", "value": "a8bbe905610f17161af68ea8aab57592", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281555, "uuid": "ef5dca00-5165-4d77-8b0a-3e66271e20eb", "comment": "Malware payload (Loki)", "value": "03a24fb6fcf36d76df6ed2eb9fbf249b71c0b33bac9a723aa6337ff19bdcebf9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281555, "uuid": "88e04d4f-1798-49db-af5a-3a230bd879d2", "comment": "Malware payload (Loki)", "value": "6a85ada10ba962b10c07955b2f73700842b4932b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281555, "uuid": "de4276a6-4ccb-4214-83d6-f7a52ae156c6", "comment": "Malware payload (Loki)", "value": "bed71eaefe2a2039a9749af0eaeb2f532c00cba6ec291170a65843d14259de97dd5260d3c04fc0d790b1bb90e51626e5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281555, "uuid": "a90c4742-9e87-47f2-86cd-7579db7ff7ed", "value": "T13D7418E2CAC526298A461AB7ED134B734DB8415D33271F3893BCC65DA143A5C82BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281555, "uuid": "9daee0c5-4d64-4e1b-a016-e362f9b89847", "value": "6144:xnILaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkP4:h5InOiAZvXAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281555, "uuid": "09c8d20c-d5c6-4347-9229-99ac86e9f7dc", "value": 369953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281555, "uuid": "64fc1a88-466a-4541-8bdf-a35dea2e9ae7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281555, "uuid": "501aec0e-afa6-41d1-b3cf-2cbb94f23dba", "value": "RFQ_2414976\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bac3785-fbca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255622, "uuid": "9a99d54b-34b1-45fb-8139-db721d5ba22d", "comment": "Malware payload (AgentTesla)", "value": "237e28ea6ba883e10036e52b11eb6fbc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255622, "uuid": "699af4d1-d467-4c36-8481-1b720f70e9a6", "comment": "Malware payload (AgentTesla)", "value": "045aacfd68737e57578f8e5ab24fc0aa98c6867c32c15ee6dcd0d2c39f709dff", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255622, "uuid": "6e1ea9c5-9d9c-457c-904a-3e1261c0a384", "comment": "Malware payload (AgentTesla)", "value": "175ef1f90be069d31629161ce8e768679a3e2a28", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255622, "uuid": "b41ae399-1ae8-48a1-be9c-0fc4d91f676e", "comment": "Malware payload (AgentTesla)", "value": "980ff03ea649d3bb64cd8a98e6bc3e976845bf2f564c3ce3a57fd4aa66db1def7a24d4b87115f979a1c4d71a99d7dae2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255622, "uuid": "6f2a0005-cd1f-43ea-b9fa-2194b7827979", "value": "T16BD423C30C7594A3CFB1569D48D8C379468D439E6B537B20E3E18EE9A4DA2872F875B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255622, "uuid": "7542c236-f55b-48db-8565-3ba97c444de8", "value": "12288:+VgGtuqWdkq733MBkrw7iAJMXi/Js4htFomzqoRagFJLTy/0/E:Sq33Myw7a4LFlRBF00c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255622, "uuid": "1d869034-7868-4056-8344-1ed5f8702c36", "value": 631967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255622, "uuid": "21cf9ad2-c356-4356-b574-b8cccfb1725f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255622, "uuid": "91dc32a2-d0a9-4c68-98ed-fac6423bdc9e", "value": "swift copy of payment.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ce580f-fc41-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713306714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306714, "uuid": "b7085917-fddf-48db-9a86-9cc5812b59c1", "comment": "Malware payload", "value": "5cd14942d071d4913f27b73dc36c7a11", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306714, "uuid": "89f1d0e5-fcdc-4803-b812-680890b10068", "comment": "Malware payload", "value": "06a9de0b7a1ce8a57375a10ea12f030a618e5f56d695f7e582c6ff79e7554757", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306714, "uuid": "62b72828-d80a-4d12-b217-50770f42535e", "comment": "Malware payload", "value": "4942a26f4ee884b8b1a6468a1632af2bad4bec8e", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306714, "uuid": "7209b370-eca4-4ed1-a832-65515e2e3e6f", "comment": "Malware payload", "value": "bc39e78c4dcb7ced98371e1e0ce94fbded65d4361c6623cd57164d3e73845d8480e12f391d4bd249c239b01626459cba", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306714, "uuid": "4bf91fbd-16db-4eaf-bd8f-29f4ba34308c", "value": "T15CA10D0AEC05BFB36D03ABA88B1B4A119DBDF83F12295045BB4CDD445F32BB061207E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306714, "uuid": "2423d98a-cb5d-4521-8c6e-8fce640aa6f9", "value": "48:4h/lhaRdU4v0rLp9dct0BLptfK00LpNtb0rLpOgJ0JLpqL9AZ/R08LpC9JMHiM3j:AOuNrN/BNj0NNtYrNOnJNqLiZ/u8NC8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713306714, "uuid": "df45a756-3d75-4b19-8f4e-42a19e8ec9b9", "value": 4810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713306714, "uuid": "b49dad6f-3ece-4625-b37b-4ca842deac76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306714, "uuid": "68e73da1-48aa-4db2-b3e0-eee83ef0a7ac", "value": "77system.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914b946c-fbd0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713258370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258370, "uuid": "c5ad173f-f58a-4453-a403-352b27ea3005", "comment": "Malware payload", "value": "7c9de4d2c78e006f11ad8f1c44966fb4", "object_relation": "md5", "Tag": [ { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "Vietnam", "colour": "#5666AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258370, "uuid": "cb4395b0-4996-4fc0-a2f2-6740abef1fe2", "comment": "Malware payload", "value": "081b2455cbf464eee43082d023137137eaf43b7a6e1f475feeb75b7cdaaa4cac", "object_relation": "sha256", "Tag": [ { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "Vietnam", "colour": "#5666AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258370, "uuid": "fa5e4383-2e1c-4836-a8d3-c5899522b0da", "comment": "Malware payload", "value": "93e54785137b1471ed7530ae0e8da5640dd0cdb0", "object_relation": "sha1", "Tag": [ { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "Vietnam", "colour": "#5666AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258370, "uuid": "81f53137-fb8f-402d-ad9d-35f932e8cbd2", "comment": "Malware payload", "value": "f5252ec5773c188f1b0fe6bbc13fb14122fd1ff616989c81881f4313fa54d37be5fd5636e01c27d25349b9ede465ce77", "object_relation": "sha3-384", "Tag": [ { "name": "Facebook", "colour": "#D4BAE0", "exportable": true, "hide_tag": false }, { "name": "Vietnam", "colour": "#5666AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258370, "uuid": "9d485b6f-b8cc-4a1a-a5fc-479850cdf2fa", "value": "T1A857332ED5AD09DED02722173B30AAB0C5BF619E8463635AF82D93897CFF79D4325244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258370, "uuid": "905d44c8-1f0c-493b-b770-b305b0331644", "value": "786432:lBr8b3ZUrQ6cc59A8Y6/EW1H3XDPs1S693nokIuWjw:lqkQ6cGm8Y6nnTs1lnPIuWjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713258370, "uuid": "aef7d6fe-8b17-4ba3-ab7a-a36a6653eb09", "value": 28177989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713258370, "uuid": "3f856cae-a3a0-4ada-bd22-9bae0999ed54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258370, "uuid": "b912cbd2-a695-495e-b08c-e8e4149f4cab", "value": "Sora - OpenAi v1.1.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026f619b-fbf5-11ee-a120-42010a9c002e", "comment": "Malware payload (AZORult)", "timestamp": 1713274022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274022, "uuid": "0b72d45d-8a05-45d0-bd74-ee82e53d9284", "comment": "Malware payload (AZORult)", "value": "69b4504419872fee9bc3bc996b88eb4b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274022, "uuid": "34d05e09-7488-4ddb-9b9f-9d2b8e4835cd", "comment": "Malware payload (AZORult)", "value": "0a06c8a177765ec2e723da7b9d406eb68c43541a6740ffa395a7297ed94e0d73", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274022, "uuid": "3cda1d61-448e-43c3-bde7-c14ef1c7ee92", "comment": "Malware payload (AZORult)", "value": "f87cd6cc91070bb3331fe6c6e25ac84b840f0c50", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274022, "uuid": "f4ba2fb2-567a-4954-9f65-420cd6ad96ca", "comment": "Malware payload (AZORult)", "value": "ef1f03f575b9941c37ceae9b1e80d22b5c5dbaaf5280cb255289d38565d48c2fc04e90577c03dbe232b3a049a168640d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274022, "uuid": "64e52473-3d14-419c-8fe3-25d7816e4f4d", "value": "T1FC047D0030D4D2B3D5722A33169346C5A93DFA719F96CAFB270C795D87B05A29B32DA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274022, "uuid": "1738a859-321f-4e93-acf2-10ce335f44b3", "value": "66deda4204cb009d8c01c3f28c17567f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274022, "uuid": "cffcecce-8ac8-4e5a-857f-6b0233dd1703", "value": "3072:TCmlA+2TGMF85+bkRG32foUP9GmPe97UoiBwASziH8shMpy4a7tzHhL1NZ:WmlV4h8JG3QUzoTnhM84a7trhL1NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713274022, "uuid": "5e673b32-c153-4506-b0cc-b047d9520ee6", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713274022, "uuid": "508e477d-86d2-4d9e-a9af-825934c49018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274022, "uuid": "207fb3e8-e7c3-4cb6-96c0-7632ebd5b3cd", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23930.29642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9565dc7d-fbc9-11ee-a120-42010a9c002e", "comment": "Malware payload (Metasploit)", "timestamp": 1713255370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255370, "uuid": "f21fa4ac-3618-4e8e-8b8f-fa8ae9ab20b3", "comment": "Malware payload (Metasploit)", "value": "12493ae559f1f5ba713762d8f0658969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255370, "uuid": "6618be8d-acd2-432e-b152-ff69f87ca3aa", "comment": "Malware payload (Metasploit)", "value": "0b2d0534e1a0893d7f420a148f307f90a12f177a823c558852df9ede04ae4f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255370, "uuid": "9e4cd2ba-7bcd-4419-9cb6-4d15609abc31", "comment": "Malware payload (Metasploit)", "value": "553bf40a51ecc217c33f679ef1bdeb366d9f48e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255370, "uuid": "ca8906bc-f176-47aa-bb59-7d4de291309d", "comment": "Malware payload (Metasploit)", "value": "701299e7ba53396dfbd1e0bab3215403eb773652c6ba5b6bc277ded69e05b90ca3f50dbb30f2121676a3d95fdcbc0c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255370, "uuid": "62700f27-cfa6-4dad-969b-6c0b3ec75c4b", "value": "T11AD1411336C45DFAC47D4A3942E3A4A3359DDA3C7F2B43F78A84510A3D5A0043DB8E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255370, "uuid": "01bcecaf-02b1-4182-ab80-1b1333dcc293", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255370, "uuid": "5ea22853-4f69-45f5-9d87-6b20264c9df7", "value": "24:eFGStrJ9u0/6vA5nZdihBQAV8aKq9KWZRCIllcpmB:is0FJihBQpE9JZRCW/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255370, "uuid": "823161c9-705e-42fd-a699-fe86d2f1d2cc", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255370, "uuid": "e29be7ed-da83-437b-aef5-af47fa6f572d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255370, "uuid": "dd713d04-1e34-4090-b031-144a9553ef81", "value": "msfcalc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090c995f-fbc0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713251269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251269, "uuid": "72dd8b68-0325-451a-9660-48ba6d2f77db", "comment": "Malware payload (AgentTesla)", "value": "c5dc0ae190a5607e76a735a0537f431e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251269, "uuid": "613e8de8-fbf7-4fab-bd68-1c04a133cfa8", "comment": "Malware payload (AgentTesla)", "value": "0bd27cf3e62297f2eda12a09cb28c272cabf470f791f278e24a77fdd0875d427", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251269, "uuid": "1fc662f0-3600-4652-9cac-644017887601", "comment": "Malware payload (AgentTesla)", "value": "9d0226a1c0b17a28b31255797dfe19d4cfdcf1a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251269, "uuid": "fbdad1a5-df34-44ec-a049-15fc0789dacb", "comment": "Malware payload (AgentTesla)", "value": "c082bce9262400b176369f72c37c4a6b786e7c1ca9c05c5e6c14121121ac2e97ba4e41588e29f1fb68cea29118922235", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251269, "uuid": "67ba6dd8-eec7-4e38-b8ea-9ae0800aa316", "value": "T14DF42370C9864779E84A376CCA8F35319164B3F7A973080E1CD7A7859A9CA03BCD61E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251269, "uuid": "abe9551a-069e-4d4a-a7da-f7946b3e6b61", "value": "12288:dOB94RHHvgvWJY72G4bvukW4x5jZZ4yIPl6F4Or3xn5s0o/lDWcPujRl9wqb:G94dPI7YbvukW4xHZ4Ub5s0GDhPg7/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251269, "uuid": "c42e4348-2b27-4b2c-8ded-d9b6d57aad14", "value": 727886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251269, "uuid": "9b4c4a8d-90d1-41ba-ae72-e05fbc08f058", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251269, "uuid": "d9e7be1b-0830-49c1-b475-1506f71ac40b", "value": "Invoice and receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a87226-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265781, "uuid": "6f06edc9-9128-49f8-8296-cd1be6f0c6b9", "comment": "Malware payload (Mirai)", "value": "6e629d8b2b1a0b9e318f8c8c881ea5ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265781, "uuid": "4eca05a9-ea72-471e-b67c-5fb55f68a1f6", "comment": "Malware payload (Mirai)", "value": "0c240f72a6cf8a5d982b7fd65f9870674ff475b872a6996ebc67cd289fee97b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265781, "uuid": "db880fff-3dd3-4fb8-a45e-681cbc00a789", "comment": "Malware payload (Mirai)", "value": "20d11576a5d95ed56fa0daa7bc43887aeac0c147", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265781, "uuid": "ef86915f-315c-41d7-98dd-9869dbc76c49", "comment": "Malware payload (Mirai)", "value": "478e59f4a672530a7023ff6c10434d8d6e07beaed371550372a771aef9626d69177a39fe3ecedaa158a0ec11ca031a70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265781, "uuid": "1309b673-1065-4df8-9686-a3629124640f", "value": "T132E30A56F8819B12D5C111BAFE1E124E37131B78E2DE7302AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265781, "uuid": "69327e79-e5db-4f40-9578-358dcf1c011f", "value": "3072:ZUIK7upU/0VjLoXUgS3wEa36BajITCW3R5Rpl:ZUrIU2oXVS3la2nP3R5RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265781, "uuid": "9609e26d-be7a-4a29-ab58-f0fce968b37e", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265781, "uuid": "2ce4a84b-69aa-4acc-b26f-55050352f50a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265781, "uuid": "f2eb3aa8-3516-4e6b-8ae7-c1fd0992f657", "value": "6e629d8b2b1a0b9e318f8c8c881ea5ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e939975-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713253211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253211, "uuid": "480176f6-1c54-4fbf-830d-16414398f16a", "comment": "Malware payload (Formbook)", "value": "4c0bd28e83a123669760202d0316455c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253211, "uuid": "c8f23e3b-4724-433e-9dd9-73c1701d4b16", "comment": "Malware payload (Formbook)", "value": "0c3a38ca1a01a40daf13699cae74d8903aeb6362f75611dbd8df3430b850026b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253211, "uuid": "d22c79e9-533f-4f39-8c19-34dcb226ce13", "comment": "Malware payload (Formbook)", "value": "3c5adfc7b212ff17a95841ebc9f91acd6d9e666a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253211, "uuid": "f2ccbc12-f3aa-4e9a-a7ab-014487bee6c7", "comment": "Malware payload (Formbook)", "value": "0895dc74c29d0d7e248bb2145710a991caf376e56344aaf93c81eb0de992079a3c74c55567e54e8b265a0433d952dedf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253211, "uuid": "6ba347f2-4eed-4c56-9479-938b9e9148d0", "value": "T111C423852720C1BFE8EB4B3104EECEFB5FAA95053561BA13235ABC597887F01D43E944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253211, "uuid": "41be7129-988e-4f73-972c-31472cdb2480", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253211, "uuid": "0bbb0fca-fb65-45cf-b24b-e024cfc81178", "value": "12288:g9gnHwjTbE+6Eg6z55aa3J0B3E2h/Ya1g6ESmLjPLoSBH8:dnHuzSa3J0BdZ+JSeoS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253211, "uuid": "89f1255b-9826-4036-857c-b6518842daa5", "value": 577720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253211, "uuid": "c2ab2c03-96ad-47d9-a009-54624760dda6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253211, "uuid": "3067165c-4367-4fc0-a306-e9f8c56f6040", "value": "2024164846750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b5e360-fc10-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713285837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285837, "uuid": "b1acba7b-2292-4060-add6-96d0b453606d", "comment": "Malware payload", "value": "91c1c647dd6fdc166ae27dec9cb859cb", "object_relation": "md5", "Tag": [ { "name": "CVE-2013-2094", "colour": "#FFD45C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285837, "uuid": "7a2be39d-5458-4baf-8257-751c7260d244", "comment": "Malware payload", "value": "0ca7e0eddd11dfaefe0a0721673427dd441e29cf98064dd0f7b295eae416fe1b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2013-2094", "colour": "#FFD45C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285837, "uuid": "29435aed-7a0e-4edf-995b-30c323b662a1", "comment": "Malware payload", "value": "287a02b8b644a757fc8ebf285047b886f7f1f2ab", "object_relation": "sha1", "Tag": [ { "name": "CVE-2013-2094", "colour": "#FFD45C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285837, "uuid": "f71a1e3b-794e-4e88-81d1-ab95cb8fd219", "comment": "Malware payload", "value": "10b789e8a9c935acd37226f33b33847ced1232b99cd376e13d12e6cf57c836b3be07f5647627533e4b88b04b5bcc355b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2013-2094", "colour": "#FFD45C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285837, "uuid": "8af77142-b8e0-4d09-be88-26009f92931e", "value": "T1DC156A57B2F3A4ADC193C135078BDBB2993AF47902126D7B3180DA383962DA05F19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285837, "uuid": "3afe3fc1-5331-49ce-b976-d4489adeea6c", "value": "12288:r0g3rRpyDg+0ZXL8KZzoD6PbtpJ61PsyUjk06/KR/VBqRkbvCY9K:rzRpyR0ZzZzm4btpzi/KnBEYvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285837, "uuid": "ed9c4098-c20f-49ef-ae2a-b04b5841b142", "value": 884159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285837, "uuid": "e2a8ffb6-16df-4564-ac24-3d712b0fa95e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285837, "uuid": "ffe22b5f-2355-40af-8051-184d3c0d0f8d", "value": "SecuriteInfo.com.ELF.CVE-2013-2094-J.1468.25273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d14b9d-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268172, "uuid": "8fb26205-114a-4855-a943-c664e03e5a14", "comment": "Malware payload (Mirai)", "value": "91846762bed6926b8c503f21ad189803", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268172, "uuid": "ab3e341d-b43b-48e4-aac6-0108b89513d8", "comment": "Malware payload (Mirai)", "value": "0ccfbbeb03817807034a2976f9e422e226bbaee21f34f98250549d3304427c56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268172, "uuid": "bd183232-cda1-4461-b920-f6bd0fe31112", "comment": "Malware payload (Mirai)", "value": "9826e2a5b3d6a65eefd8c6c6a1b3f4a18c745155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268172, "uuid": "abfc48b5-8cbd-474f-8e3b-cbc75a323048", "comment": "Malware payload (Mirai)", "value": "f014c3a02cc3e0acb920dedb590babf05a81193f3fcdae2a242141f40659bdbff3117814ab127e59a48c1fb7b408f016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268172, "uuid": "91e70d3a-1835-45a2-8652-651afb985d09", "value": "T11333F174C2435B759F72BE36DD608506A39FAEE45C7C364667178BAC3F8588903B00B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268172, "uuid": "6c49e181-9c33-4e26-ad23-deea84eecc63", "value": "768:YfAK+AkmKNgvJxHKKZuKm5Lhre3DwBHe14mq3UIeCUawMtt34c20IOvGA+FZ:ytkFgvJhDuKm59B+14JeDEf2hOvGAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268172, "uuid": "c8b99b0d-5645-491e-9fff-13d0869edadf", "value": 52848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268172, "uuid": "2fbb559b-61dc-47ec-afa6-267fb21c94d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268172, "uuid": "a93ca1fb-1ee3-4cfd-9374-515d0abda10d", "value": "91846762bed6926b8c503f21ad189803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b763cd-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256933, "uuid": "79ea0d5c-523d-483c-a1d3-a7709a5ba755", "comment": "Malware payload (Gafgyt)", "value": "a9e00b851df991edffb3d2b2006f85ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256933, "uuid": "932c2955-6522-44b2-bcbd-f3ef19e2481a", "comment": "Malware payload (Gafgyt)", "value": "0e46c1068a7292d54c2a6c8a48d9d054accf2efaed0f910115133dcb2f5dad30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256933, "uuid": "0486d702-6d9c-4578-a6c3-831f274f97de", "comment": "Malware payload (Gafgyt)", "value": "1f0e36e1dc88f40388bbaf69454ba6f5bcb7f1ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256933, "uuid": "e8ddddf7-328b-44bf-a58f-1f68a84f4f17", "comment": "Malware payload (Gafgyt)", "value": "0e9079aac494ede53c25b0b970ce6d8060a2324d6219bcb9ce17a3675243a4f522f75e4a6372ae09c1365fdd7fde6f9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256933, "uuid": "46e73dce-d845-464f-889a-a4c88de9545d", "value": "T100244C24E5404B57C2E323F9AA8E428E3B3347E563D773154A389BB03FC2B9A1D75925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256933, "uuid": "d56602cf-8b45-4fae-b6a9-2692d1014564", "value": "6144:FZzyacCwXJ4DbpW0va5hbL6K2axVOcgym0wfB5RyAn:FZzyacCwXJ4gF5hbMylgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256933, "uuid": "b150d56c-c2d5-4dd5-ba49-09e531bdb6cc", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256933, "uuid": "2f123ac4-cfd3-4719-91b3-3f9d72b93c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256933, "uuid": "8483abe7-3c6e-40a2-bff6-3218e0a2870d", "value": "a9e00b851df991edffb3d2b2006f85ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacdfcd4-fbec-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713270492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270492, "uuid": "79c3a8dd-21de-4825-9760-36269a815566", "comment": "Malware payload", "value": "f0619714b6d0f63f1babddfba7e5e911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270492, "uuid": "cd0177b5-7e56-4323-8629-cf2ab3df7193", "comment": "Malware payload", "value": "0f5572daec618481247db7e9c7fdf24454423d8b2f7e65681b418e23a2e4dd89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270492, "uuid": "132c80dd-f878-4810-b939-e69e98038a71", "comment": "Malware payload", "value": "3011572cfb67dd60da13de4e403a5884fc660f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270492, "uuid": "7e31a78c-d251-4c13-9137-9477f4aa09db", "comment": "Malware payload", "value": "965c3425a98ee5c740cad766da54cdbc00e58a76fe4a53b5f709d046eefec34def866f447bc8148474b6c7e8ed924ba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270492, "uuid": "79ee5e09-b87e-4461-a1e3-69492b728ad4", "value": "T1A606C122BEDD406EC46716314F5D7A3CB5AEBDB03E39021B32993F2EB9B06415928573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270492, "uuid": "a26b0d84-3e75-44ae-ae33-5939a76b663a", "value": "2bf45941fb80878d3d34cb8bfef8b49d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270492, "uuid": "6b2d1434-5184-461d-a33c-f602758342ec", "value": "98304:aYGYf3CX3N22bWEvXtsPK3GaQMQT7RpgRHLvCi4OiZrq1DfPHNADtV6v+2gYJbKI:aX3NcoaaOgRHLvCi4O7NADtV6v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713270492, "uuid": "b9873870-0bdf-4f39-bf99-62ab1a6e4bdb", "value": 3755520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713270492, "uuid": "4451fda0-5992-459b-8130-3fb014b17437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270492, "uuid": "12a16c53-c38a-4d47-90c6-42ff11c18527", "value": "SecuriteInfo.com.Trojan-Ransom.District.19336.22619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030e3adc-fbf5-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713274023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274023, "uuid": "e2f66b70-29fb-4e79-bedf-c498884c8fec", "comment": "Malware payload (RemcosRAT)", "value": "47dfbbf7dd2b6cee793d3ddb6c22364e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274023, "uuid": "12a8ab99-42bf-4cf0-9bb5-998e69f45d2c", "comment": "Malware payload (RemcosRAT)", "value": "10550a684e5af2a6affe1aab086f18790d137392a2a145103db87d2ea014dcbc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274023, "uuid": "e0400242-0323-4ddd-a815-dba445fd3d02", "comment": "Malware payload (RemcosRAT)", "value": "eef40083b8670934b5b848d9995f27e37172b610", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274023, "uuid": "9287c2a2-b97b-4c04-92d7-e85d8ad756f6", "comment": "Malware payload (RemcosRAT)", "value": "8450606e0c6bdf160c481a1e6da0787c75683f2dde012bd9147af39cb38ec3ad8bbf902caf86f6125add8c4504c885cd", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274023, "uuid": "beb554ff-7d9d-428d-900f-b98c1ba29aab", "value": "T19653692EE34F0915DF56967B034A4B4A45FCB33DB28500A179BC97743BADC2E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274023, "uuid": "faa777ff-e24a-45c3-b41b-5a2e740c63f5", "value": "1536:92RQqyDNx43c9Ab6Zz8cMuMg3HDHYOU98QE1H1:9gQqyDnioAb6x8cMuPk2Q+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713274023, "uuid": "7c4525d0-6746-4f42-9db3-6efe6dec6ce6", "value": 64639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713274023, "uuid": "265a887b-5af9-4ce7-a00b-f8140652f01e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274023, "uuid": "d5cc194e-d9db-4ad4-920c-c6f03123e057", "value": "SecuriteInfo.com.Exploit.ShellCode.69.24616.9282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367cea90-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302456, "uuid": "41ab05e3-7fe6-4043-a1e9-beb0ae51cc6e", "comment": "Malware payload (MarsStealer)", "value": "ad89890757c177d7d05e2fbea0547772", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302456, "uuid": "64cb0d61-ae4c-41d5-9987-5d3a20b13404", "comment": "Malware payload (MarsStealer)", "value": "1109fc5e54190e0b50cdc3c455af86887566968cdfb6df59c2bfb566ddb295af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302456, "uuid": "171c6ae7-e8a9-4c6a-af0f-82a6d7fd3f43", "comment": "Malware payload (MarsStealer)", "value": "da871536caff869ea4a35f351b2fb90c6645b555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302456, "uuid": "b45165b5-297c-44fa-be93-095df42badbd", "comment": "Malware payload (MarsStealer)", "value": "7ca96343ad47b9f4103b8967515826fca124096f81267b4d5e78a50f39c0501014538c7ce1a8cc3fae46e18a02621f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302456, "uuid": "35879c8a-849b-4a85-924c-7e7ed6e91540", "value": "T1EAF3E1EE4210DA5DC5B45CFD4327B7B2EB7F5E2652298909F01D408D2AC10B6BF3AA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302456, "uuid": "a37c067e-3dbe-4bd4-a93d-b3c0645267c3", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302456, "uuid": "dbe01982-6d2f-49de-aa6b-aac31c08cd27", "value": "3072:ULKMxcDnqH/1IWaoytzjrTwCykHRlHAJ6+iAKu/xytwJSp8Bb8EG:EKzu/1IWaXtzvTvx1AJpPX5IE8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302456, "uuid": "54614d81-fc6e-414a-a7e2-c8ad8639750d", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302456, "uuid": "5d5e7570-68e4-4239-839c-8ff024314745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302456, "uuid": "9fc5927e-59ea-489b-8e99-f7d638208ae4", "value": "1109fc5e54190e0b50cdc3c455af86887566968cdfb6df59c2bfb566ddb295af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2befd4f-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713282129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282129, "uuid": "ce6e86e9-165f-4af1-9884-a03749ae4e0a", "comment": "Malware payload (AgentTesla)", "value": "fa261bf50908cf31073d1f9ceb85ec96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282129, "uuid": "41d44543-5f86-4e4e-9c2b-dcdfd2e1e358", "comment": "Malware payload (AgentTesla)", "value": "1311425073e904b4ff3da746f24efbaac8a1cf773babc731a4cad7135e836bb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282129, "uuid": "0525f2a0-d1b0-4bd4-845e-f867bb80dc27", "comment": "Malware payload (AgentTesla)", "value": "e136af3d7ad8ceb9cc8b4065d283879eb32dc94d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282129, "uuid": "a6edec4c-bf47-4216-a4a6-57ed4244d966", "comment": "Malware payload (AgentTesla)", "value": "f0159abd1bb105c12c4cff61b9f986f7cacc2acb3e9316e123428fe36c9fc8d23aa6bdcedc8dc5d7088b049821c986c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282129, "uuid": "7adb1de8-ec5c-4ca4-bc31-b7e8bfb5e7aa", "value": "T187340E037E48EB15E1A87E3782EF6C2413B2B0C71673C60B6F49AFA518516426D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282129, "uuid": "005ea341-f9ee-4808-855d-e9b30f63be82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282129, "uuid": "8350f38c-d244-470d-bb95-3348d3dadde6", "value": "3072:jaWLxRhBRjcawo6QRtKhvkOkDioylvI5qc/NEvG4kU:jaWLxRhBRjcawo5OcNvylvi/NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713282129, "uuid": "7b7315f7-6eee-43e3-a82a-c089077cb0bf", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713282129, "uuid": "1809201e-8727-480d-9d57-4215fb7e1901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282129, "uuid": "656165fa-429b-4455-be13-f91907dc793e", "value": "17132821272328b4b36e4a610449f7b2307828b4b561daff0edbb5a1a6dfbf1d1dab271cbf986.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70cb111-fbb8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248233, "uuid": "59675bb3-58f8-4546-9d42-e1443304a275", "comment": "Malware payload (Mirai)", "value": "644787c36d033f5cadec1f3d3e189fdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248233, "uuid": "a2cdf4ab-49dd-46d5-9d48-b2cf568f3d84", "comment": "Malware payload (Mirai)", "value": "146c465de07d9ce3c452a551f19377d530c5ca6d47f68c6095a043a9d72d6741", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248233, "uuid": "f8e5ac4b-98bb-4a96-a879-e8bc15c5f55c", "comment": "Malware payload (Mirai)", "value": "8ed3ac999415930549d0bcdc4b3491986ffe33a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248233, "uuid": "7a76c030-b3b2-4079-b3a7-52d504c3032e", "comment": "Malware payload (Mirai)", "value": "cab710378af1140eb84048d6dce9446ef2f59a365294bd00eb18668bb87f71686f1cfc4f7921b467c5038d02b4e8d87c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248233, "uuid": "820807e1-fe28-4a38-affd-b858c0056e02", "value": "T1D1D31845F8414F23C5C652BBFB5E428D372A17E9D2EA71039C206F61378B96B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248233, "uuid": "fdc4c1d9-8ae7-4308-9591-d31be4e9fd1f", "value": "3072:gNam/BzaBzhqQcQez06v1rADFFsXn30soujFd6l4262:lmJaBz4Qce6v1ELsX30sd6627", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248233, "uuid": "e8eb9d29-2b0c-4e49-8d2d-afe92ac08653", "value": 142312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248233, "uuid": "70c32a08-6f3d-493c-8c8a-e5dd30fdced5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248233, "uuid": "8427159e-6b59-44a9-a85a-effdcd9ba298", "value": "644787c36d033f5cadec1f3d3e189fdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa85237a-fc19-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713289766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289766, "uuid": "8598fe89-9c92-4cbc-9b9c-7bc45d499345", "comment": "Malware payload (AsyncRAT)", "value": "aa603e3b55b1c895bd213d06fcbced27", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289766, "uuid": "a2e040c1-38e2-4039-a753-ca142e87777f", "comment": "Malware payload (AsyncRAT)", "value": "14c66a0b3a199d38a236bed7780258d84c8a3cf335f9397769dc06a17d5707e0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289766, "uuid": "5ab894a5-f01b-4f0d-bf89-62077be7528b", "comment": "Malware payload (AsyncRAT)", "value": "ae1a724079ffc4a470a1e41ac07770489c90261b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289766, "uuid": "85d408c2-2e55-4dfc-a6a1-40d0f8b97f5e", "comment": "Malware payload (AsyncRAT)", "value": "ac887132c955e7d3fa6b92f09caf8b78cfc10f0a7a02caa3b90e889fc82a3af22404bd44e43c5c9573c15a77b17b432d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713289766, "uuid": "91c56608-5b7b-4e57-9c85-d681c61ba206", "value": "T1CE6307053BE98019F3BE8F7469F6658506F9F56F2D02C91D1D8950CE0632BC29A81BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713289766, "uuid": "7bd886d0-28e8-4b9a-8173-58fd03f29ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713289766, "uuid": "45c541ad-0cfa-48fa-9ee1-3d4b8a770e5d", "value": "1536:e2wukvF1ak9gcKu5UYFy64UmzbLbjVMonXdgqHirPlTGRx:e2dkvF1ak9Ku5UYFy64UcbLbjDCdix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713289766, "uuid": "a9676a42-c411-4bcc-9e1d-c4cd0e067991", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713289766, "uuid": "f77a69fd-fccc-4418-8590-2aacfb144a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713289766, "uuid": "62e00ea4-864a-49dd-aed4-bf7d3fb21116", "value": "xutnF2gKGTTy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efc8030-fbec-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713270285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270285, "uuid": "8f363339-541e-487e-9c48-9d8b0bbb2ba5", "comment": "Malware payload (Formbook)", "value": "1a75fb2dda3e1cb61bfafee3d684d83b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270285, "uuid": "0382fd7b-ee08-4791-8429-82897a558d3b", "comment": "Malware payload (Formbook)", "value": "15e6d2f42a3ca802155a78e54cf8d3fb9df7746290fd4acc544472b1800bba00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270285, "uuid": "251329fc-81dd-42c9-b8d1-d5c5ec5fc8cc", "comment": "Malware payload (Formbook)", "value": "767823688a9146bb9c520be22719df8289f66495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270285, "uuid": "20a622c8-adb4-427c-9aa2-04b8bc114838", "comment": "Malware payload (Formbook)", "value": "609455f0c065282e42b67e2034e732de8286bcab71c724b7d498b0ec0d3bc8ef4a112a0201035378147e4778bec114b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270285, "uuid": "1a3dbef3-39d5-4356-abde-6802ab40c8a6", "value": "T1D2F4F20093F88957D5FF0A7D783810912EB4D79DB285C3761D68C2AE2DA3B6C5E806B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270285, "uuid": "0ecd4013-074d-458c-be05-6f1471da811b", "value": "12288:8lyUNb//rs74XjQgWMAQL1IvFiYANqrGi+7FmofGeaO1ba63mP:9O/1jQTMAY1AQYAN6Gi+7FmIGel1+hP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713270285, "uuid": "5084ce82-4312-413e-ae25-cddd049eeed2", "value": 782996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713270285, "uuid": "8f883851-915e-408a-93fa-0c2334b5f55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270285, "uuid": "a1a75cab-e426-463f-ae6a-20c75fecb94c", "value": "April 2024 order Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e469f0fc-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713253355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253355, "uuid": "e109e6d4-85d9-4072-a649-cd21eb157308", "comment": "Malware payload (RemcosRAT)", "value": "cb5d55cbdd70a44948d1f976af168a59", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253355, "uuid": "4e6c0a89-40e8-4607-8daa-eb36a9cdf925", "comment": "Malware payload (RemcosRAT)", "value": "15feeb12f8460eebe263ec750d08dd79e1d26b2704726223f0dc7c6bacd1506d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253355, "uuid": "c5f6f3db-2426-4167-9efc-6b92715b7f33", "comment": "Malware payload (RemcosRAT)", "value": "07d995e60e3dbdabf23690014c3a4c74aa1e2139", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253355, "uuid": "c6f58853-5c5d-4086-9046-19f0d06634ee", "comment": "Malware payload (RemcosRAT)", "value": "66a9eed029d729b7777f2dc2f4b882f906c5145bd1aaefa28913b3c307ed0fb21c5437e8e2f42a92666429e5e79f371f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253355, "uuid": "646bd954-ad5f-4835-a713-d644ba9d91ca", "value": "T10E64E051BE918646E85507314DF79A9B6225FC415F934B0F324CF32D3EB43E82E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253355, "uuid": "ffb6dd2c-fefd-4c17-9848-378a16eb0cbd", "value": "6144:LuunJk9CBY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVd1MIhFjMaZ4EX0ikpM:LvJksA3bVd1MIXMa2EEL+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253355, "uuid": "54bfde84-53dd-4039-a9a7-03512edb462e", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253355, "uuid": "5d608a6f-bc23-4d4c-b05e-56ac69df959c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253355, "uuid": "bc984c6c-28d0-411d-9195-6d333e202d18", "value": "GMB.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c654e9d5-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233978, "uuid": "12338dc7-c06e-4c51-a95f-fac2c9217a90", "comment": "Malware payload (Gafgyt)", "value": "c4358ab67690320f0ca3430fb37f770b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233978, "uuid": "95e09363-99d6-41f1-9de4-8171ef07fa8e", "comment": "Malware payload (Gafgyt)", "value": "174d08dd7b41722678ea83e0df19fca7edcfdd7d749b6791e62e850f24c4a403", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233978, "uuid": "f3dcc6af-f4dc-41f9-9ac1-05d306a02012", "comment": "Malware payload (Gafgyt)", "value": "aed97208d30e15cb2c1bfc7e8917ef4de5c90709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233978, "uuid": "3478e5e1-5a70-4759-ba21-65227bceee12", "comment": "Malware payload (Gafgyt)", "value": "4ce4f567fc59fcaf6943e7176facc48872e28eccae89238a41d9592640bb620d4f5cc755f341a00c45e795a45edce28c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233978, "uuid": "f505a533-b603-40eb-85c6-b7a3c21a2b31", "value": "T14FB309037B0E0B83D1533DF06A7F2BE1979AFEE215A5A180751EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233978, "uuid": "71ebcec3-1ae1-4aca-8ade-e82ca8605872", "value": "3072:yLIfmmx4F1xwL5b/vRxkpRGRXUc5hQpX3:yLvsL5jvM/GRD5h43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233978, "uuid": "74d0bdc3-6bce-40ea-b3ed-85c96702fcc7", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233978, "uuid": "3277f6ec-9fc8-43a5-9599-9e52c95b6cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233978, "uuid": "2822c1fe-3b21-4ac6-b901-5a59c3c49777", "value": "c4358ab67690320f0ca3430fb37f770b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947a375e-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713256228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256228, "uuid": "3500fb02-e161-41ff-903e-ae2090d7abcb", "comment": "Malware payload (Neshta)", "value": "a91dab24aa90fa6115cd9a6d496aef47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256228, "uuid": "3a8ac11b-576d-4e3f-a00f-4066ab72d5c3", "comment": "Malware payload (Neshta)", "value": "179e9673e3cbfd035d528f744f3eb88c65583089bb78d744f2c380be3bf3540a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256228, "uuid": "1bb77060-8759-4cb4-8e14-a4e0fa05d29b", "comment": "Malware payload (Neshta)", "value": "f6713efef793510d67b672eb85e52582e02be38c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256228, "uuid": "d898f8c2-aeae-45a6-b430-708d8592b7dc", "comment": "Malware payload (Neshta)", "value": "fbe724969d4d8d77c80009dc9768246142b033c2b29faa261b0b277d9c8c31ac8847c5aa2841fac39604431754d02f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256228, "uuid": "5f433db0-0142-40e4-ba53-ed0f4ceb2962", "value": "T1DAF4120466FAAF09EAB947B155666C240B7775EA2976D34F0EC260E72C34FC04B41FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256228, "uuid": "769f3dd3-9384-479e-ab98-114c8d085e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256228, "uuid": "da511581-f654-4c61-b8f5-c599fe2d03f7", "value": "12288:9Qzh3gasPD+tioja8FqUQJNX+7X98yUE56TVW79FLhM2++yceRlzI1b:9m3gasr+cqFq3LXSt8rE56TVW7yX/c1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256228, "uuid": "4055e60e-78a7-4ce5-a9d1-ab01daf7c3db", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256228, "uuid": "77c1592b-5c42-49f6-976b-a81f25a0fa40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256228, "uuid": "edb7c3cb-6ad3-4cab-9e48-351763c1e573", "value": "PO0130717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a307b5dd-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281593, "uuid": "abf64b75-095d-4328-ae52-047e62626f60", "comment": "Malware payload (GuLoader)", "value": "a2b8d337b9b1d176d3ceb15be7e1a751", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281593, "uuid": "580d3a3a-e1ba-47df-a86c-dc64fa384121", "comment": "Malware payload (GuLoader)", "value": "17ae23439b2bdf81ad90a0134a11a2630b2ed138da7a8726dfacb2834b304f65", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281593, "uuid": "10e8584b-e16f-4a9c-8c5d-310b84d5b46d", "comment": "Malware payload (GuLoader)", "value": "72cd10b58ca390d1ab2ef8765cef522e742d2080", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281593, "uuid": "b4250fea-6f72-452d-8285-713177d380d2", "comment": "Malware payload (GuLoader)", "value": "a347a35d2fe47e1187811f5708aa6b1d769b3affb12d64ae1f245874e65285462844470eb72411e547b9b19b50347410", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281593, "uuid": "8f143c76-8c8d-4b71-ba31-38a7c82f9772", "value": "T112946D60EE68066A0E4B279AFC911A92C5FCC219462710B6FEDD074E61075ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281593, "uuid": "0e030618-9397-4dc2-be49-dd165e0aeb56", "value": "6144:ltrc0iH9QXg0I6+QU0FSWtBVkmqtESGPSg8FD35GEBXMVU:lFidQ0XIzT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281593, "uuid": "97df3b83-7052-4239-b24a-981e7b452492", "value": 412821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281593, "uuid": "48ef2e76-dca7-420b-8478-baaeef8c042e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281593, "uuid": "46e020c3-596e-4756-a239-412e850c3f81", "value": "Shipping_Invoces_xls_0000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1337e17e-fbed-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713270614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270614, "uuid": "bd32d7eb-177a-4f61-acca-78c8360f7b9f", "comment": "Malware payload (AgentTesla)", "value": "355db74680c1b1700a22223513fa3379", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270614, "uuid": "a30a86eb-d48e-491e-9bf3-e3aaa7ade168", "comment": "Malware payload (AgentTesla)", "value": "17c0c50c1bdb385925428029d1dcbe31c084753ff0ab8c11c8b866163425c5ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270614, "uuid": "09e1cccc-6288-4957-a6b7-80f5221f7548", "comment": "Malware payload (AgentTesla)", "value": "c851d174c267357a544940d5a0cf66fa17603b46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270614, "uuid": "1a96c727-898e-482b-a75f-7c700bb31b02", "comment": "Malware payload (AgentTesla)", "value": "a6e5f2e01bac0c3d0f5fc7f6db60162031d5ae2d3eb874d2a2cf0f2e6c151cf8f4c47f42140a3aa46cde4d35b28b2c06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270614, "uuid": "adecc258-37ca-4626-b3a8-e153b70afe67", "value": "T126158CDCB14075DECC1BCF7689642C24A6127C76A73BD10F901B35A8AA2F697CE215E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270614, "uuid": "da6c1028-5ce9-4c3a-9475-afb648191872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270614, "uuid": "0e4acc3a-3d7f-44e8-96dc-27b26af8e84c", "value": "12288:Z6KlknteFTuzB2nEmad19ThM+3vgNxv9f1OQacaq9wChAwfAtWifcnFmaJm180Hh:wqUe1uzE9ad19NM+ITdtAwoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713270614, "uuid": "02c29a5a-b4c6-4d76-8498-1c5c0246724e", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713270614, "uuid": "ca748a26-74a2-413c-be87-20290a636805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270614, "uuid": "52e70342-53a1-47e3-9bb0-4aefad5bba43", "value": "HOU34ED23E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266e5115-fbd3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713259479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259479, "uuid": "295be585-0d2d-4dd6-ac57-29aec34fbaf3", "comment": "Malware payload", "value": "27e1ba124dca078b7c11401f9467b1d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259479, "uuid": "ebdb875c-5ebf-4133-8475-2545860f81c6", "comment": "Malware payload", "value": "1862b29b4e7d6d936345b6dd89216cd677f82410761de7a192af822663ecdecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259479, "uuid": "84b5fd29-210a-4ed0-9e7d-c4cebab0f98f", "comment": "Malware payload", "value": "5549c30cc5f36ef2ed3d796e6f16309e7f274c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259479, "uuid": "bdda0a81-da17-40b1-91f8-29ec293fe6bc", "comment": "Malware payload", "value": "165ca4038bc38bb601b2b2b21bd1cd1a70d100bf92a64fc5a23a3c5e568bcd6f943dcdadadb438f25ac423ef0c416cb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259479, "uuid": "baa9de7d-5e19-4503-9f62-97a2f850040b", "value": "T177755C1EB51241A4C46EE570997B9928F370B5549BF477CF92A4038D2EEBBD81AFE300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259479, "uuid": "184544a2-ce92-407f-a685-0bd4926b0c37", "value": "8d907744ea3ec6418c39e9dd7b1b8f8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259479, "uuid": "680bb70e-ac39-4e00-901b-2b8faee42362", "value": "49152:FiaDCMQwfG+mLpit5ckD0bF6eq+yNGNbbgWWkPAdU+To:FRDJW3bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713259479, "uuid": "f4c5275f-46cf-40ed-b247-4143bef61ba2", "value": 1581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713259479, "uuid": "d04991df-47be-4e12-99bf-d12a87907621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259479, "uuid": "aaa58768-f00c-4061-9612-497cfd01502d", "value": "SecuriteInfo.com.Trojan.GenericKD.70591578.24974.31588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b48cfa2-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713257018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257018, "uuid": "2330ffee-7eb7-460a-8c9b-a9421eadb0a6", "comment": "Malware payload (AgentTesla)", "value": "6cfb9d303aacc366473e5d7846ed6140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257018, "uuid": "e6252e24-dc1b-4874-a32c-427e4b8eefd2", "comment": "Malware payload (AgentTesla)", "value": "1902f939a74f649682dc0d484b6b101b855de2053cd6a74535db49697aef4c1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257018, "uuid": "0c029195-caa6-4a4f-813a-52a21e14607f", "comment": "Malware payload (AgentTesla)", "value": "ad5bbb50db782c3200e4bf41183d19823e78f5b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257018, "uuid": "c6920d43-7590-4867-bfbd-fdb13c56e4a7", "comment": "Malware payload (AgentTesla)", "value": "889093046609f6d9b5ad5d1d4535959d6b9c51cf1891c24a9b53039307955860ccbb146cee868d1ad3c843b474aca743", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257018, "uuid": "662e9393-748f-479a-ac40-38d3e2463e35", "value": "T1A8E42228B3AD9742D2BDC7F8A86584064F72740B6936C39D1CC0B1DA7DD2F60C64AE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257018, "uuid": "65d7cfd6-bd0b-4d04-928a-fd3fbf4eddcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257018, "uuid": "bfe9ca5f-ece6-4407-9abf-8b7d62df8100", "value": "12288:KaAvgzT370Mzl+ZtakghHJAm13QDY6v81XbNz69k4GoajFX601569Mum6zrZ8KXC:KMB+/ghHJNQDYBXbNz69kVocFH1M9Fmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713257018, "uuid": "fffc680d-e335-4890-a735-0debc2fce4c2", "value": 678408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713257018, "uuid": "6afaa8bb-e1e8-4986-a7f6-d7f2212b1d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257018, "uuid": "06318125-713b-49b5-b2b2-24bef361cbf0", "value": "6cfb9d303aacc366473e5d7846ed6140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95e02b4-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233983, "uuid": "7c786754-ddda-4900-ba16-feb635dfbffd", "comment": "Malware payload (Gafgyt)", "value": "c2223d3ea289b3924851e51a4dd51f0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233983, "uuid": "c217ac8e-8d29-4a03-88e1-a9abf51af418", "comment": "Malware payload (Gafgyt)", "value": "190646c2bd27cf50a941a3faa6cf55ab5d8b053eff4be64bd4d176d9bc791c4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233983, "uuid": "cf8e24bc-740c-4934-be9d-3b5d55dfe082", "comment": "Malware payload (Gafgyt)", "value": "122267e495437d95021963c296b690b5978c1d7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233983, "uuid": "776c7826-0779-4e2e-91a0-89fa1ac5f987", "comment": "Malware payload (Gafgyt)", "value": "18f0d41087258c8c17cf2846abaa8b133a7a9e24b37a7b2a5ce9bdf1aa756d5655b946a66a41cd58c184914c13b4d528", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233983, "uuid": "60983228-27c4-4d1d-82cd-2792aff7c52b", "value": "T11E934A23EA175F0BD14BA0F061F59E391F12B8E689535BC6E066DAE5A583CC9B005FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233983, "uuid": "31efbf09-5395-4f29-8535-458f8e23912a", "value": "1536:DxLXRnvDmlv/hYxvKTD6VBJhPKd+VCI+yf7iGU5hzRnvRpym:ZhvMv/SyTOZKd+VuyDU5hVvRpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233983, "uuid": "6e37795d-c273-4179-a5ab-dde1754b9df8", "value": 92020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233983, "uuid": "4135aed2-6194-41a4-acf7-292f1c70d46a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233983, "uuid": "b31c4a8b-96fd-427f-9fc0-1bc97ad38b13", "value": "c2223d3ea289b3924851e51a4dd51f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c17eb8-fc0a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713283211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283211, "uuid": "540a2708-c9f8-4671-888e-472e5614dac2", "comment": "Malware payload (RemcosRAT)", "value": "3a9fb5399a485d6e94d5ffe6e2349e74", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283211, "uuid": "9d828cf0-39ee-48b4-9ce6-bc586e52bc13", "comment": "Malware payload (RemcosRAT)", "value": "1984264959b7d63e516544cbce4b6dffb7ed5210a472437dd88068f4d39600e2", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283211, "uuid": "9e18026d-af22-4d84-95f0-55a775561cea", "comment": "Malware payload (RemcosRAT)", "value": "9f5438e7296fe2ca8f7efb574e7139923756ceb8", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283211, "uuid": "a9c50a0e-eeba-45eb-968b-6859b7b8cac5", "comment": "Malware payload (RemcosRAT)", "value": "6f8f6c142a139b7911106e63d03ea4a47b7b4d44a6c87e48cd184896ed9cbb0fb9e0ca2af848ad086e95c1d7977403bc", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283211, "uuid": "27af94b7-2338-45de-9a22-b7070f31da39", "value": "T1FEB49E01BAD1C072D57514300D36F776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283211, "uuid": "8070d4cf-5a3d-4334-a46a-3bfa28190ee8", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283211, "uuid": "783628a0-845e-4a58-852b-2533482d4926", "value": "6144:mXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNra5Gv:mX7tPMK8ctGe4Dzl4h2QnuPs/ZDncv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713283211, "uuid": "b5f8f7ab-c7d7-468e-bbf5-baa7f1580795", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713283211, "uuid": "52574b64-2b77-475e-a1a4-a2d6d3eee87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283211, "uuid": "edff7f01-519f-42c9-9176-2006058e69a8", "value": "1713283209b718b3402f0849bd96c1191ce385ad0742966accbbfb52b7b95b60820687e4a6909.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e7b068-fbd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713258728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258728, "uuid": "d55bcb9b-e7e2-4fb9-8a69-c5f89d167cce", "comment": "Malware payload (AgentTesla)", "value": "fa832937b6ce510fd8dd8a622e67b8ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258728, "uuid": "b0e086a6-bb26-4260-a7f2-e1cda1b5a107", "comment": "Malware payload (AgentTesla)", "value": "1a46ff8c8076f68bf5dc48845c315a216d0a0c02502d1b5032a00279a7afdbb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258728, "uuid": "d865cca1-f1dc-4b36-a633-69adfc69652f", "comment": "Malware payload (AgentTesla)", "value": "831d1858002528464dbc22d7ef9b33970ed238a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258728, "uuid": "e4efbe16-8d0c-4f2b-9f03-7ae17c2763ed", "comment": "Malware payload (AgentTesla)", "value": "00758f98e3a185ac71f2432c9117ede00ffe72d41f9cd48cbb436e3083699ca95a17b772f2efec6d8e8cc67186a29114", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258728, "uuid": "6861be06-6d2e-4f18-8b9a-a0040f2a61b4", "value": "T139A4239A6DDA163C8635CEA6D9DD8DFBC1B523012EBCD050917329349B3C7E02981EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258728, "uuid": "b2cffd20-5597-4513-ac48-4bded76d3f88", "value": "12288:lp7MeQA1QtP1xJwhlDT2sZRqvQZFcRZCutmPC:l9MeQA1UPER761ZCutmPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713258728, "uuid": "01214dde-6775-4562-b96e-ca5d17e57804", "value": 484879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713258728, "uuid": "b5349a5b-a3ce-49af-b103-76b495a19882", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258728, "uuid": "8f5560dc-ef70-484d-8ba9-dbecea0f4470", "value": "5586751de290b907937845cb29c222d012c98e46fb2ab28d5c71ab2d5454bc70.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7b8f60-fbf0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713272131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272131, "uuid": "9422fbff-3935-472c-9c62-558575a47e0f", "comment": "Malware payload (AgentTesla)", "value": "550c6272ef08725bc9040956dacb7b28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272131, "uuid": "f7d7fcd9-6909-4b4f-a12e-d1b633aefe2a", "comment": "Malware payload (AgentTesla)", "value": "1a632b809dda5ccb587a4c6dc66f7b0e118e17d91f8e6813a1cb36dfe3396771", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272131, "uuid": "bb8cf0c4-994a-40b6-a0a4-98bdb52eb1f9", "comment": "Malware payload (AgentTesla)", "value": "228f91fba71ed51fd377159480f809a080022215", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272131, "uuid": "3bdc3988-ccc2-4315-9429-e1c948acb4a7", "comment": "Malware payload (AgentTesla)", "value": "67a697e3f1adbff917cb1df03b1bfceb6c40822fe9937638e0e1455b179e3c26949a0794bfc90adc257d3aeae16a14cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272131, "uuid": "4fdb0aa0-2780-4d48-99ae-2217ac6e01ba", "value": "T194F4F1246AABBF26D6BD47F14561691007F1B46FB865E29F0FCE10D92922FC90D81B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272131, "uuid": "5f3bc7ab-8da5-4253-bb88-510ff16fb1ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272131, "uuid": "fe8c0e77-679a-4003-8414-6c59b3a48abb", "value": "24576:HuBPuFUL6z9TYT+UsBvXH947Bdy3jaW7fdsIwC:Dis9TYT+/9K73yzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713272131, "uuid": "9e2bd7e1-ddd5-445a-9ccc-7f7277338dc8", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713272131, "uuid": "bcf6d26a-6039-4cd0-af61-9b1d42166eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272131, "uuid": "356d173d-b745-4d90-a43b-a2a0effc19ff", "value": "ES502900012.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feb28c1-fbd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713258582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258582, "uuid": "1ae059f6-2f35-4276-aeb4-e4e40927cbfe", "comment": "Malware payload (AgentTesla)", "value": "2fe332da4bb7f662369861c411dc2b92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258582, "uuid": "f74be4ad-363e-47f0-997f-e134b46fc06a", "comment": "Malware payload (AgentTesla)", "value": "1a70b5141a0f1cb202ca1c2d418a6bc824ae8932f54d383581d9861009b53d45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258582, "uuid": "9b861b1f-a924-4bbc-ad61-e57a43d21474", "comment": "Malware payload (AgentTesla)", "value": "3587ec55df614df19fa2945bbe17dac119e0ac3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258582, "uuid": "08bce8ed-e017-49aa-8f59-22eb6b252f5a", "comment": "Malware payload (AgentTesla)", "value": "6f5276c8d3f423c64864e371a04873d121277ebe7365a71479c52db43bfe9767fdefde63141c379388139834d5ffc46c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258582, "uuid": "8362585f-3603-4f82-814a-388fd523bada", "value": "T1BDE43330E745305890C2BED8156F9F86B9C4D3CB2D899ED055409B73ACBACD8DEE8D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258582, "uuid": "6a649011-b77c-4863-bf49-2650d64ce636", "value": "12288:EeCCqJIW6+6kjIcADjk2j6emad1d2c24DuPAHGWuWVr3uNOPnGpXrMel:jCv4+9UNM2jIo1ccfHGWuWVrecPGtrMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713258582, "uuid": "7a39bdde-8b69-4d52-a370-ae39d7a93b6f", "value": 697580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713258582, "uuid": "b5dda9ed-feb7-4382-9480-502a07e9f010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258582, "uuid": "93719826-86e8-46fd-9543-b74f80feb220", "value": "93001657328.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e115b108-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713234022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234022, "uuid": "f9fd1ce6-24b9-4d6b-bc27-7ae5b01a9215", "comment": "Malware payload (Gafgyt)", "value": "1569508a3a6e5ebb14150b03da3ef23b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234022, "uuid": "12d98b54-f3c6-4490-8a0a-f031a3227855", "comment": "Malware payload (Gafgyt)", "value": "1b9281136a947b98514deb07b6bb5da381242745f2893f99c5233d10096c57fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234022, "uuid": "68cd33b2-6d53-43dd-acc2-b53733d4cf48", "comment": "Malware payload (Gafgyt)", "value": "4ddc31372f0e7e9a418d3a114b2d3b93803dc65b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234022, "uuid": "4ef64b64-acd2-4674-a341-0633b0a8913a", "comment": "Malware payload (Gafgyt)", "value": "c88fca94f02325f0ac6af917778ee41ff6442fdcf0206777d0d1b2c4c94f310565b41506e2f14e0590cbc43a399c7654", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234022, "uuid": "1f7a0350-8403-46aa-bec2-693387888c05", "value": "T12BB31A93F515D9B6F40AE73708D38B247270F6A14B53162263177B6AEE362C4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234022, "uuid": "09a5e0de-ccd4-4dc5-a065-8999e1e78689", "value": "3072:pNq0YQeqacWucW0JcWcBLMM2VeBXR41Otn28wMPKud+mmTbzTx9H1En:7YQeqacWucW0JcWcBQM2Vete0x28wRpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234022, "uuid": "f1ab308d-40fb-44c4-8195-77d69bb4e4e0", "value": 110175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234022, "uuid": "65f47d66-b78a-499e-9d01-a8e57e24e8f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234022, "uuid": "2634aaac-9dc9-4df6-9476-4a77f5eaf2d2", "value": "1569508a3a6e5ebb14150b03da3ef23b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f445283-fbed-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713270715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270715, "uuid": "f82b61ba-5dae-45d8-bf40-4db1be823cdf", "comment": "Malware payload (RemcosRAT)", "value": "1626a8bd20e14d78a9eed883017016ec", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270715, "uuid": "a6a18cef-ca56-4efc-9bb5-4660003c5f05", "comment": "Malware payload (RemcosRAT)", "value": "1bc1da839fe7f12dec13b124707d8d98d8703a631a469f1c83e821cf664a9d9b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270715, "uuid": "c4c25f58-c79e-46bd-9af7-6fa0d9487204", "comment": "Malware payload (RemcosRAT)", "value": "c9f2e59dc6f1117a0b863d966d11a1c0eebb539a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270715, "uuid": "1efc5820-6270-43fc-b1c1-8ed2ef2dea04", "comment": "Malware payload (RemcosRAT)", "value": "5ce6f3af499c4ad365e5228d0192a3961b9d03312c32139c3b87b181df7580d6dc6b0469bd4b5c64308fd64eb9657298", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270715, "uuid": "58b91f66-ff07-4e2c-b095-cbc58354980e", "value": "T14B63792DE74F0915DF51A6BB034A5B4909FCB33DB38540A179AC97743BADC2E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270715, "uuid": "a64f4fda-b2ef-4245-a487-2b88e08ff41f", "value": "1536:MzClGeDt8xwauyDmyttrnJ3YbT1AuWpWyEhJBwFCLSEPK+fBYebZiuher6WYWXZG:oClGeDt8xwauyDminJ3YbT1AuWpW7xwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713270715, "uuid": "58909306-28ac-4471-8c1c-35f77532682d", "value": 72235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713270715, "uuid": "12f1120a-4009-4597-9765-b457b8ab5373", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270715, "uuid": "d7356272-1ac4-4a71-9ef2-acb962f8760f", "value": "1626a8bd20e14d78a9eed883017016ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89be6a9-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713234008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234008, "uuid": "5f51404c-3b74-420b-a379-d7d6327b9fe6", "comment": "Malware payload (Gafgyt)", "value": "1f5aa231eb60f3937434a3404bfb7b87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234008, "uuid": "1ba6d439-15f1-4631-8d07-a545bf9ece7e", "comment": "Malware payload (Gafgyt)", "value": "1be464e385ec5f3ab817d8648ef3a03caae9fb172d222946c4ab4f6d345bd224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234008, "uuid": "5eba59f1-8f93-40a9-83d3-b089189d43d0", "comment": "Malware payload (Gafgyt)", "value": "f745830b8ce0798623bfbfe95774f286835ac488", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234008, "uuid": "9731eee8-91a0-4c5d-adce-21f200746f14", "comment": "Malware payload (Gafgyt)", "value": "8b23903606098914336c1cadb0050a5c65cd955cc9bf6c5278be93d28b01fea945d8d8bfaee971aa09f19a8318bd0c13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234008, "uuid": "56e8285d-6b6a-46d0-bc91-1035184c7a00", "value": "T100835B47E262C5B7C4831B7612E7962A0631FC274B6B9F06F35D2EF4AB024C5319B366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234008, "uuid": "821b3d65-940b-463a-b9bc-2ba0bb308b25", "value": "1536:JYn1wyt6o4FRcY1z6GsqtRNeF12XwnzvsXjKmQTse6MCYka9:JObtriRcHqPNy2XwnzvVmuseVCYka9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234008, "uuid": "a7b3b27d-4fb7-4d7c-b9ea-0647534bbb72", "value": 88153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234008, "uuid": "a533bee7-a070-4422-98c0-da0326c181fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234008, "uuid": "98ec38f7-2f35-48d6-88ac-bf584b9d39ec", "value": "1f5aa231eb60f3937434a3404bfb7b87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b611c065-fc1b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713290644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290644, "uuid": "21152638-b8a4-40ca-8ab0-51b1ac53d0ac", "comment": "Malware payload", "value": "334f3fd6c9fe35fa7d5e7d2780d636ee", "object_relation": "md5", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290644, "uuid": "1940c34c-d7c0-490f-9f7c-9be5f205d5bb", "comment": "Malware payload", "value": "1c4d704dcf8a341a8a6129743b1eb84681d53c4459cdb62fe2954e41adfed961", "object_relation": "sha256", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290644, "uuid": "a4a7761c-3c9b-42cc-97c0-f30600a46bff", "comment": "Malware payload", "value": "127f6bc9b9a42bf7036c3f39d66c87d32cddeaa2", "object_relation": "sha1", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290644, "uuid": "3844b8b6-062c-4e5c-90b3-17804012a255", "comment": "Malware payload", "value": "86cb2d4c1c6bb636f1fc8f293a44e6f2c9d9c0ddcd2baf9a57cca38993765a49c1291e8e63fb09beaecf72cc92b00cbe", "object_relation": "sha3-384", "Tag": [ { "name": "AHK", "colour": "#84754C", "exportable": true, "hide_tag": false }, { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290644, "uuid": "6994d4ba-0220-4492-a865-19a3bc2c6a28", "value": "T1A7F0F12B09DB019886E2A4C8FB9634509CDBE946ED7D929838C244DC4A8DB125CF4DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290644, "uuid": "df22bccf-ef2b-4058-ba96-048e880711e7", "value": "6:8kYWQxcpC1ogdG+GbBWcQdSIurioqqu3DHzJsaum8rkwHYF6DtGy1xk5QQNP0Pa8:LQxcpCeY0Ojo1uLdsa7e4YD/ktVsKVnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713290644, "uuid": "86fd8dc2-6f93-40ed-8feb-95f27799953b", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713290644, "uuid": "777c413f-c62d-4b5a-9ac7-1b6b5630f5b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290644, "uuid": "c7f4225e-4131-477d-9bf5-3f8841ba0e25", "value": "script.ahk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad49f1bd-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713251974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251974, "uuid": "76bfc318-3c80-45dd-8886-f3214cb55810", "comment": "Malware payload (AgentTesla)", "value": "e1530ebf84e2732b1777dc141bf3d0be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251974, "uuid": "b27725e7-ea6a-4e6a-aff0-e3abd52034c6", "comment": "Malware payload (AgentTesla)", "value": "1c83a3e2497d59214bd6360f295dd57f74eb2e5c2fa68b81dddf5482e61e0914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251974, "uuid": "0b3e8a43-46c6-4ede-805a-d8632ba632cb", "comment": "Malware payload (AgentTesla)", "value": "b55659753b8e0d3a79ff3b8ac83a7980f79a78a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251974, "uuid": "68563810-f727-486b-8aa3-b39e7b751b06", "comment": "Malware payload (AgentTesla)", "value": "5c3c572c641b513588f96b535753e5d055b1df9c598ae2e1cd39681b6b20b5d7eb7d787aad086d03a4b1c9fcdc3f36f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251974, "uuid": "e70e07fb-3353-42d6-bcba-3e11d8a82e12", "value": "T12AF4334B73A0CEBD717B9B45719162BDE4A15F0062FCA9375AAF18F15DAA2F118FC002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251974, "uuid": "9d38011c-4bbd-433d-a6e7-13fdd4b8049a", "value": "12288:m5G2ji800bRKAoUGCuvRENGZuyQI9Md23cb41MwNV10mw1+c36g0ukhOkBU3q+YQ:92jAnUKENG1QI9Md23jMwNVq1+cKg0un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251974, "uuid": "adee788f-dd0a-4235-aaf3-60bf2430b30e", "value": 736939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251974, "uuid": "2e7b795c-2039-42dc-a543-a76566a18432", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251974, "uuid": "513880be-e5bd-4285-ad92-fc07f06bf22e", "value": "Statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bc4f2f-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265405, "uuid": "8204f56b-94c2-432f-9ab0-2a88f49e2a63", "comment": "Malware payload (Mirai)", "value": "046c8d52a27c17aa3efc5a8ba99b728f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265405, "uuid": "bf3ea350-5837-4604-88c1-bd10842450a2", "comment": "Malware payload (Mirai)", "value": "1cd31019e461eb33865f572403fdba43202f101d1d33272a6f4d5f63bd1c4e88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265405, "uuid": "861a3dc7-e583-475a-9129-dc0f7fdb76b4", "comment": "Malware payload (Mirai)", "value": "0d2bc9bd2a7cb71e1369a7f26f9c947d397c85aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265405, "uuid": "ef74c563-08dd-4af8-a18b-0d5aaff857df", "comment": "Malware payload (Mirai)", "value": "8fa32c42744ef7b7fefcdd524ff201327ecc741f72e47c8e3a6aa59f133b70fd04d48ec3ca93825f51f0c92fc60aa900", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265405, "uuid": "a530ed6b-79ab-4aab-ab41-2a0959649b93", "value": "T114147C86E762D9BBC44B077906EBA7354637E4A2031F4B02E31CAEF46D53291F585F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265405, "uuid": "e95ab238-fec8-44d6-92d7-60f5d4788429", "value": "3072:UpGYXLlyQylu1zXMA2R4TnNjbaEcCvPvyHVByqqJEy:VYZylu1zXMANnNjbaBCvP6Hv8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265405, "uuid": "d450df04-fffc-4a5a-bfb0-e35be9630380", "value": 191979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265405, "uuid": "51a55e7d-de29-4346-9f0a-9d79c398f33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265405, "uuid": "fd60d295-761b-4cc8-b254-e79b6a340da5", "value": "046c8d52a27c17aa3efc5a8ba99b728f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c758cd67-fbf2-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1713273064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273064, "uuid": "7f279130-072a-423f-8cfd-331c6842a88b", "comment": "Malware payload (Vidar)", "value": "3b40002d7d0fce8adf90ef1312ec7b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273064, "uuid": "1cae2f16-752d-4cbe-b441-081c879c60da", "comment": "Malware payload (Vidar)", "value": "1d16a4484c0e53e9ddd9d14d8b302389ff861aaf9a841268e2e8f40c11615e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273064, "uuid": "60920500-f593-40b4-a6ee-1c3c8599e88d", "comment": "Malware payload (Vidar)", "value": "efcf62cfc00bccbb9f6f683f946a13f5f2d5927c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273064, "uuid": "29ae84b9-d537-419e-b9fc-22df4ea343bf", "comment": "Malware payload (Vidar)", "value": "888b6613190d959498824d59d58129248a976c11bb078da9590e85800b50444e42b831957412a0f6fb98b1d89da61d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273064, "uuid": "a97dc838-3754-4a27-8e52-b4e418f1c886", "value": "T1C064F211B9C0C072D6B21A360930EAB49F3DF9701E649ED763681EBA4F345C2DA35E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273064, "uuid": "fe0b4343-a08f-4944-8ae8-dc7140085ee0", "value": "b09f4628c9b8d8436d8b37442f32d236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273064, "uuid": "ac46a0de-ca88-4138-813a-10baf591411b", "value": "6144:NkNn/RgaOp0lfgS+wIxFcOmDgZCZ40VNPd6e3vp3:NkNn/0O+JxOOWgZMXNPdpp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713273064, "uuid": "13c20512-e935-45cc-8084-1a956b749c56", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713273064, "uuid": "db99fc77-2ef1-49c4-8eba-a437d48bab4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273064, "uuid": "36fd648c-25ef-4511-8f2a-21b95b99b1fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a16d0e-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265415, "uuid": "534813c4-cf42-4474-be76-fc551e7d3562", "comment": "Malware payload (Mirai)", "value": "6c89568369918efa7e5631f19400379a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265415, "uuid": "9cd43009-06b2-4b92-87ac-ce9d4fd84f48", "comment": "Malware payload (Mirai)", "value": "1f11295cea1c0ae31fdf3c755196c8dde122a4c33da0e5fb84c51464c9f80f00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265415, "uuid": "40f2187a-a52b-4e27-b27c-5c18c80601f2", "comment": "Malware payload (Mirai)", "value": "eff5e8e2fddeed23892096c8d4c2362f5640b819", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265415, "uuid": "3a05199f-fb6f-46dd-b081-05b98364ec4b", "comment": "Malware payload (Mirai)", "value": "a5b93054e972b47bcbba6689c75f88dffa30f0ac043178f8eb9d6876f95c7a36b83ea06ce61fc2a5d703f2a912430b2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265415, "uuid": "b9aded1a-5b0f-4cc5-9475-ca883b8816ea", "value": "T1F223F7D7F801DDBAF81DE73B8457040AB230E69606921B322367352BFD761A40977F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265415, "uuid": "ab7f3af1-b5b1-4177-be46-c4af2746fce3", "value": "768:nfQRC3yCkw/oCaLa0y8aUBMsfnVCBI13E0xXhBXjUhrn6v/I6:fVlP/ks8aUfnVII10ixBXjUhr6n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265415, "uuid": "79f66ce4-5b35-46ff-a517-c3937fa56a31", "value": 46124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265415, "uuid": "aa642caa-8b0d-49cd-a086-73c83156d776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265415, "uuid": "1918cb58-27cd-4bf5-a3c3-7a199475bbb9", "value": "6c89568369918efa7e5631f19400379a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7a2f4b-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1713253070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253070, "uuid": "e91d1a6a-73f5-40d5-97a1-b82d3e165c03", "comment": "Malware payload (DarkCloud)", "value": "9fe6dfcb679f1fb1c5a7c8c6269373ef", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253070, "uuid": "1fe79798-0cfd-4478-9cc4-4b96af2d4423", "comment": "Malware payload (DarkCloud)", "value": "2049983c8bc3bc8bfd8eb95e01e56071ed1833b01a6923133d1238aa904f01d4", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253070, "uuid": "e46167bc-a44f-4455-930d-ae3c1976ed34", "comment": "Malware payload (DarkCloud)", "value": "0fa13c67f2642390e7aa402a1e3383429703572b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253070, "uuid": "f01a1347-7759-4ea9-a475-cdca9672c146", "comment": "Malware payload (DarkCloud)", "value": "4e25f843b9969d53100b2eab0abd565c90ae51d5b43dd009a2ac64b94b31ce75061201ea80926cfe5c5f1b985651da4e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253070, "uuid": "da0d6630-4d8f-4f6b-bb9c-95f0afe3f59c", "value": "T11B151208B5BB7F19E6B88BB9043118101BB179EA6572F34E0EC564CA6D76FC44E10FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253070, "uuid": "28ce0906-36b0-42d6-b0a5-a24daf6539ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253070, "uuid": "2db17479-3ef4-452e-b4df-884464256dd5", "value": "12288:9jbl5URBsle4E3NgwUaDTm4V4CxOaVhGDvnKYI6kQLGjouEu80Lx+wnMCwwrb2pp:1E3lUa/mQ4CxOASRKQLWsxVag8avn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253070, "uuid": "dec863e8-05e6-437d-b812-0534e0830cba", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253070, "uuid": "59f6c92a-7473-4795-bd8e-1ef9c193a927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253070, "uuid": "095fbfd8-4bbe-43ed-b042-870934d26331", "value": "iterms.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5855285-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713248660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248660, "uuid": "6f987be4-9564-4b5a-b7be-a8244117e79a", "comment": "Malware payload", "value": "ba7b2b951e1585e39d9231d890574f74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248660, "uuid": "7ff2ae8e-9a10-438a-a631-f10fa23df476", "comment": "Malware payload", "value": "20d81eac80589337dd22c8cb94aa5ad05d409ee35be15d621d69de05053ecef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248660, "uuid": "cd58b55b-ca6c-4383-8b12-e53f065cfc7d", "comment": "Malware payload", "value": "00cfe99bc6c6c089e9037cbf1cfd52118d069c05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248660, "uuid": "39c42004-81fe-4a09-98a5-b7187e4ab9e0", "comment": "Malware payload", "value": "6afb3b09fdc52c130a298425caaff2cee0845ff205f68a4814f6084089bce8c492cb3e82133a72e03bcc22b1114f8ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248660, "uuid": "54aceb41-9a3d-4213-98ab-3b085a77990d", "value": "T19F1501A4EE48D149EB75613097DB9EB2A63DACA0072900133C8DBC3AFDBD715B10BE55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248660, "uuid": "7c99503c-eb68-4756-a09f-d2ffd1fae502", "value": "932662637fdceef8177ab46381d851d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248660, "uuid": "b645a28f-f9fc-4163-bb8d-6a2628e5ba99", "value": "12288:7yV5pSa1q489syD+k6dOR1txSo52XjirPYE722+pIoMezxRp4DjY3ySNzWKqC1bf:6PyzHDF685Ao8zOy2+eoMezLvzWKNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248660, "uuid": "0ff3e986-8fd5-4e22-b4ee-2516a54a3458", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248660, "uuid": "8c55c51e-ca94-4586-a3e3-2fac29619a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248660, "uuid": "20ec33d2-3d1d-4fa6-96dc-fdd1e629187e", "value": "SecuriteInfo.com.PUA.Tool.PassSteel.10.721.4365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7e2f39-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268240, "uuid": "7be84572-db84-4465-83fb-c1b02c3d4e86", "comment": "Malware payload (Mirai)", "value": "954e3deebe9a4c80d0c77efd860c6ca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268240, "uuid": "14d1c16a-16fb-4391-8c42-f924f556ee4d", "comment": "Malware payload (Mirai)", "value": "20e4d5fc1151694a4c95b2798325c64a46ce55420f333b81a9ec8b3854314a3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268240, "uuid": "3179ef47-6755-4aab-89af-5bf94af9ab47", "comment": "Malware payload (Mirai)", "value": "a633575ae42112c567aa0374448fbfcd62793e53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268240, "uuid": "491240ad-2eb4-49b8-a8a7-47a4c46880b0", "comment": "Malware payload (Mirai)", "value": "b07270047e22f884d9b9d74f6f63a405505f711087fe733c530b779b26bb997a353f9dd902b478d6ea7a1e5f8e8a2a16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268240, "uuid": "99e64945-b270-4dc8-8526-5926a8ebaa3e", "value": "T178934A25B8391E27C0E4A17A21F7C712F2F1238D25B4862E3E710F4EBF656407956BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268240, "uuid": "b68fb7da-7c74-4701-9840-a48f07040be6", "value": "1536:RW+K+V0Sli9mz+W/uatkL2vGTQ4l9GXh75K4q2tjr:gUWmqlTVl0XhVKsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268240, "uuid": "c9a8e66e-9999-46d2-9a84-27195b5f68b8", "value": 91276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268240, "uuid": "267803ad-fb85-4681-84f1-99741d3b1e1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268240, "uuid": "619455a6-f1d7-4b59-8054-da80bc90d1c3", "value": "954e3deebe9a4c80d0c77efd860c6ca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab769aa7-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233933, "uuid": "88ec57a9-147f-4567-8a9b-e3cd5ae62389", "comment": "Malware payload (Mirai)", "value": "4661f9e1b1f00868e0346a256daa7bcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233933, "uuid": "c4aa6b45-c567-4e5e-bdcf-930d576021b7", "comment": "Malware payload (Mirai)", "value": "21416c50892e964857102820acdbb48b7fb435438daa9161f86270044f5bc8c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233933, "uuid": "1b8b7093-e885-46c5-b5d7-73d48c3801ad", "comment": "Malware payload (Mirai)", "value": "1c44bf124e70ed1475471ca8dff93c0f98a81688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233933, "uuid": "cc876a76-bf75-4058-8d2f-c193771a0acd", "comment": "Malware payload (Mirai)", "value": "d36758c8b550b04cba31cd900123dcedcb443cf7843308b0950f8ba468beb48876f31ceef432bdb31c42fbc581cb94c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233933, "uuid": "9d8bedc0-3347-4624-83e2-dc7cbb2382bd", "value": "T1B2532B46B9C29A16C6C423BBFE1E46CD771A63DCD2DF32539D216F1237CBA2A0927141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233933, "uuid": "79eb4b6c-4480-4a42-9bc9-627f537431d7", "value": "1536:UFpP9K2cNWHn1qSHYW94+8eRlu5XTRJHynHDuwZJq8pFMb3p+2:wNpckH1qdl6u5XlJ26Co0FMb3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233933, "uuid": "4d08f7f7-019e-4e27-8dc7-10c1c50fa9e7", "value": 66708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233933, "uuid": "1d307dbf-6be8-40e9-be66-b3a3b2afe3be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233933, "uuid": "e91eaee3-429d-4e8c-9f05-a2a6924a7f95", "value": "4661f9e1b1f00868e0346a256daa7bcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610642d2-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268167, "uuid": "4bd3746a-01cc-41e5-b18f-a977dc930326", "comment": "Malware payload (Mirai)", "value": "755cb234876a776aac51d6253ccd7f1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268167, "uuid": "445b581d-1247-406d-8ed1-62da7b3a1d62", "comment": "Malware payload (Mirai)", "value": "21a4a329c6f9bb7dd7f79955123a4ce72c95694f289f8031b73660008c3be608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268167, "uuid": "c89f6312-c64e-41e2-b725-b7e1c20b9652", "comment": "Malware payload (Mirai)", "value": "c49bd7d60ec5a2f027de2974568dcd33ad249046", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268167, "uuid": "cf1aad0b-919e-4669-a6f7-149f06f255be", "comment": "Malware payload (Mirai)", "value": "710cbc51aba48e78468e67905ed7d8270f92c4a2face0b723f524fd10c1d8a16d564e0c025b68f5d8a672a6b1da19355", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268167, "uuid": "404c6cd4-f1ce-46cf-88a9-252b563befca", "value": "T1B5535ED5F401EE7CF94BDABA82524A09F721732055A30F27B727FD936C320969D06D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268167, "uuid": "e6fd6fa0-050f-474c-83be-6932c82a93e3", "value": "1536:H8X8nYjkDdX4fiRe9Vn2RtFVG0ljse5BNzdD8V+:HRDdXgiIVnQLA63NBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268167, "uuid": "1011d23e-1284-42fe-a3dd-4a9512180ab8", "value": 63636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268167, "uuid": "281a877c-28a8-4e01-b444-e73ad07be359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268167, "uuid": "bb19197e-1519-454c-aafd-0fb72f16de12", "value": "755cb234876a776aac51d6253ccd7f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0142e532-fbf5-11ee-a120-42010a9c002e", "comment": "Malware payload (CrealStealer)", "timestamp": 1713274020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274020, "uuid": "1a5fd68c-2361-4998-96c8-9825ab263459", "comment": "Malware payload (CrealStealer)", "value": "8970451141430c26562d36432eaa8d75", "object_relation": "md5", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274020, "uuid": "642dd67f-767e-4f07-a272-89ef61e290ab", "comment": "Malware payload (CrealStealer)", "value": "21a9b4859121afcf6690c2c15b795094986c0a20c36a356c3915f107ec41f67a", "object_relation": "sha256", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274020, "uuid": "b0f28122-8fa3-4c4e-8750-1018a4f09f1b", "comment": "Malware payload (CrealStealer)", "value": "9a8a345b036b2b3a78bb811d2cd4b21d72afde0e", "object_relation": "sha1", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713274020, "uuid": "88d0fff1-bbbd-4d8a-8467-108e59f33096", "comment": "Malware payload (CrealStealer)", "value": "7f14f6e31ecddfe627e88f6fe11ff614e1d021e72a6818e663cbbbfe1af325b67c9eb75920afcc8ae159fcb698a3c49e", "object_relation": "sha3-384", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274020, "uuid": "77f88469-8efe-42dc-a7db-409b05587bb5", "value": "T1B707339573F16CBAC3D2413345238E666E72E8885B61DA4F13B812951F9F3A24D36F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274020, "uuid": "64239d6a-6b9d-40ca-b341-659ef262d049", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274020, "uuid": "95947eb0-ce9a-43a5-8225-f2dc06e626de", "value": "393216:GEkZgf8FgP8AxYDX1+TtIiFGuvB5IjWqn6eclz1PyxXUS+da:GRbFbX71QtIZS3ILn6ecHyV+da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713274020, "uuid": "39911abb-cb91-4aca-8149-b1729f07f9ad", "value": 17660698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713274020, "uuid": "75f2d323-1e89-4808-aac1-cae733d2f359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713274020, "uuid": "9b5c61bd-6b7a-46fe-acf4-2b3489c5c69c", "value": "SecuriteInfo.com.Python.Stealer.1447.10844.3562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772c25fa-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281948, "uuid": "804e0623-385a-4fd7-9087-1168ac963e9f", "comment": "Malware payload", "value": "c7487afe01ef1aa2cfbf60a5afc27a8a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281948, "uuid": "82048e66-6bb3-483f-a1ca-618e0618dc21", "comment": "Malware payload", "value": "21e858a5c9f9fc429019bc1e7e81191c3f70b4bfacc7275e44d8f09402442f80", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281948, "uuid": "9ed959f4-eed0-435d-96dd-98e412881f4e", "comment": "Malware payload", "value": "2ccf11ae534456c86cea13798bc0b32907b7f372", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281948, "uuid": "f5d3de8c-54d3-4bd8-8738-e92a57036e33", "comment": "Malware payload", "value": "17b124777205a81e8d5087bfc77505251c89fa6c2814d064c70d93885e9f088524def61b30be6db6dbb0a69de3d7f82b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281948, "uuid": "87639d3f-1520-4dee-8c04-3908b1c68658", "value": "T19DF15BDD5633302ED35C3639800035485B6432532F9B2A6F7231DAEB6EA77DA9B59A0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281948, "uuid": "f692d4d4-24b3-4565-aa16-159a83e3c71a", "value": "192:hg1SL9OV8vdQjmtK6lvNcQsYu+7jeo7DJ:hg1V8qmsyuQlu+/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281948, "uuid": "e51229e0-2c03-4278-bc34-04c61d74fc3e", "value": 7532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281948, "uuid": "52a68799-0161-4ee8-98c5-7b78b14084fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281948, "uuid": "fb26dbf3-7494-41f0-ae1b-ea27fe8a237e", "value": "TransactionSummary_206010200006576_310324101244.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f621538-fb8f-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1713230423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713230423, "uuid": "71826988-d16e-4f99-a5ef-edb2ca644c9d", "comment": "Malware payload (RustyStealer)", "value": "80556eef27f5fd1b98e5a3bddedf3348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713230423, "uuid": "95fcaecc-297c-48ab-b470-3524a4860757", "comment": "Malware payload (RustyStealer)", "value": "24de8de24001bc358c58aa946a28c545aaf9657b66bd5383c2d5a341c5d3c355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713230423, "uuid": "cb34583d-6c1e-406e-8576-2a16fe503163", "comment": "Malware payload (RustyStealer)", "value": "d33242c9662bf0e3b29958034d393893ffe90cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713230423, "uuid": "d0ef7966-8789-4f0f-a84d-0ada34a80bb0", "comment": "Malware payload (RustyStealer)", "value": "af7c05716d2145581ec1030b9d735230a2ac9b281deedb8e08341015e11231e6925ffc391a7fd0b0ee61a4e44984c7c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713230423, "uuid": "69721346-adf3-4664-8fe8-f9f785bb52b4", "value": "T1ABE47D07F69211BCC06BC17583576733BA73F84D4525BA6B47E08B302E69F50AB2EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713230423, "uuid": "f29f362f-77b8-4ac6-ab1e-7b3349bb88c7", "value": "5f9114057082199d8aba42fca85bfe9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713230423, "uuid": "416c0a5b-42d3-40c9-b867-be7a2108f5ea", "value": "12288:aSsa4fnphAI1N/ghWLJcK5t/EJrdyZpzZ90p3PqTY:ia4fphh1NLBgW90p34Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713230423, "uuid": "a941851b-1aca-4ced-ae39-afa7379c4fb0", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713230423, "uuid": "8f4bfe3d-c7b1-47c8-ba44-3f3c2a55ae09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713230423, "uuid": "40b77228-8857-4615-9cda-937c97598e62", "value": "locker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f070140-fbad-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713243334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243334, "uuid": "1be31b50-7977-45ff-b8de-be8513da7a1a", "comment": "Malware payload (AgentTesla)", "value": "b6e200695150b70c11faffbc3d5c30c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243334, "uuid": "d819fa97-f612-4dc7-8b38-971b77e619ab", "comment": "Malware payload (AgentTesla)", "value": "24e1635d9baec3de0506b2574420ccec046c903278316dfc461abb19b13b6de9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243334, "uuid": "cb7a4108-5420-478d-92d2-bdf4fb637a75", "comment": "Malware payload (AgentTesla)", "value": "17c4a1dbf6cb38aa3e65027505680be6994b114f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243334, "uuid": "ad7d4703-bb2e-412e-b7f6-55ced2032238", "comment": "Malware payload (AgentTesla)", "value": "7f1ec2af7c0a3f2b2d7095521f59e919245c30198e349cd36e466671583775df88763c69de02de5fcfe05fb27906d45a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243334, "uuid": "61696a9c-f5ef-43fc-9197-511dc1cab7e6", "value": "T1DF259DA16265137EDCBC44BCB02190B5CE66BC670616D4AE8CC13D9B3D79AE27470E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243334, "uuid": "676dd786-eb90-4a09-ad40-02808e0f9505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243334, "uuid": "4797cc5a-489b-4cc0-9597-a5470c568521", "value": "24576:q4NQ4PRNB5mcaNj/qcCt7gwMqU8xVtIj5QlW:NWNjycu7gwrxz25Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713243334, "uuid": "cb8403ef-04df-4aec-8cbf-04e13b4e2a9f", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713243334, "uuid": "5353aeaa-18e6-4bfd-99bf-9aff37e95265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243334, "uuid": "ec25130f-3720-4d32-b848-fb0a42cde8eb", "value": "Purchase#order10662324.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd3616b-fc15-11ee-a120-42010a9c002e", "comment": "Malware payload (VenomRAT)", "timestamp": 1713287815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287815, "uuid": "71dde802-894b-4b4d-a1d9-8e07fbec2b9a", "comment": "Malware payload (VenomRAT)", "value": "1813054fd92c59be0214e8f908d31155", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287815, "uuid": "69dc4d7f-9c00-4e28-a104-7b6f2ba2c3b8", "comment": "Malware payload (VenomRAT)", "value": "2522c6e717f20b29f38a73dc450a3ad748a14bbe86796429e50eaa672edd5d23", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287815, "uuid": "d754ee33-0df9-45fc-83c7-464b82268524", "comment": "Malware payload (VenomRAT)", "value": "3666af3fcd4dbf6d4881afb6e80841c87732569b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287815, "uuid": "26289c12-9963-4c86-9688-a31a98fb5155", "comment": "Malware payload (VenomRAT)", "value": "0ac218f63f09ae68b613fbceb512456a64d07889b2951009c70e308f55b03a2982520a7e6e61f15996f4b531583e3d60", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287815, "uuid": "3789ec3a-332e-4d29-a16d-deea860fc416", "value": "T111526DA953FBA9BE541061838CA908A34756D87F59113EC433C1EE9E250EEE8DE73C53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287815, "uuid": "23d31359-00d5-4659-88d3-7c5f6a6e445c", "value": "192:whpDrcs3f1bF0VXd5uQ45pj3PxFtjQp2QYw:wgefH0lC5pTRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713287815, "uuid": "eaafe756-17b0-4ab3-b10a-2c8919710a21", "value": 13225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713287815, "uuid": "cd86e39f-5056-44f0-a4a1-6e96fbf30abc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287815, "uuid": "5d07b6f8-3555-44a4-acd8-1927d1be1448", "value": "3.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e11905-fbbf-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713250830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250830, "uuid": "7b9e2004-33b0-46a3-8e23-cf9c11402966", "comment": "Malware payload (RemcosRAT)", "value": "28f01b474be6aeb345aaca18388a3ad6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250830, "uuid": "6cdef851-d76f-4cd8-975f-7c93fe87347a", "comment": "Malware payload (RemcosRAT)", "value": "2562b562a8f29256cf16403c893b482838edee61e631639c39a705237046d225", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250830, "uuid": "0d407a18-df74-48bc-a397-2f01325dffd5", "comment": "Malware payload (RemcosRAT)", "value": "ca62d1a84fc88a61ab5ec5162219f847ffd4ab70", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250830, "uuid": "636200cb-801d-4da2-a92a-020828f9f7ca", "comment": "Malware payload (RemcosRAT)", "value": "21aa3d3141e117c98e82ce2ae2a88c1e5117aed2093f938cac6a6ba23f9e89a81421224cbf57d8327c77fd7543a35398", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250830, "uuid": "19f61bdf-ba16-47f9-9ea9-3b68256b1345", "value": "T1E2739B6EE70F0964DF55977B434A4B4A06FCB33DB28500A139BC973437AD82E4A6297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250830, "uuid": "ff143732-485c-4d0a-b4bb-82e5a7c3ca5b", "value": "1536:OOE//90vZ4xj50yduAGFbN2ftcO1aWKW/H6yzAZF94BPU:S90Kxj50IuAeQft/1aWKW/ayAt4NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713250830, "uuid": "7a8299c0-4ec8-47c9-80f4-27a6b4dddffa", "value": 73565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713250830, "uuid": "8c1f7e3c-aa47-4ee8-81fe-ff041290d943", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250830, "uuid": "a115a420-34e7-4836-a609-910fcd32aa71", "value": "28f01b474be6aeb345aaca18388a3ad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3df604-fbb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713246604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246604, "uuid": "c7ca5e77-bb35-4f91-84ed-1fbdd201f976", "comment": "Malware payload (Mirai)", "value": "85e536cf8bb6d27515dbc967650f6068", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246604, "uuid": "89e5cd69-1f9a-450b-97bb-aeb5bf1cc30a", "comment": "Malware payload (Mirai)", "value": "25b219be4643ed698fd4e5267f0499129690a88bfccb1bbc5da66beea0493cfb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246604, "uuid": "7723bd43-3359-4495-bb9e-90e4602d572f", "comment": "Malware payload (Mirai)", "value": "71a283b9751d57f28ad458cec86e07de8bac73df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246604, "uuid": "f6fe8c5c-12bf-4003-8e6a-59f71028e8d0", "comment": "Malware payload (Mirai)", "value": "03c7a7edc202f115f0ea1931c83cd8cccde3775fddf03e2147d73fec941a598c90901205f644d2006c396c233175b4ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246604, "uuid": "239e1ea1-968b-4a9b-a410-a80ee6511439", "value": "T1FE147C86E762D9BBC48B077906DBA7354637E4A2031F4B02E31CAEF46D53291F585F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246604, "uuid": "eae6b5bd-bf4f-4b25-a1df-e12d98b446d2", "value": "3072:UpGYXSd6Lalu1z/MYexJ7ngjbaEMCvPvyHVByqqBky:VYzalu1z/MY8ngjbaxCvP6Hvk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713246604, "uuid": "0ee65ec7-f98c-4a6e-90fb-246c7e56b180", "value": 191979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713246604, "uuid": "9cc39084-3416-499c-abb9-581969b4c330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246604, "uuid": "ef192ab4-1d01-4612-8a09-5522b8fd5feb", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a27daaa-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302489, "uuid": "20b6d78e-16c4-466f-a171-9d920fc08dd3", "comment": "Malware payload (MarsStealer)", "value": "a189002dc2c26fe21a7d25d171e71699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302489, "uuid": "35663f77-734d-434d-8a37-2f98b6bdac59", "comment": "Malware payload (MarsStealer)", "value": "26838d9cf197e16a55066ad6fa480d510f249e587143c232cd2176f3f3785b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302489, "uuid": "13a6583d-ee90-4c7c-9517-79e14cb67748", "comment": "Malware payload (MarsStealer)", "value": "ee96ca8dfd8fa8e04754936b5a8205ed68869fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302489, "uuid": "6dea6f3a-8550-4e99-baef-b3f3dcf2689c", "comment": "Malware payload (MarsStealer)", "value": "64df991775d51d7b19172bf05f4881d6041335581da8b5a626b92bb3ccefa4b561b5f2a4257f8ebc9c355a70db879350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302489, "uuid": "9165db40-8431-4448-adfc-195794f7d2e2", "value": "T19AF3D0E950309A6EC5F06DBA9617B7B3EEBB1636462D8506A00D028D6DC20F76F36707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302489, "uuid": "be5fc225-e334-4d78-b503-5b451f1ff7f7", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302489, "uuid": "63a9131a-685a-44bf-9440-d7aaec772c75", "value": "3072:UDycF8HbhAn7VYm5YymnnPLIWEKwROlc/6RsjOUJSp8Bb8EG:ky5o7VYm5YymnPL+KwRWc/UsiI8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302489, "uuid": "267588c3-e97c-4680-a0a2-2c3ca41c0974", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302489, "uuid": "e3404320-7088-4867-8d77-fa475b06c905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302489, "uuid": "f2ebff51-af9e-490a-b6e2-d8ff343c9a96", "value": "26838d9cf197e16a55066ad6fa480d510f249e587143c232cd2176f3f3785b67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d3bdad-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713248659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248659, "uuid": "70e0a976-9138-4f5d-9151-c3e7e4b587bd", "comment": "Malware payload", "value": "f64f450c1b684e7815bed5a6741156a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248659, "uuid": "43bebf98-253a-4eed-ae8d-fc45e83ace01", "comment": "Malware payload", "value": "268d52ab0cb04c9f6f3f43bae951492bd3661e9c783b0eeb42cc2a640f0e2acb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248659, "uuid": "21b34852-4732-4ba0-860c-ade5e2c8ee4e", "comment": "Malware payload", "value": "16f9f0e989195b2ffea879ba8e1230d5e6577f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248659, "uuid": "d3bf29de-465e-4d09-b992-f05caafed5b0", "comment": "Malware payload", "value": "6a677a64909cdc7cc9cdb29a2d57bf0bdaaca85b9f43dc29304552cc683ff8b50a7b696ecdeb06583ccc65a524df693b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248659, "uuid": "ce401cc7-2c12-4785-95f5-f08eab8c7162", "value": "T1A095AF67B3814D37D95326309C0B87996921BF306E2859867BF93D0CAF3A7827835397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248659, "uuid": "e0ebcde2-182b-4f9a-9130-5f874978c846", "value": "24576:YdO2kboOuWDAXyrFIbW2l0uIUEnxTF5EPTIkxjdj+aTi+Vw8lL:4O2kFu1W5xMj7TiUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248659, "uuid": "931c45a7-4dcc-4810-9407-b01f1a72158c", "value": 1938432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248659, "uuid": "fd2d7842-bf54-4ba9-b97b-024289b7307a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248659, "uuid": "ac4bea27-b0a9-401f-b2ac-2345f3996ad2", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.10386.12214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffcf48a-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281587, "uuid": "38df2fd6-d16e-4ec9-b294-535e1fd84142", "comment": "Malware payload (GuLoader)", "value": "cc706991e70caa76595bf08fc59bc6a1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281587, "uuid": "2b801211-d73f-44dc-a50c-f6980aea7ccf", "comment": "Malware payload (GuLoader)", "value": "26b773de9b887b31c238e4baf440618acce9e0a277c3ebefd5e0c26f61a8e53c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281587, "uuid": "bfd29ae5-3d74-4208-b345-6725ffc52a18", "comment": "Malware payload (GuLoader)", "value": "1172135bb6eafef9633db0ae5f818366a1515e8a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281587, "uuid": "f5b2b481-a555-4db0-8bd7-c2377e5332e6", "comment": "Malware payload (GuLoader)", "value": "3a527efe4f736444f5275009ccd68d3ccaf27789f4e71a9861330c250ceeb1003ca01b5bc761d18a6b2eefb9c15bc5e2", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281587, "uuid": "08ae851f-3aa0-4763-810c-a294afa09409", "value": "T19D2408F09F0B36199F4B3EDAAC6445924AF48195051238B5AAD817EDB383D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281587, "uuid": "526097b0-ba55-4f29-985b-fb468196f7c8", "value": "6144:DYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfkqZD:A2dOB2mTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281587, "uuid": "3aa31c00-cb05-4779-a60c-bc376e2963c7", "value": 215670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281587, "uuid": "3e42ee5b-db0a-4782-a1bc-4cb47ba2f6f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281587, "uuid": "1af09567-d4f9-4701-87ab-23a61c3f00c1", "value": "RFQ183494.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745aabd0-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1713281944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281944, "uuid": "6bfa7a26-1682-4ab9-8df2-11032e7e1f53", "comment": "Malware payload (XWorm)", "value": "d4289e605bef1ea3f62eec4e11454044", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281944, "uuid": "a49cf016-a7ca-4b3b-8dd3-e31593843309", "comment": "Malware payload (XWorm)", "value": "270c995cf90e01ccc91f573c18955cf7730d5a217135dd297c91d474e33f8558", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281944, "uuid": "afb89621-dfa7-4704-ac4f-1128f6abf1dd", "comment": "Malware payload (XWorm)", "value": "9c7145cb5e1efcaf8c67f34e27dee2bbc518d54d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281944, "uuid": "ff931fc5-62c2-4bca-afbc-c3f45b6e6d50", "comment": "Malware payload (XWorm)", "value": "0224eede22c8565f2ea8b6bcc16ec9e4c0a6e512f7d3f3729a7c83ce00993b3b33a5cbedf8c7112d1adea8a946e34a4b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281944, "uuid": "e6b389a6-79e9-4bf9-9f72-248b7d321c3f", "value": "T1D0B3AB526BFA1208F5F77B88A97611340B37BD99A97DC64C05CC290D0FF3A848865BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281944, "uuid": "9770386c-cb6f-46c4-92cf-313ddd537482", "value": "3072:rQB02wBuU0W0tU1DHFUGmgURDFBe0tKl9CP4:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281944, "uuid": "34403ad9-eb88-4483-8a63-caf04b7b675d", "value": 110938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281944, "uuid": "c5c83908-64f1-4ab3-b167-e295679577ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281944, "uuid": "2e4b9187-23f6-4262-854a-4aa7dd760119", "value": "513616103509452909612589303471676534521900095585.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3abdf42-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233973, "uuid": "b677eecf-6206-4111-a1f6-e855e786b47d", "comment": "Malware payload (Mirai)", "value": "f3ef46ad97fae0ae679d7c58f53513e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233973, "uuid": "9b686ada-6884-4834-b744-f456e45c70b1", "comment": "Malware payload (Mirai)", "value": "27570f06a2b360b445f4f23063e65343154843037c21490046adbcba9256c62c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233973, "uuid": "f3025230-772b-4d72-9d72-2d41714fa8be", "comment": "Malware payload (Mirai)", "value": "00bb461ff5d00c9730f5dbcaaa5a325c4d88beb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233973, "uuid": "d3aaa00b-52d8-481e-a629-78a10cc137ab", "comment": "Malware payload (Mirai)", "value": "7a83463a104a6d97366f9718f27d19a8835610e9dc2a81d43194c0169b8ddc03fc79df20840d68e9660603144972e917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233973, "uuid": "5f04e801-29c8-484d-8f04-57929dfb2237", "value": "T11FB3718A7F503FFFE81ECD374194AB06119C99192295BFB76A78E408FA4610E49D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233973, "uuid": "04ac3c06-2363-490b-9ebe-696d63212138", "value": "1536:9LB+WvJ0i2bXfJRT8Il+GbDrAYWcElPc:9LBiXz8G+o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233973, "uuid": "ab4074ca-64ec-4703-a6d8-4b765fd02524", "value": 112084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233973, "uuid": "601f02d5-a693-4a23-ac88-ae809668e76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233973, "uuid": "add5b9f6-7ed4-4b9c-bf46-974d10801d3f", "value": "f3ef46ad97fae0ae679d7c58f53513e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96805a5a-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713281572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281572, "uuid": "793cf3cb-c021-4812-8036-397834cd719a", "comment": "Malware payload (Formbook)", "value": "4a6be1b6607a80a583ff05c2ed8908ef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281572, "uuid": "9f19bb31-87bc-4e27-9435-71b0273280c0", "comment": "Malware payload (Formbook)", "value": "27b8abaa4457130d3435ae7db4ae8049c48c50a700a535029ce1f8c621877579", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281572, "uuid": "41cc1304-7104-4e5c-b509-dced12358e08", "comment": "Malware payload (Formbook)", "value": "5073ceb6220c10c872b58d433c0d46994353af4e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281572, "uuid": "dbeb1065-60dd-4e9c-98a9-83dd663dbf24", "comment": "Malware payload (Formbook)", "value": "f4078a041e1282873ba6235f0ff2f7ce9aa9b2b2eacee120157f99c55e9881e4d8c0c97a62e4493a333bdbbe200588fc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281572, "uuid": "618a28af-69bb-468f-bb31-67c5d24fee65", "value": "T1C12419F0DF0B36199F4B3EDAAC6445928AF48195051238B5AAD817EDB283D2CE3FDD14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281572, "uuid": "a54161eb-506f-4cdf-8e01-607422fe3305", "value": "6144:lYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf6q6I:e2dOUB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281572, "uuid": "be762a36-78f0-4811-bbae-1149a04bb90d", "value": 215422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281572, "uuid": "c244ca46-2f8a-4f1f-b35c-e65a007a7674", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281572, "uuid": "bb7255a0-65ba-4562-80ae-d8f3c6dbe773", "value": "Nueva lista de pedidos Green Valley Corp.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d89e42-fbe8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268576, "uuid": "26fd3995-086f-4ff8-a225-be3c1829b415", "comment": "Malware payload (Mirai)", "value": "362b760141ac8e22dabe55cc65e2e598", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268576, "uuid": "f9d3753a-9242-4b67-976d-a1ed524a711f", "comment": "Malware payload (Mirai)", "value": "2c0f0b2616d7e56f5f82d05e35d28be44d1187ccab83e62dcfe1a82569198817", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268576, "uuid": "3f12487b-4231-47c9-a8d3-6c95f9b3be52", "comment": "Malware payload (Mirai)", "value": "00f554b3dcdc377f5ddd96a3b684685dfb9f683b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268576, "uuid": "a524cefb-ace6-4149-b468-d5313058abce", "comment": "Malware payload (Mirai)", "value": "8f83da771c309c0ef4f1f167a0bd123d97ab5d7ac5004de3838c0306d05ce99d301f247aec2b479452e093c2a7c93560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268576, "uuid": "e0237ead-1c7c-48f6-bad0-778f6ee3220a", "value": "T127B3B40ABF611FF7E8ABDD3745EA1B09249D510B21A87B75B930D818F25B60F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268576, "uuid": "b810bd32-91a3-4c1e-ac8b-c60d8e26627b", "value": "1536:sAcC99ax1OOEEXz4ZnMiNj7GY7GmFPCQvGgscOYgtZ8Tm:sZC99axQObiMiBogscO9om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268576, "uuid": "6c477c67-abb7-49f7-9a91-292c66e5c1d8", "value": 108964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268576, "uuid": "622aba09-d807-4461-a76e-dde9d0ea2b31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268576, "uuid": "5ee4b925-c9eb-4d80-a426-a1da3b6b40f6", "value": "362b760141ac8e22dabe55cc65e2e598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003a69d3-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248248, "uuid": "4821f350-8f07-47f3-86f7-d0eaff899d62", "comment": "Malware payload (Mirai)", "value": "481a199798d212874352911fb3888d2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248248, "uuid": "78b12718-cb67-44ae-b73a-6994b15b77ea", "comment": "Malware payload (Mirai)", "value": "2da6ee615336b3f75a07ef209ced3c4f14139143cb67dc2527814aa3241138e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248248, "uuid": "9c0ea167-1a96-4aef-a536-393f0a656fd9", "comment": "Malware payload (Mirai)", "value": "e9c5c71fe933d307edcee82aa753bf40cecee58b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248248, "uuid": "0dc44bb4-76da-4b9c-bb5c-a0a889b6a63f", "comment": "Malware payload (Mirai)", "value": "6433cf1c82041706723c0feca2f00fc006914e8394d9d6e8a51539df3e003fb0178f3af50fa4b0ea11d892fad16847f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248248, "uuid": "befec2b5-24cb-400e-9c89-fc49883f399e", "value": "T17BE31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248248, "uuid": "fab7f4fb-e0b7-47e6-b7d1-c140dca9be83", "value": "3072:Z41HOuaGVV3NfHUOjqylXqCw3jkmhxQwoVZUNu:Ze3aGVVdqylXq1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248248, "uuid": "0d6cf9a4-9844-403a-a802-3d9708c0674d", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248248, "uuid": "1592dec7-9462-4a99-b753-9650535c9af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248248, "uuid": "8abb0733-e51e-4418-8e14-00d55f419651", "value": "481a199798d212874352911fb3888d2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3f816f-fbb0-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1713244777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244777, "uuid": "52713aa3-62ee-4483-b790-8bfc3ad16b07", "comment": "Malware payload (Adware.Generic)", "value": "2b8f2424eea5bb8731c9edc9836bf8a9", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244777, "uuid": "ee2a61fd-95e4-4f4a-8249-67441831405b", "comment": "Malware payload (Adware.Generic)", "value": "2e7cfff76b92ee24139553e557d11bb3f5854ec6b822b1f894e784a3ab49a895", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244777, "uuid": "041a0899-daff-4367-adc4-e9fc49075ad5", "comment": "Malware payload (Adware.Generic)", "value": "a5ee52bb1d6c17d80310d84f351bd7354a557df6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244777, "uuid": "08b151df-f03c-405c-8781-d6ff1e6c4650", "comment": "Malware payload (Adware.Generic)", "value": "8b0c3257f49f6f80372287bf3726323db57f0f4566e23fcf1a690a589def59232ea22038b38b7e8ba6eb6d955ed75335", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244777, "uuid": "b648c621-0ae3-487a-988e-f4816a9fb11a", "value": "T1A626F02AFD54502DE4DE0E72657F56109777AFB56A0A8B0A03EF3408CFFB4A01F2A546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244777, "uuid": "5db60816-34b5-4206-a2b6-4b13a3670021", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244777, "uuid": "6554537c-0522-45db-b1af-c748f512f2bc", "value": "98304:qkLN+lMhjiiitZY6O4cr7xjxvEfTNSnKxXblXnmATLR8PBiO:l4lEkt+/lpUTpLNnRiBiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713244777, "uuid": "dbb51a72-dac5-47b9-8749-271226a3bebc", "value": 4726912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713244777, "uuid": "3236ccaf-63c7-450c-a6ed-4641778329ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244777, "uuid": "25b82c8f-813b-4446-839c-2531e441183b", "value": "SecuriteInfo.com.Program.Unwanted.5508.2103.29535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6665538-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265385, "uuid": "8d05b8a5-2722-47e1-a1e0-361084f9754e", "comment": "Malware payload (Mirai)", "value": "371ba5f5a4933067527e44d4ddc4da29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265385, "uuid": "d720c38b-9a17-4a62-8c01-e086779aeb81", "comment": "Malware payload (Mirai)", "value": "2ec7fea584e09e36e05525462bdd5602db4c0395bf7c8afc4721a4c21caed11d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265385, "uuid": "2b54bef6-991b-47c5-8452-3be8fb2ff63d", "comment": "Malware payload (Mirai)", "value": "57115b4979bfc2bc3cc5aeb4e87ca5d83e955fe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265385, "uuid": "5f87b541-6f61-4cd2-8308-1b6d590fc594", "comment": "Malware payload (Mirai)", "value": "5b10783418468ab96cac28005d82d25d4b296c7a0a26b60f3bb2cdeb07a7819862ce6d0e7d3ecedc6a86de1d4b52075a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265385, "uuid": "9b4d683a-7e63-4dc8-bceb-991bdc399609", "value": "T126E3176277B60A27C0E0A579B1F75733B2B947C514A8C60B3FA11D8D6FA95903213BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265385, "uuid": "3a958210-4242-4244-927c-72936b1aa93e", "value": "1536:kUieDQLDy+duZ1cKyayi2z/lz2XjzhtVTMNH+wiCCLHtvqyTysGrio6zOuO:adU0N+pXAp+dBqyFo4Or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265385, "uuid": "b8cbe37f-aaa7-4afb-bb48-f72566c5ff39", "value": 150888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265385, "uuid": "3c0ca66c-1880-45bd-a662-9340bc9f0f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265385, "uuid": "6caddcfa-b89b-40ea-8227-5f3cf17d29f7", "value": "371ba5f5a4933067527e44d4ddc4da29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ccbcc8-fbef-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713271798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713271798, "uuid": "63bf76b0-2e50-4f32-8443-1c10ec10dfad", "comment": "Malware payload (AgentTesla)", "value": "63afe391178cb8bf14d24d2d569dbc51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713271798, "uuid": "0dc13bc3-712b-42cb-9015-5b08d95b4f42", "comment": "Malware payload (AgentTesla)", "value": "2fa2f6f81dc805b509157ff73570ef9fd921cc0b73bece828000356c926546a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713271798, "uuid": "f667b636-c966-413e-a3f4-f0d4a9128d4b", "comment": "Malware payload (AgentTesla)", "value": "477c0cea3777ec0e4e98eba78dd81b72f12af8f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713271798, "uuid": "8c018a20-c08b-4910-8da1-3423882e427d", "comment": "Malware payload (AgentTesla)", "value": "13a957bcba14a3dd154afc300630e4cdbc1094d864755b32a1a8e70092a4bfaad1540185311e8cc0b30109b24870dacb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713271798, "uuid": "32f213fd-4cb5-4d22-9e49-18766d2932c0", "value": "T157F4F1285AFB6F2BD5BE07F64622192407F1609F74B5E25F0FCA20D52A61BC60D91B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713271798, "uuid": "79b78923-89dd-4a3d-9d72-a9361d6c10cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713271798, "uuid": "09695ca0-3979-4b91-ad08-aab201bd0476", "value": "12288:Wp2IEA/HPL374emD+biF/cQ5zLYsC+1BViX1j4bSVlxVlIi014bFZsyWFcw:OPDdmDZ/cQ91pBViFjXlN9FZsy6cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713271798, "uuid": "af16625c-bba7-4705-92cd-e3370a86a23c", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713271798, "uuid": "bfdc4274-1f45-45c7-9782-18d0607d6df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713271798, "uuid": "0fc14dd0-5515-4d5a-a243-4b066f202a98", "value": "#568350035791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b49a338-fbff-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713278385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278385, "uuid": "4482a6c5-b0e7-4fa2-8705-fea343508f8b", "comment": "Malware payload (Mirai)", "value": "bf92638a4ade2c509fe5b940ce140d84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278385, "uuid": "98406b86-dd18-4177-b760-2441691a2ea8", "comment": "Malware payload (Mirai)", "value": "2fd1457366dde5031209a9bb074b1fe051fd6776d40e61ab325931271b29f212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278385, "uuid": "bc56b441-e406-4a58-8e84-1d6cb646154d", "comment": "Malware payload (Mirai)", "value": "a9b873a5eabde160a2ddbe3949953d73da6e8d4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278385, "uuid": "7f3dcc5e-f46e-4a0c-80ea-6ad5dca165aa", "comment": "Malware payload (Mirai)", "value": "ccb5a889b5be0f02c77bc1fb981e611dce3beb5749e5293cc25420e918373006ee469808579a7573e56e65dfb72c6b73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278385, "uuid": "35534fd2-8f90-4063-9f1b-9eb66d3ba91c", "value": "T14CD2D01E5B46B9F3E896D9B3C4A603912FAD8FE18853CC891658E1E05D406BDF07BBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278385, "uuid": "b59a6cc6-2cba-460f-ab53-583c40c9412e", "value": "768:MIzjdYIOOlWGySMgSjloSJVareQgu21WgKJgGlzDpUYsR:dzjNdlWGy6YXVgeQgu28guVqYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713278385, "uuid": "32644183-ad87-4aa6-8a9f-5fba4d99914a", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713278385, "uuid": "4492f304-a7f8-4f5c-bdb0-4d0797e14f33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278385, "uuid": "a7919b49-cdcc-49e7-9dc9-ab09bd365630", "value": "SecuriteInfo.com.Linux.Siggen.9999.11621.28071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe20e255-fbbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Phorpiex)", "timestamp": 1713250822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250822, "uuid": "c1edd007-b73d-4a7d-9071-6280ecd979d4", "comment": "Malware payload (Phorpiex)", "value": "f4355af73c2dd6e8eb69f29570431f6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250822, "uuid": "f147bdb4-01c3-49ac-83da-f7e424194920", "comment": "Malware payload (Phorpiex)", "value": "31be31131a00b743ea598caf706b7c08703d98c3b90aed0523a0aace6ebe318c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250822, "uuid": "fac297d5-ab9b-4d6b-a909-ef30383ff688", "comment": "Malware payload (Phorpiex)", "value": "a0ba95d51d98fd602ab29531a7b0695496657a74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250822, "uuid": "ec25571d-a118-4486-8ea4-cc8bb7f839bf", "comment": "Malware payload (Phorpiex)", "value": "3cf639ebc8f5ec691cc5b21f9afb882fa000a0fd1b27271df7fc4261499712d518ab519185591e6787908457b307568c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250822, "uuid": "fbaf063a-075b-4627-af72-024fdb2812ca", "value": "T1D3921906A95A539BE836187063B31D25A079BE72631D85CFFB8005791270EE4FA3334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250822, "uuid": "03ed8b32-2561-4384-b8bd-2c2c0d7abaf7", "value": "fb0ee5bafbb99ce467989526f0be15c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250822, "uuid": "b7b6b3c4-fb27-4c42-8993-fa6b40fe00f7", "value": "384:4QpiPUjq7B0CiUAxIAtlYxJ4JVB00/XMSKRC:uPUu7cUyTYOv/X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713250822, "uuid": "a0e73f4b-3357-4dac-a4a5-2d479b67e5d2", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713250822, "uuid": "ca09d75a-1cce-41d6-ab24-4efcfd48ef8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250822, "uuid": "3f5c56aa-8b6a-41a4-9e52-0c6025a6a32d", "value": "f4355af73c2dd6e8eb69f29570431f6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce4ae24-fbed-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1713270925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270925, "uuid": "b8cfffaf-58c7-4c13-a9c7-b3997ac6cec2", "comment": "Malware payload (DBatLoader)", "value": "b3d2c19596308cc99a284f7f4f95048c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270925, "uuid": "a07def8c-6ddf-482c-b7e8-db8d4ba8d2db", "comment": "Malware payload (DBatLoader)", "value": "322c05c9ae509f7ee9be1059a1521514477020a48bae213f077058ce75442b36", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270925, "uuid": "72976527-1e31-462c-a569-7ef3d381d740", "comment": "Malware payload (DBatLoader)", "value": "a58413b0c63aad48a7e6df7dd77aafbb40d5742e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270925, "uuid": "14e55f10-3d87-40c9-94d1-ae363c82095c", "comment": "Malware payload (DBatLoader)", "value": "735589488c78cf424a57f900bf76d415d7eb4bd403e53efe3b2c080460c44ab94a13e91e30131c16ab2a55d4a15a56dd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270925, "uuid": "e2743e2e-a5e9-4e44-8301-f57fce69da68", "value": "T130F4230BEB35137F4087179986ACA3DEB89F84F8116EE51F887E9819F449C320A2771D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270925, "uuid": "d24cb3b9-69dc-4e38-9681-804dcf321987", "value": "12288:lrvyCKOE393oSBZZEix8953FMUSziWRMxyhgRts+jfwCl/HY9ByjdipEOdq14bGL:5ytOE393TZEu87rERMxyKtnHYPys5qO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713270925, "uuid": "229cf77d-ea61-49b2-8372-820c4b898bcb", "value": 743460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713270925, "uuid": "85f38735-9b3f-4820-9587-69fbfb1e9f76", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270925, "uuid": "9e141afe-58f6-4ad0-863c-b5bbe801d1e0", "value": "20240416-703661.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561a0bf0-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302509, "uuid": "f0b60c15-be14-421f-9141-4c1991ed7a53", "comment": "Malware payload (MarsStealer)", "value": "ba6e7e1e9161199cda53984e8797add7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302509, "uuid": "6f0e718b-1a5e-4cbc-b124-a4b1e7a003c7", "comment": "Malware payload (MarsStealer)", "value": "32429b9055e49788020d2baccfd472075a26cbdd1c70d0693150cdf963975775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302509, "uuid": "fc89071d-b095-4433-9ea5-34795e61fdb4", "comment": "Malware payload (MarsStealer)", "value": "c4ad796a18ffab0ef5f7df1a0db302114a4826d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302509, "uuid": "cabffb39-97ff-4d96-a03d-0f5503e2002d", "comment": "Malware payload (MarsStealer)", "value": "4abc01916c179d55e1eaaf9e21c4ff70816549574138bff53da389dc6448a150c4d152fd42042ae0d2c3608c818955fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302509, "uuid": "3cf5f8ad-bc06-403f-9eed-f0c57e75cedc", "value": "T1B9D48E2439EB5019F273AF796FD5B8F6E91FBB733A02241A10510B8A2B23D42DDD1539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302509, "uuid": "734d0662-5753-46b3-98d9-252e035b271e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302509, "uuid": "dd74095e-b81c-478c-ac5b-e3037a11b89c", "value": "12288:K5XTI5PwjN7SJxjHhXXBVDgIQ7JMKjK5+GbKGvOs2JCo/bSJBoFnCMX6k:KppbjjaatFKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302509, "uuid": "2aabe4f0-751a-452a-bde5-a86addf47027", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302509, "uuid": "6ff2c318-988c-43cb-8893-95a1b50e8c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302509, "uuid": "7bf89208-e913-41a8-b9f1-2f32939c95fb", "value": "32429b9055e49788020d2baccfd472075a26cbdd1c70d0693150cdf963975775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e906896-fc09-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713282847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282847, "uuid": "b0582042-5f4f-431f-b332-6041600af96a", "comment": "Malware payload", "value": "61c7dc2acfea864ad45b2a4fa8b1bb5c", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282847, "uuid": "d8ebbefc-4555-42e0-870f-deee7d51f299", "comment": "Malware payload", "value": "326f2caac45fb3fd8aeb65f3c70105bce862022c2e30de367ebf9fbb77d1abce", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282847, "uuid": "123732b6-44cc-4805-854f-be7b16794a89", "comment": "Malware payload", "value": "73fb54808cd83f946cb618513f4c2f969f85b347", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282847, "uuid": "a04e7212-6246-46e3-bd90-d9446e83774b", "comment": "Malware payload", "value": "15d323bc4cd136aaec6e33e06be17942391aa67ef8ea84cdc93818c0947822284a734f79ea30bf2fb51face8ccb4d5c7", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282847, "uuid": "804294fa-065a-40b7-9e6f-dc05adb270cd", "value": "T16FE229487B948222E6EF6FF128F351050374D517D923EFAE0CE485EA6B67AC186407F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282847, "uuid": "236052ba-c269-4fe2-9696-d76c82c5b46b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282847, "uuid": "f59fa168-cd15-43a4-9a74-545384b955ab", "value": "384:oAV3W8+h/ghVYLcKnLTL93ZFsLcvSAOokFRApkFTBLTsOZwpGN2v99IkuisTH6x7:u8eFZ393HJvlYFVF89j/OjhBbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713282847, "uuid": "b56c359a-22cc-42dc-a0d3-e4eec4fbd6f6", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713282847, "uuid": "ec7c934e-36c8-4dac-8be5-c0f096a7be3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282847, "uuid": "3c89b92c-a3bd-493a-885b-204cf2bd9790", "value": "171328284503097ec9167b4bcb20655c248cb3019cdc3966ecccf11a86ab7ad3192e8a9a17121.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d620ec-fbc6-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713253997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253997, "uuid": "83d6b249-a749-431a-afec-91698216e75f", "comment": "Malware payload (Mirai)", "value": "14b2963b00a1183d0490f1bdf05e9468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253997, "uuid": "c3705b48-488a-4ea7-834a-12eba94190f2", "comment": "Malware payload (Mirai)", "value": "329b7b203886a1313c7b183331ffa36732671443ad14dbd782dd0b515ea1a567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253997, "uuid": "c99b4183-26cc-41bd-9001-2cae0351dabe", "comment": "Malware payload (Mirai)", "value": "997816b5615c48c5f08a0163374857e6accb127c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253997, "uuid": "4866b257-c8a7-45c0-a3af-ac1f9ff39e16", "comment": "Malware payload (Mirai)", "value": "6ac99431dee593c0dd7c48416873b992ced1d6e12062375c7068b2f6922899bd210205b6a90caa40d4ef55d40950de37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253997, "uuid": "2415eb36-1483-47f1-a0c6-e2423b82ba8e", "value": "T1C2438E77C829BD84C4458AB4BC358EF41F53F00482679EBB1999C6664087E7CFA463FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253997, "uuid": "75ecb180-f022-45da-a7d9-74420e1a63ae", "value": "768:crp4mwyCvey4tCyHvkLUhHbcG2CCu7fKjF5pamzoOzm0Kz5CgqGxWfW7xFO9I:crWbvF4/vkqbt59KjF5EmEOmFCglNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253997, "uuid": "d71da76c-4145-4547-a3ed-c0bc5aef051d", "value": 60236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253997, "uuid": "fd108915-f154-4b37-b99b-e02c1559b7fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253997, "uuid": "79a4d8bb-6777-4524-9e3e-b65311ca1af2", "value": "14b2963b00a1183d0490f1bdf05e9468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6d50ee-fbc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713252730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252730, "uuid": "ce46e56f-d741-47be-ba5a-cdc7a4f420cc", "comment": "Malware payload (AgentTesla)", "value": "935091d7c79381d402d30372962335d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252730, "uuid": "517b5ce0-0f35-4972-a4c6-60c1c3bc4df2", "comment": "Malware payload (AgentTesla)", "value": "333092f6705f7e8dd3923aa886e1ea495257fa4b57a02fbead9bc5a2e9fe74b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252730, "uuid": "133cdc8f-51d6-4efc-905e-47b29d04da66", "comment": "Malware payload (AgentTesla)", "value": "e9a380a4d44172684033bf9fd846c6bdf56ffe06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252730, "uuid": "67ab8dff-fedc-4cfa-b22e-a4c91daffcbe", "comment": "Malware payload (AgentTesla)", "value": "696b413088ed496b240191427de845336f70ff56074286d2b89bbbba778c207e988c0c7f1ede19705b0e629f3b226fe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252730, "uuid": "0f5c1c44-23a6-4813-8f0a-61a9a2fd6ed9", "value": "T14334FE037E48EB15E1A87E3782EF6C2413B2B4C71633C60B6F49AF9624516925C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252730, "uuid": "bfb1707a-9b94-4176-b8ca-464782f7a998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252730, "uuid": "c50c8d61-ba97-4697-a575-03fe54f9069b", "value": "3072:WUapN5VZmVSJF5iDt6coCvLbDVv52EsvBV:WUapN5VZmVmbiEazXVjsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713252730, "uuid": "6c9bbb94-c089-4c32-8930-dec5bf72dd08", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713252730, "uuid": "923370b7-899e-41bb-a203-3010a09def77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252730, "uuid": "ecd9a098-af00-4927-a0b0-bdde2eb452b6", "value": "1713252728d0778b270721e7a662a1a17f7505d0149a8cc6f803a15e21ab507860d90a8e63378.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835dbb56-fc39-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713303444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713303444, "uuid": "b24cc3da-7658-4982-aa67-24845937ae91", "comment": "Malware payload", "value": "e36ddb8aa278d4429714c9d8dc7e1920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713303444, "uuid": "f08b341a-8bca-4a5b-a22d-4c0f7122b920", "comment": "Malware payload", "value": "3356b512fb6f3c64c923fb65721a807514d047b84239b57607e804b7e3a18cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713303444, "uuid": "1bb91fec-c5e8-4931-974c-a720d7eb8968", "comment": "Malware payload", "value": "8b246da504dd30f548228fba16c594bd7ea45ab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713303444, "uuid": "86b82f06-8a6b-4b37-973c-2dbab1f23a84", "comment": "Malware payload", "value": "6a4a83aa7c00eb298279db6f7525753ab3a93ea5d678b8ce38a9e2c0a5bd72a254bb1aa73699d6f1d93e5cd9cb437bd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713303444, "uuid": "20830a68-213b-4f37-8bd2-b41207c5840d", "value": "T198F3AE1235D2C8B3C57741331485EA99AAB6F5709FB58E5333AD038D2F523C0A77A2DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713303444, "uuid": "abb78d80-cbf0-41ea-9ff6-67bf305173d5", "value": "1bbf6b8bec1bf789db20fe160a82563b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713303444, "uuid": "dfc6998d-bb79-42b5-b185-7e52cfd00774", "value": "1536:oKfCtcYqHPTI/funkR5Ab62i1LijgT7TnqxEMt+IOEnToIfp/7DFt645PgICyO8I:oK6+FTI5ipiFosoTBfpjDFt6GIB8o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713303444, "uuid": "7e1704b6-b906-4970-8710-9ee9808ccc2f", "value": 168864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713303444, "uuid": "fc69b596-2972-4fd4-948c-000a1e4d01d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713303444, "uuid": "223d2a8f-fac1-41f1-8c86-7de04e48229d", "value": "SecuriteInfo.com.Trojan.Ymacco.24259.31491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9172fc5a-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713256223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256223, "uuid": "c60cff01-1c77-41dd-8849-f79869d8efca", "comment": "Malware payload (Neshta)", "value": "28677859e6db52bbc82dbaecb6e39409", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256223, "uuid": "3b14825f-8cba-4a3b-af30-5ce6f52f10a7", "comment": "Malware payload (Neshta)", "value": "345c9e1d0f7acf8e08d4831daacc56a1c8c57299c75895fb0783c891750eb509", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256223, "uuid": "727fd474-1373-437a-bbfd-56ad90643ae5", "comment": "Malware payload (Neshta)", "value": "491376323b2f34e783733ff80b8452876255d908", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256223, "uuid": "64c53870-04b5-4cf8-ab38-dbac3c0dc8c3", "comment": "Malware payload (Neshta)", "value": "24410e4e29f6d57d0ba09784726dde83341fa67629b83b643007d4a8dced58e333c1264fa41c34fc75549e8345f2e86e", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256223, "uuid": "ee994321-cf75-40b5-98da-8c5586e9e59c", "value": "T1EEE433260EEC2408B655EEAB264F7869DC7B56C679FCCACC604630B398B09F063559D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256223, "uuid": "1bbb09e8-089d-4fcc-b7b8-9e7465360a53", "value": "12288:zZKhTguqVj+tioje+FuYYJXJAjx98yIEpIxVE79vLh42+UGcyRhzIJ3r:tYTguqV+c6FuFBJon8JEpIxVE7oXdgJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256223, "uuid": "db1ae4c2-2854-4139-9bdc-775f48a6ea9f", "value": 697718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256223, "uuid": "52c4c87b-10ac-4f42-8092-fe09c8203dfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256223, "uuid": "cdcb6454-57f5-46e8-909d-fb0df4f47b6b", "value": "PO0130717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45949485-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256954, "uuid": "4c183717-6f3e-4a24-b9d9-16625cb5f917", "comment": "Malware payload (Gafgyt)", "value": "474828e048b3061bacf8b802d013de8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256954, "uuid": "8aac735a-ca9a-4329-8b74-d07d7455862c", "comment": "Malware payload (Gafgyt)", "value": "352f7a64d262e12561a22d0ffa52627b36eb5b68cbfade99d4f93e80807b0c43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256954, "uuid": "a06d0abe-68e6-46c4-847c-ef6fe9672dbf", "comment": "Malware payload (Gafgyt)", "value": "8c9ceb20fad152875c5dd4206c367e18c8f91879", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256954, "uuid": "4e9bdd08-17c7-4dba-b9a8-225fc20fcc9b", "comment": "Malware payload (Gafgyt)", "value": "a04a31570f93661a10d10071e1fdd82610e30c1a2ed3f42f5fb3bbeb1ccc95cbd9ebf880ecbba8269429e53ac7cf33ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256954, "uuid": "6c36b14a-365b-434e-8d1a-b99ef572e778", "value": "T12DF31824F5408267C2D327FAA69E838D3F3557E223D733145A389FB02FC2B952D66964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256954, "uuid": "cd33df79-6aad-4063-a938-81b511472978", "value": "3072:Bdy8WoZkeDGOvvlIAFZ3U5c0xkuQn3f5h1X7cKUmSQnNbGUBn:bZv9KBxkuQ3f5h1X7xUmSQnNbGUBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256954, "uuid": "e8f4b91c-0ae5-458f-9e18-e827227e4ac7", "value": 171215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256954, "uuid": "97ba2527-1e2c-4dd1-ac9c-b59cbee2645d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256954, "uuid": "e0ccc7e7-4c47-402f-811b-ab7a85a5981d", "value": "474828e048b3061bacf8b802d013de8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8050309-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713248664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248664, "uuid": "23a1a7ee-f1e4-4b81-b0cf-c6130629fb64", "comment": "Malware payload", "value": "8b5e7324fc594e072811e657cd84e61a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248664, "uuid": "c115c365-f836-436c-8ef7-236ddfa273d3", "comment": "Malware payload", "value": "35f30d1b2031f1c9a348b80ec5d211482ca80d99d1124c6c1805efdcbda486ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248664, "uuid": "a8d126b4-bd26-472c-bb51-48dd11d9d033", "comment": "Malware payload", "value": "e7b9ecd7dcc98e4c5de0f2a329f10d0907fe0b8c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248664, "uuid": "943777dc-64a4-46e8-b6b8-5b31cedd5276", "comment": "Malware payload", "value": "79d2b9c847478f4bca884d7d4b83dd01b4c16d611a91594c5029fd7b65b8179992f7a78948e05b9f52f71351fc6c5918", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248664, "uuid": "af7d90bf-e5b0-4aab-bc56-cc0b1d3df03c", "value": "T1C7047C1171E0C4B7C1DD413D0A17B725A3BEAF60DDA14A13AB647BCE5D321829E1AE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248664, "uuid": "eae8a312-d27f-4651-975c-60f645cd9707", "value": "3c6f3b56c52588f777d09adbf63850c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248664, "uuid": "530492e0-8500-41cc-a59e-baed6c9be57f", "value": "1536:8NNZ7zBgOTRpq/BRN+ukujQUPBxlrBSktYmBioA5H7eedjPpXPn1MFCvJgZP1aGD:itgMIBZ75htWoA5HyIjPpREPgGB/POb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248664, "uuid": "50f2cda2-d583-4025-8d98-ecb617193d83", "value": 184908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248664, "uuid": "f5db1396-2371-4775-be13-f39a3549e6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248664, "uuid": "5c586475-8006-4133-8a0a-3d851ce7481a", "value": "SecuriteInfo.com.Variant.Mikey.164567.16975.11601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ce31f1-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281631, "uuid": "2018c15b-21dc-437f-9baa-f2ba0475fead", "comment": "Malware payload", "value": "c1c96a931853a718ab9175cf413516ae", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281631, "uuid": "eb5b509b-12df-4bcc-90d1-e30e14faf528", "comment": "Malware payload", "value": "3642c953da7b2d1c9d38ab27ae9e16b0e81d55f0eb48d39e09eb9e865d2437fb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281631, "uuid": "f403819a-dc78-46ec-9c0c-07393a565ebd", "comment": "Malware payload", "value": "37cfe1d86559edc234bc0e89e0b2752b614a5393", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281631, "uuid": "81c3cebe-5ead-459b-b1db-ee4f0628176c", "comment": "Malware payload", "value": "2430caf3fcda76860bb83c68cf23f160c81796ed90118ae5b3e8e9302d1593e6de902a5a647109a894506a6bf46ba298", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281631, "uuid": "2eaa0027-7057-474c-a65a-e144f4a4e42b", "value": "T15CB4123F7FAAF17CD007A53019488AA5EB0D522DC055925FB1DC18592E3498EAB13EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281631, "uuid": "483cba8d-58f4-4c32-82be-d40c27537842", "value": "12288:bxKaeyL6Xw9uwSL6d/soKMFhyngUYiTf5kVG6a:bvtWAbSL6d3KMagu6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281631, "uuid": "859b9ce6-ab56-4e87-b003-4a647963d30e", "value": 533588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281631, "uuid": "b6ca157a-9add-4e0d-abf4-2a4adb029773", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281631, "uuid": "e218dafa-5b3e-4c97-ab5f-906499756eab", "value": "CS TSA Inv-90071894202300415 jpg.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe1fa15-fbc3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713252912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252912, "uuid": "b68c8b05-50ef-4a4a-80e0-700178be9fe5", "comment": "Malware payload", "value": "8213f49384e2e9b5b5b1b8e86c83fad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252912, "uuid": "e08d87d5-b149-4acd-9066-f341da0abf42", "comment": "Malware payload", "value": "366979ca5121a7ccc6e8d8b0031683a333893743c0cd6b95b26d71fd00efbb1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252912, "uuid": "261b292e-aa45-4746-8edc-83b76b3805e2", "comment": "Malware payload", "value": "c2ab8fbbb872a8a0e41586366e7ce106401f8b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252912, "uuid": "7f34cc04-477f-486e-a960-369869775adb", "comment": "Malware payload", "value": "26f684efa69b0183e759de8a570afd074ea28fbe30bfaea671f3970d62ebab19f2a85e8dcae164c2545ea721a661677e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252912, "uuid": "efc5c43b-7871-4e30-bd5c-db3d30947067", "value": "T1F8C4AF0AE7E409F8E0B7E538C9574906F37A7C4D03619A8F13A9566B1F273A0DE3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252912, "uuid": "da0ebc47-6328-45d4-af6f-c751370a0199", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252912, "uuid": "632b45d4-3ea4-4343-9344-050ab416fa51", "value": "12288:UCQjgAtAHM+vetZxF5EWry8AJGy0wT+t1XQHfho3en:U5ZWs+OZVEWry8AFUXUPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713252912, "uuid": "60272762-677d-4fc3-bd56-3b4be25fe602", "value": 545905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713252912, "uuid": "6e836c0e-e729-4b4c-9acc-85a1185bb020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252912, "uuid": "0c4a3de7-7936-484c-9609-ed6e68b9ea2a", "value": "8213f49384e2e9b5b5b1b8e86c83fad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6a9b0a-fc40-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713306412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306412, "uuid": "52a18902-be29-4e8f-b366-1ebbbd693e0a", "comment": "Malware payload", "value": "8a088038bdbc3d06cfeafa984fe9f1d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306412, "uuid": "9a92ca90-ba1d-4833-981a-323e714a98e9", "comment": "Malware payload", "value": "36c6aa85bd2813a4c81203091a76fbfd1b666ecadd36dfe4524fdbb4a9bfe960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306412, "uuid": "6c4a0f5f-cac6-4a11-bee5-b811b1254e75", "comment": "Malware payload", "value": "7169fe35d4ab458ba2cd0e98cbfdecf6d1808718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306412, "uuid": "07552d6f-184d-4515-bf52-68747b174f4a", "comment": "Malware payload", "value": "6e5b30064b59460877761a9d812f79a1427e349d7f1084ebba64592e39b4018ef73fd83f2bd47b7b134e8042efd68ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306412, "uuid": "f4276259-c619-42c3-a440-2428e58d67fb", "value": "T162B4220539D4C8A3F5430AB0C2F19FFFBBB69E86D24145176B68BE5B7D743634A02292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306412, "uuid": "086fa6a6-8be7-4a07-821f-98ea17b0d24d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306412, "uuid": "c8f7f2cc-7834-429d-ad77-b231ca89b284", "value": "6144:usFMgIS7V/FbHLcxAD7kZaDO4NBXKVJCq5GptlcOXBHZy8yU5L8IuNfbuWG7Dk+N:plF0xAfkZaS436BYRfygoIuNVGTH/24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713306412, "uuid": "3e39b3c4-bc89-40af-a7e0-335a7eb26d69", "value": 538856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713306412, "uuid": "d07104ad-535f-4ac6-b9f7-195775cafcd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306412, "uuid": "8597b705-13cc-4a06-9e8d-9e9a9eeaea99", "value": "SecuriteInfo.com.Trojan.Inject4.54824.15312.17403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e3f412-fc43-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713307766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713307766, "uuid": "aab34b34-c54e-4e0b-9cef-a87cc4498fe5", "comment": "Malware payload (AsyncRAT)", "value": "0aecb205aba6cbf8a51c343fad500259", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713307766, "uuid": "f865d733-5196-4611-b7e9-6da1fbff76d4", "comment": "Malware payload (AsyncRAT)", "value": "37c59b4a6bc52f2fa3398bba784ab89b2316c17edf13bb350e2c7dbf5933d285", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713307766, "uuid": "0e783ffb-b2b8-4ed8-9879-d0e9c320544c", "comment": "Malware payload (AsyncRAT)", "value": "8dfae8d0183f68b62f9b3c9b88198404a1ff6ef6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713307766, "uuid": "6e713d37-8037-450e-bb3b-1e3db329619d", "comment": "Malware payload (AsyncRAT)", "value": "8ba8a46a86f8b26872c4fdfe7ee3b7def85fc9c674bd660607e0034fb00556e436315d2f0c5c1ca8c38c1fa0ec9c207a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713307766, "uuid": "46e1f3ba-5735-4b07-b099-86dd4d199e88", "value": "T124536B002798CA66E1AD4AF8BCF2550106B1D5772116DB4E7CC854CBAB9EFCA46133EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713307766, "uuid": "cc2d8e5e-2c4a-409a-9786-587205a79576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713307766, "uuid": "77139e88-f151-4bc1-95ba-0102bd9df32d", "value": "1536:nhp5LrUwk4Xq0Wd4ZsYCnn/bb5wesr6GRZVclN:nhp5LrUwk4Xqd4CYCn/bb5TizY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713307766, "uuid": "7f3226bf-36c3-43fb-aea2-09cb442ff92a", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713307766, "uuid": "78ef2ccf-009c-4ab3-b078-79fb037d6513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713307766, "uuid": "513df68f-a1a4-481c-9622-2ec4fb7ac941", "value": "xM6280MQQPyf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca37433-fc17-11ee-a120-42010a9c002e", "comment": "Malware payload (Adwind)", "timestamp": 1713288910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288910, "uuid": "716d8a00-ff61-48b4-95f0-5ed3b8a65a9a", "comment": "Malware payload (Adwind)", "value": "df2d12625998b7c51a4eab26d3a42e7e", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288910, "uuid": "14dc0704-d83c-433f-b800-f7a67de37c6a", "comment": "Malware payload (Adwind)", "value": "380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288910, "uuid": "c4125dd6-6ac8-47b5-bce5-bfe8feedf848", "comment": "Malware payload (Adwind)", "value": "3d0403ab389c056beae99b7e71cca51ad521c870", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288910, "uuid": "c9705f13-88be-4ff0-9729-d2db0fdd6849", "comment": "Malware payload (Adwind)", "value": "66b93486e8dfe5470f8a29b231f0ec681e0d1c963cd5fc8de37ef16caffc994efb0a3d5b067c8c0451a06e44ab5e3723", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288910, "uuid": "5c9937b5-24a7-4813-a94e-6bef630ca182", "value": "T157E433D09A76464F2778AF4B48924B2E626815F09BE6CC7E3F3374142C544CAB1DE0F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288910, "uuid": "7f5378f2-9843-43bb-8c7a-178e484e7446", "value": "12288:R/eAo7rK7tfAKc6Mr+DpxFGs/HfTeg1jPZc+AR6AptwyoFGVKBzG1KpUfsRxrq40:no7rKJcPr+wIHfzxcbTLwyoFuKBAURx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713288910, "uuid": "b80b37ff-8f0e-45e8-b249-ebc1420d6488", "value": 658720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713288910, "uuid": "57dca9d6-11e7-47a8-9927-bc8e985c6165", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288910, "uuid": "7fe1d752-45ab-4554-a56e-af6c6ce3f904", "value": "FACTURA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff8742d-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713253348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253348, "uuid": "bc890bf2-0987-4d10-aea6-de471ddc179d", "comment": "Malware payload (RemcosRAT)", "value": "be38401d540cb6a7106d9ffa610410dd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253348, "uuid": "74ccf301-2018-4163-8202-3c6450e7d78b", "comment": "Malware payload (RemcosRAT)", "value": "384a162db4859d3ff2e892a6ba20bd56435d1690e6c821758657e44eb3ca0f66", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253348, "uuid": "c488e43d-2a91-440c-ba59-be989c4e0de4", "comment": "Malware payload (RemcosRAT)", "value": "45197cfc844f71c09ac8fcc23b0d782a84c87593", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253348, "uuid": "598f5e6e-9071-4307-bcfc-147a56a3ff61", "comment": "Malware payload (RemcosRAT)", "value": "575eb91e6f0520e5293a5bd9b4b416b54d375b7dcdc5cedbb37b1582b206259c406517607e786ab3d6d4a59043710a93", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253348, "uuid": "df5f299d-d1b1-4c52-be48-e088fb651a5f", "value": "T1E664D051BF818607E859037189F74B9A6361FD406F924A0F321CF72D3DB43E46D2BA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253348, "uuid": "9e657f50-e695-4a18-ba70-c968addf53cf", "value": "6144:qgunJYZY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVB2MIHqnz6fDr6ncfnqeo:q5JYY3bVB2MIpfScf97UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253348, "uuid": "cc83d6ec-42ac-4bb8-8e36-5218812f27b5", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253348, "uuid": "1a9294e9-dfb5-4b59-b124-b268052a7612", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253348, "uuid": "d08abfb2-8126-44ce-8248-3a28f67e8e54", "value": "SOA APR24.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cf331f-fbb8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248222, "uuid": "d274ed0b-0b09-48e6-8cda-866195619301", "comment": "Malware payload (Mirai)", "value": "c5a3ad6699be9dfa3ff6cfa2ba90026e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248222, "uuid": "d9070b4d-0622-40d0-9bc9-6e83397f40d3", "comment": "Malware payload (Mirai)", "value": "39ec37247d7e1f5ce83a075960bd48453ebc498d802a6faceb6aef53e7368e9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248222, "uuid": "62d527f2-db69-4667-aabb-5e7d447415e1", "comment": "Malware payload (Mirai)", "value": "14b55b70ff8a1bc026980398ebb39ad00b7515b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248222, "uuid": "b2201682-0f8f-4928-8093-c81d1bea37ac", "comment": "Malware payload (Mirai)", "value": "8d1201706835ca9d71c0c09b53b1b216502eb10ee7f55f81f238caa0200fec27a11248d6f453a633471f6dfe0f7efaa9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248222, "uuid": "a5c33a21-446f-48eb-97f8-fd247c238203", "value": "T125E31B56F8818B12D5C111BAFE1E128E37131B78E3DE72129D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248222, "uuid": "198dbde4-2982-4f65-b78a-39d28de21724", "value": "3072:8RZLoJEUL04ElrXueCgwjauichjbRCddp+Y65:8R5oJEwcrXJCgyasTAdp+Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248222, "uuid": "a0e5884c-5ecd-4f57-bcd6-09c102f69c9f", "value": 148092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248222, "uuid": "c7a19fbb-8e88-4fa7-8f53-ecd4754c387c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248222, "uuid": "7434b69d-8736-4b01-bff4-eba38e9e3fba", "value": "c5a3ad6699be9dfa3ff6cfa2ba90026e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70c1824-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713248662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248662, "uuid": "41ed4a38-861a-4e83-b38b-96d9930ba486", "comment": "Malware payload (PureLogStealer)", "value": "76eae6ef736073145d6c06d981615ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248662, "uuid": "c503bf80-ffa0-44cc-8bea-c65f3007a8c6", "comment": "Malware payload (PureLogStealer)", "value": "3acdea11112584cd1f78da03f6af5cfc0f883309fc5ec552fa6b9c85a6c483bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248662, "uuid": "5ac92cf6-1222-4907-86bd-5f23bcd507b7", "comment": "Malware payload (PureLogStealer)", "value": "6612a26d5db4a6a745fed7518ec93a1121fffd9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248662, "uuid": "63cd2666-a295-4405-9a7c-85fa5df3b070", "comment": "Malware payload (PureLogStealer)", "value": "3e6a2657cc8db17c8f861d9a66f7dc3e5da23f6b420496aabb4cfa3fb57c2c30e6028227a3a5fc0c22202283116e34c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248662, "uuid": "cfce92b5-878d-4761-801e-ba5f364c5d8e", "value": "T14FF5E00BBA878DE5D34A273FC19B550C5BE8DA812217D71F79CA237525037BAA8C160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248662, "uuid": "81eb84c7-35b9-4974-92ba-c80a09f591fe", "value": "98304:Y/gORUJOUyQBOrgJedw0H+GSYq8dG+zMJ:Y/+J69gKw0e1Yq+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248662, "uuid": "7f26ffc1-96a8-474d-ad7a-5f3a78b8d44a", "value": 3430912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248662, "uuid": "65a5910e-327e-48a7-8756-5c4dd7dd3132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248662, "uuid": "d9ac2c4d-4bb9-4440-80d6-809e657d7253", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.30455.29056.1307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67fda1a-fc05-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281276, "uuid": "27129433-4c0c-4758-b5f1-d2a17783857e", "comment": "Malware payload", "value": "2919c35ef52335a2a8e43666618b540e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281276, "uuid": "dfef1ce3-edfc-45a8-b12d-b15e847dbf89", "comment": "Malware payload", "value": "3c2fa4437eff84f61d87b37e04792c18b0338003b1f08b0397ab41ac7468d2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281276, "uuid": "7123f41e-d6d2-48c7-a673-8e10c17d7462", "comment": "Malware payload", "value": "18668dee5b52493baeb4b567aa74b4cc93db1164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281276, "uuid": "0e3200c4-81bb-43a0-97f3-33e44f869967", "comment": "Malware payload", "value": "d80962b9873256d73252a1f077b5804a6f89b0ae93bec1264e458399011f305944a928654c4bec6f14065e1ad879c84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281276, "uuid": "f7bedfe2-1ff2-4a94-a702-578367ac2411", "value": "T1CD051208747CAD17D77D05F44442082847F2E12729AAD6D8DCDEA8E728DBBF48A91B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281276, "uuid": "447546e0-2708-4a1a-94f8-cbf45ed5e62f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281276, "uuid": "16b605b6-fb09-44c4-a95b-5a34af8b60e3", "value": "12288:60uDrDvy3IusaZOZT3rExDM6EPbP4lzT0gnvF41Y2m3x4vKHYGB/SI9IATvcR8tH:O7vENA7ExGPCzYWNjOKHhaI9I2cRpSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281276, "uuid": "563ee79a-45d6-4833-8d27-c657132b9b57", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281276, "uuid": "114d044f-8e42-4ca8-aafe-3da1eaf66e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281276, "uuid": "ea9dabb4-2cfb-47ed-91f3-caac32f73cc6", "value": "Order356789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8c8ea9-fc36-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302283, "uuid": "eb21920c-c1b8-406a-a681-8f010869fd53", "comment": "Malware payload (MarsStealer)", "value": "b3605edf698023865b1e65852ff9e627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302283, "uuid": "2a771636-25d9-44bb-968b-79f82dd1ff39", "comment": "Malware payload (MarsStealer)", "value": "3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302283, "uuid": "1e2232c5-f9be-479b-bb46-0505b11fc9e1", "comment": "Malware payload (MarsStealer)", "value": "93c8ce5f7dd2e69edd50ef26d00f89b4bfbe20b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302283, "uuid": "df7cba76-3915-49b2-9c34-c5f877bdbd6c", "comment": "Malware payload (MarsStealer)", "value": "6e87fdf4c53dc9f1f538ac8264d40f81025d7669f480cb01ec9b20cf5232f2de78407ab909c7e59ba71dd301dd60e65c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302283, "uuid": "9f8dfff4-a9dc-4d5a-bd66-706d59830352", "value": "T10336493439EA5019F173AFB94BE879EADA6FBA733B07642D105103864723A81DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302283, "uuid": "e9b03e9f-d51b-4614-92a2-e2a89f992461", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302283, "uuid": "23609e17-f44a-4acc-b5e5-fc627ffd4ac3", "value": "12288:937z0DEczgGtM6oHYuFr7H13jeGeTaGHK4juSAxJWjbA/bJLoGI:WD2twmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302283, "uuid": "3ad4ff17-f109-4e1e-8c72-1e853e2d62c5", "value": 5002592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302283, "uuid": "15f7e40c-d7c9-473b-8448-1b4c51e64b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302283, "uuid": "c87b2382-dcb1-4a16-8836-ed522dd0b3da", "value": "3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51e0cf4-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233922, "uuid": "f7e6d221-20be-483f-851f-e2a0ef6757fd", "comment": "Malware payload (Gafgyt)", "value": "c3008f88e6f408753fff361c64e022b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233922, "uuid": "fc1fa5d2-8a3e-4cbf-917c-8c2af9bd32dd", "comment": "Malware payload (Gafgyt)", "value": "3c8a678f0dccb24dbb1849bd05c30e44d72342a60b0043754192b97d411d6467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233922, "uuid": "27dfc5a8-9714-419c-8087-59b1e86f5a9b", "comment": "Malware payload (Gafgyt)", "value": "454f62d0b8222200397c90c1bab73d4772e15fba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233922, "uuid": "eb3f5ad8-8819-43ad-a53d-8d6114911678", "comment": "Malware payload (Gafgyt)", "value": "81724e40357e5a11814df1b52f82b322d3cc4fe48cce0e462e015a51dc5cf179b479e0cfe8a15c0ab69375ab38b87ce2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233922, "uuid": "ec6a0437-4268-4e10-b0ab-c0f984a90afb", "value": "T153B30801E954872BC2D22B7AE78B434D33366A94A7E737195A34BFF43BC27982D36111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233922, "uuid": "61ff19e5-3f4d-46f1-9f65-42a66290c569", "value": "3072:Gyrbvv2UDFkYreszxIYUqEG4O0GFam4Qn7JXBfn:fvecBzxIYCG4O0GFam4Qn7NBfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233922, "uuid": "f1bb22ba-afd7-4a12-832d-c9ca1d63d336", "value": 111337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233922, "uuid": "a1dec3e5-e420-4c0b-b87b-f1cebfebf2f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233922, "uuid": "f21cac89-d94c-4d82-9459-d36983da28e6", "value": "c3008f88e6f408753fff361c64e022b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d3edc2-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256982, "uuid": "d67f2033-1e4c-413b-baa8-74f150e4bd0e", "comment": "Malware payload (Gafgyt)", "value": "f4712dccb0f82d3dff78139eda7c69ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256982, "uuid": "018cc961-f149-4ef6-b254-ac1812b35403", "comment": "Malware payload (Gafgyt)", "value": "3c9d0a46f4f9866e5ebb53772964e1848f17eea9a27d4a66bd91ddb9c2273c7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256982, "uuid": "8e37d493-f745-4057-91fd-739289f53441", "comment": "Malware payload (Gafgyt)", "value": "cda3dfe4756fa134d1940ba67023ef633b13dbff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256982, "uuid": "1c68e994-36ff-4644-a095-466b5deb3baa", "comment": "Malware payload (Gafgyt)", "value": "ec31904b694bdea62f756250001a485693ef5e023ed732860cdbe52b698d4d5c6009033809902ced94e2eb777c6e336e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256982, "uuid": "f4339af2-845e-4c76-9b54-ffed5a65b76f", "value": "T192F309B6F811CEB3F04B96B208DB8E256E30A7E31B532122636736A7DD361C53857D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256982, "uuid": "56b3e8af-f54a-41ee-8843-fc980a0c7161", "value": "3072:WClTh9fb1p4O4fqdfQeqacWucW0JcWcBFj1pBChuC45DJ8DMvnJ30X3iQzwwmmud:RHfQeqacWucW0JcWcBrpAUxRJ8DMnJ3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256982, "uuid": "5d5ec429-77b9-4d93-a58c-fce3d093634b", "value": 159434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256982, "uuid": "e7edb113-d766-49f2-a617-aaaea4d4c52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256982, "uuid": "23b266f9-4828-4c33-b1fe-07adccf925c9", "value": "f4712dccb0f82d3dff78139eda7c69ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fafaa57-fbd6-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1713260864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260864, "uuid": "4a691b69-c44c-4f24-9a5a-e5aad69e4885", "comment": "Malware payload (IRATA)", "value": "a6cc49497d43508e8e4d1149f148a4f2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260864, "uuid": "6307c37e-a586-4add-b125-1755cd530421", "comment": "Malware payload (IRATA)", "value": "3d5dd6660a6c659fad85268a0a8002905b061ab015e129f3d2da817d010da57a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260864, "uuid": "70b857d2-006f-424a-8bd1-1f39eb1d0b28", "comment": "Malware payload (IRATA)", "value": "dd51c6498c34c98142c2cb45c71a26622a1d3720", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260864, "uuid": "bee286b6-07ac-4492-a7d4-a031f7036f35", "comment": "Malware payload (IRATA)", "value": "1a83635e52bc14917f52572d027c21324df89f3c843190cdc722784a13a73e156e87327885ed1756d8015974e62744f5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260864, "uuid": "3e7f984a-5afc-4c8f-8194-8ac7a3f468eb", "value": "T182D52347F3A6B81BC9F6C33212A4263921374D198B47F789B54873B970FBAE84B851D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260864, "uuid": "b067acd7-4cec-44a2-9f14-7f3b21f47428", "value": "49152:a/a0ZOty1WmU9nZ22I4aiPah3IPz3C8bz/NOmj4IWAMW6AUd9RsYUY8:whZey1qZzUhYPz3bzAmj4IWlld9RH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713260864, "uuid": "b1d76758-bdd4-4588-b03a-0eb67e8100ed", "value": 2834505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713260864, "uuid": "5c7ea4e8-7bef-4055-b537-c40f618a7ec8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260864, "uuid": "140f4334-8fd8-48c2-bcda-cfa3ed7d4892", "value": "Mad-rat-3 (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7d76cf-fc0e-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713285043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285043, "uuid": "bd64c33d-bf61-4fda-8454-f89adc1ad430", "comment": "Malware payload (RemcosRAT)", "value": "c7d0967e4b8c8a0a1309e97d549b828d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285043, "uuid": "ab23f923-49db-4934-a698-828e714b6c19", "comment": "Malware payload (RemcosRAT)", "value": "3d9744bfdd9d8e6dc31dd3f8b6485a0acb76d96dc0dd121248e29a3d975b600f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285043, "uuid": "7bce8a12-154b-41d3-b204-9cee88cab634", "comment": "Malware payload (RemcosRAT)", "value": "61cd7eb2ee3b0e0664b5efd753a342c5a2ceb7fd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285043, "uuid": "b8a40c12-e59e-4c67-b41d-784ed8562c9f", "comment": "Malware payload (RemcosRAT)", "value": "48cefe873d3d76ec06034371adc12517fc2ccd9221f34dc8da2bb0046dbeb11165ce2e811fc360f42ee750b9a0f0cf56", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285043, "uuid": "f38c2b33-8326-4ab7-9315-3108e293aa09", "value": "T12853E22EE70F0915DF55D77B034A4B4A09FCB33DB28540A579AC973837AD82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285043, "uuid": "906588d9-cbb7-4152-b7b0-07fe85e34da5", "value": "1536:DIPFRGUXgszsu7AfpTlOttmtDVvhCXlnYfSEdsmV0Dwfhq5e15C3f:Dgnwszsu02tt4TWlqDdYDwfE5e15C3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285043, "uuid": "94a485f9-b2f5-41ee-b533-86266dae64c3", "value": 66605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285043, "uuid": "c549138e-90f5-4670-84c7-97f2f40e14d4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285043, "uuid": "1c1184bb-afbb-4b94-9c39-2c3a257e9fa6", "value": "c7d0967e4b8c8a0a1309e97d549b828d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc2f4b3-fbc7-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713254577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254577, "uuid": "edd1e8d3-d086-444c-8e64-0a2eee57ad03", "comment": "Malware payload (GuLoader)", "value": "6d469931b2f7f0547b5b29b1f13757f1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254577, "uuid": "aa145dad-ef99-4c41-8b45-e653ca838ecb", "comment": "Malware payload (GuLoader)", "value": "3e7a73967dc5a281769f045c83e205afad5afc15698606f746e820afb0567230", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254577, "uuid": "5096e633-13d8-46a6-be4a-28701b1099de", "comment": "Malware payload (GuLoader)", "value": "a396528b953b6b573828ce621b4a1309f35853f5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254577, "uuid": "6e9d820f-6062-410b-b377-f44b8746b514", "comment": "Malware payload (GuLoader)", "value": "2be6054cc43e6af9c334feb9e84b8926821f2ba80b52befb80ad74a7c97f66cbe9704afdaae645e98094cfb7db5de56c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254577, "uuid": "e0d59c9d-7a8b-4876-9a68-3972eb94ed16", "value": "T190946D60EE68066A0D4B279EFC911A92C5BCC219462710B6FEDD074E61079ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254577, "uuid": "e36f9ee1-dc87-4142-a211-6a40c1a22701", "value": "6144:ltrc0iH9QXg0Id+WULFvWtBVkmutWJxKE2l88FD3NG8BXMVi:lFidQ0y+znKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713254577, "uuid": "48b10a33-35bd-41f3-9be1-18a55ed6cc03", "value": 413282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713254577, "uuid": "bc4e7962-41c3-40d9-b5aa-532ac3870747", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254577, "uuid": "4d5e0cf9-b7c6-4552-a233-91b71413f93b", "value": "awb_shipping_label_invoice_15_04_2024_000000000000024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a24f39-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713281625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281625, "uuid": "8595a6e8-a876-4cc9-9936-ca14ea9135f3", "comment": "Malware payload (AgentTesla)", "value": "4287a9d914a236cba3e11341562bc9a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281625, "uuid": "7a0961b6-50c7-4a9a-bbef-a051c8a4c003", "comment": "Malware payload (AgentTesla)", "value": "3ea7d9d931eebd3542a7a54f7f93254ca897a44398cef1b19bf491ce4a0f14b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281625, "uuid": "399b0557-12b4-4b85-b380-e36ff135e084", "comment": "Malware payload (AgentTesla)", "value": "fb01432aec2e310769aab7e34df7cb9215d1ad95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281625, "uuid": "dd8a0a51-33ad-4d73-bf4a-b9c981f0a597", "comment": "Malware payload (AgentTesla)", "value": "52811cf77f6fd5f072d082a24abd9f530e6f93aca09d827c2d8ede12123f5f5d6fab0b6c9bf0d735b16a2c7f7a554788", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281625, "uuid": "255f3bdc-a1a2-4ca6-a971-874bfad53ad6", "value": "T12D94AF5263ED5008B2B33F04A9FA91258B3BBEDA9C79C54D058C5A6E0BE3940CD757B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281625, "uuid": "27c91046-d0a6-4204-8a95-94951f1756e1", "value": "3072:HHGRPQMYFEhNe4VTdRnTT8w4TWXZq2vgHdpe+og0S76QzS18f8d6bb/g52r:+PQMYFYZqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281625, "uuid": "a82bd5a9-42ca-40e6-a350-707efa14a09d", "value": 409036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281625, "uuid": "598a0dfc-f9b7-45ed-a466-f8b5d29585ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281625, "uuid": "39fbfffb-e495-49b0-8d24-1e2c69def0a5", "value": "DHL Shipping Documents_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a38f5e-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265435, "uuid": "380fab89-7d5f-4c13-b525-e0cd7cdedd19", "comment": "Malware payload (Mirai)", "value": "5b77063b0569ee46cfbf856dd139c902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265435, "uuid": "a0e2e897-824f-4ac1-9605-bcfe153274c5", "comment": "Malware payload (Mirai)", "value": "3eed5d02325f641448cf469ca0ffef7282e2c13fe9c7f928385dd37aa2c60713", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265435, "uuid": "9d93bc15-d9f8-4864-9552-7e37fca1077a", "comment": "Malware payload (Mirai)", "value": "cff7f211d0a75f6eec7a760cb084de259a19ff9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265435, "uuid": "ce6b83c0-0e47-46c9-9ac0-f9758d09786b", "comment": "Malware payload (Mirai)", "value": "4b7e587967ab56d91c7ddcce15772aa4cc1138dbdbc6c2fd587eda01d899b756834423810c745455e7dc700d1df65eca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265435, "uuid": "dd3a9145-90de-4179-b686-cb42c030c673", "value": "T17A433B61B7720D27C4E4A579A1E74327F3F9438A14B88A1B7E615ECC2F9496032537F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265435, "uuid": "5b6194da-b66f-4808-a3f5-404b0239480a", "value": "768:LeIv/HTBePTV/yqwLjCJTbQ9O+wWxAqEegtZuzLvnto74IqV:LxvbBYxaNjC9ewW6LegtZ4nto74H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265435, "uuid": "cce69c80-bd9d-4e51-a37e-46328fc97ce2", "value": 59028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265435, "uuid": "3ab7f2fd-6248-4531-8341-ffbfc8ddd280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265435, "uuid": "e7f4002c-e4b2-41e9-9e44-e4cf8b2de1a9", "value": "5b77063b0569ee46cfbf856dd139c902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464bde4d-fc09-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713282725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282725, "uuid": "0f78cb2b-fe00-458c-84cd-25d0a0c79042", "comment": "Malware payload (PureLogStealer)", "value": "7efdb8104be2cb54cb77ee615d9c6197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282725, "uuid": "c283c7c0-2550-439e-87f8-b458b339330e", "comment": "Malware payload (PureLogStealer)", "value": "40c251a8afb49d3b567a370e67ca7861a4cc2008c7deef39c3739284c1b7e3e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282725, "uuid": "d0cb8db5-b006-4695-bc88-0f9f22252f5e", "comment": "Malware payload (PureLogStealer)", "value": "f937e4c7ce6151d2a662f180420ab8e6ac654ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282725, "uuid": "ae68c7ce-37d6-42c3-b288-db88ae5eb147", "comment": "Malware payload (PureLogStealer)", "value": "dc3a472a3a6355546a70a737cd2c7fe1d7c9d13b253ce26821b7a7f7991c5105bff64fea940913c0011076a9db505041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282725, "uuid": "73dc7b8b-3601-4507-8aa1-31eea67b1b08", "value": "T1FFF633AFE1ED6D48C4B0473584F840E9A430B2F54B7124EF255AC634DA729EDB836B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282725, "uuid": "64100ac1-bbf3-4181-b087-c26fa1804a95", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282725, "uuid": "da6a9264-562a-4610-8c2b-9222ab01c99b", "value": "393216:sHCoIgksmCvTUu++OqYW1cVXWLkbl+L+QU+:4BIgLSu65W2V+1yQU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713282725, "uuid": "360eb7ed-f896-4680-b152-14188fd70f5e", "value": 15261184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713282725, "uuid": "47cfa679-d79d-4acf-ae3b-09299110ae15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282725, "uuid": "0fd53e6e-bb95-4a15-ba93-56207aa8c0b8", "value": "7efdb8104be2cb54cb77ee615d9c6197.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b160771d-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233942, "uuid": "2ae40604-2a95-4e81-9d50-d266efafaac7", "comment": "Malware payload (Gafgyt)", "value": "2027be5e63290f8ac85569d9a91d9029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233942, "uuid": "8aba1f61-b701-4f4f-8446-3e4ab23e0a53", "comment": "Malware payload (Gafgyt)", "value": "42deec8992ff7183f50147f29374f42894c4d1b8483485342fcc27d0d060cb7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233942, "uuid": "86ca7a7e-7335-40c1-a0d8-8061060fb1f6", "comment": "Malware payload (Gafgyt)", "value": "d053a94ae94fc889cef48205fc57e64d0ebc3dc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233942, "uuid": "23c60b8b-11cd-421c-ba31-ea9223ae92d6", "comment": "Malware payload (Gafgyt)", "value": "1ff6aca166bdb53131d41d2cc6c358b0063bbdc2ff77441016516fb728a3f11c93be4b25902beae8254208e9a3ce1ed3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233942, "uuid": "2d3143c6-ef2a-426d-ad87-c40883bae614", "value": "T14BC33917F9429F41D1C325BAFB9E924933136FF8E3EB7102D9209F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233942, "uuid": "e7ec819f-79e5-41db-b060-786774fec12f", "value": "3072:/kjpy/Zo4waXD+ahAHaVTsXerkYk3YI5hepC3dn:/kdy/u4waXSahAHaBstYk3x5hXNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233942, "uuid": "cc9c5105-ca87-4d4d-83be-39a03fc70351", "value": 129776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233942, "uuid": "feeb5dc0-662c-42e5-a504-172831ba0f5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233942, "uuid": "b6877274-d8dc-4ad1-b701-86df0bc2e223", "value": "2027be5e63290f8ac85569d9a91d9029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23dde10-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713257137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257137, "uuid": "f919160b-e45d-4436-9084-56973c13b22f", "comment": "Malware payload (AgentTesla)", "value": "af60b92bd160c7b73fbe9a3b5eeda034", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257137, "uuid": "2e9fd3f3-2f23-4a0b-b08c-6b8d96216bbd", "comment": "Malware payload (AgentTesla)", "value": "44509a1580c18a2b3b59c340de7b28d7451ccbbb41e264e168bbe148c66ae930", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257137, "uuid": "0ac080d6-2461-46cf-ae9d-93ddf2ba9d4f", "comment": "Malware payload (AgentTesla)", "value": "1930fb9e301f29017979b214b096e209a685752b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257137, "uuid": "01f61ef8-8ac7-4c26-905f-d13cce2236a3", "comment": "Malware payload (AgentTesla)", "value": "39e7983df899e78286953bada074a35ddebc564caa97290918e4bb702ca3c10f8f21c7b4f1805c543154510c63b0fdbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257137, "uuid": "b68517d2-d7e4-46a0-b382-87c3a24154da", "value": "T13CE41204B3F6AF19DB7907B065306C140BB779A92A76E32B0FC554DB2A38BC44A41F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257137, "uuid": "17ed0610-65a7-4837-9f68-e2c6a392ccbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257137, "uuid": "daeab351-abe8-4c51-99a6-b45b261b7285", "value": "12288:6aNC1oLnhJmWH6G39IJ6kenAP2U4MvOo8JugErSRUSIn:+1o735j3qYtn62DMv/84zQIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713257137, "uuid": "3a80ca3a-b72b-4492-a44a-54a067d216c6", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713257137, "uuid": "35c14240-5d9d-4a79-91b4-f5afbe8237fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257137, "uuid": "a2fcb586-e365-4f44-b13c-8593c96773ee", "value": "Purchases Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49992860-fbb7-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713247512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247512, "uuid": "83500333-4d07-42bd-a899-c7b8ce1fe3c7", "comment": "Malware payload (RedLineStealer)", "value": "3275b7e131f4fa647860ab05d943df6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247512, "uuid": "283d87de-d7ba-400b-9d0e-456a2a3ddeff", "comment": "Malware payload (RedLineStealer)", "value": "44ba13a119d19891a586d95310d8a51e9440fe2c1659b397d5795ecab37e3eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247512, "uuid": "b51ca08b-5a24-4112-9046-6b5122247068", "comment": "Malware payload (RedLineStealer)", "value": "b71625ac8fc87558dee875298018b450173ab2e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247512, "uuid": "441a770c-f463-4421-96a0-1859c30ccbf7", "comment": "Malware payload (RedLineStealer)", "value": "b40126df0e96bc7bb9dd2663904a6ecaae89a7b857feb578bcf1884b3fd866f720611a4d7900d5c8d84d5681f2e03902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247512, "uuid": "cfa5348a-08f8-4217-af9c-fea9cd977afe", "value": "T163051221BEC5C871D473153B1AF5AB38997CB8200BB68EDB17944D1D8E606C29B3A773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247512, "uuid": "68cbdcd2-f5fb-4d03-8b1e-0667dff7e074", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247512, "uuid": "4000fc18-43af-4943-b270-4ce8346f8aa4", "value": "24576:TxLsMs8WdXk89WkrN93cjuOqNZtqffDKU4YRSFu:Bsld/9WkrnVOqPtqX+UH0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713247512, "uuid": "778b3e69-4f46-494d-a90d-b69e883e8844", "value": 813435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713247512, "uuid": "2631b8b2-56e2-43c5-ab4d-4bbb0a804338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247512, "uuid": "1f9d40e8-b9f9-4e6d-8214-1a31d8f6ddcf", "value": "3275b7e131f4fa647860ab05d943df6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19be68a5-fc15-11ee-a120-42010a9c002e", "comment": "Malware payload (VenomRAT)", "timestamp": 1713287805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287805, "uuid": "5e73114d-f0c8-4d47-b41e-70c1af1c49ce", "comment": "Malware payload (VenomRAT)", "value": "9f587ac1e364bc4b89ea9991c780b09a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287805, "uuid": "a5abcda7-9522-4497-9a7b-074c5d8cbe8d", "comment": "Malware payload (VenomRAT)", "value": "44e910d573342c0bd7713e853d6bffec6565db309e4e93042052f064b5626384", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287805, "uuid": "bab1d085-1f7c-45bd-b6cd-b96d27898126", "comment": "Malware payload (VenomRAT)", "value": "9612509e53fde418c7bb1794ac5f30c894b960a9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287805, "uuid": "9348340b-8815-4917-98ef-55ccd03af29b", "comment": "Malware payload (VenomRAT)", "value": "66c019f1269899ce272740c4ed093db8b0839bf45061c2e019d5cd604e343ada8554060834a331587b332d2f3e06688e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287805, "uuid": "d987b217-18b0-48b5-9aa6-52fdf7fe3d85", "value": "T19652562B0BA31955FFB6D9E9B52D138CFC2141E8D1952EA47D01A8F32D4D5BACCB00B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287805, "uuid": "eec9c3de-563b-4135-9d1c-193a034964a8", "value": "384:qpzWNjCBvB7owyK5GYsx5GlUi5GhmPM5GmmaUi5Gt48FR:scYZkYK0qmPM9mYl83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713287805, "uuid": "25aacef3-ad4c-4701-8b04-dcac3c4ae48f", "value": 14035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713287805, "uuid": "cfcb2d56-1077-4b31-b177-8d1320c5ee3b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287805, "uuid": "be7f824c-1c47-466b-b26b-4082d6e57d0d", "value": "hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b9e299-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713248665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248665, "uuid": "ae02e70e-146a-474a-9f5e-861e493f2b8f", "comment": "Malware payload", "value": "ea3abaeb2d198c9ae3e0bf286950fa43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248665, "uuid": "1c1bfcad-cf4b-4c47-b9f6-b7eedf976963", "comment": "Malware payload", "value": "4585cda3f3d0f7de8d4262486a4d40d3f498bd75b27f4ed8817cadeb7d180a05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248665, "uuid": "c833d11c-1a46-481e-aa6b-30642f599553", "comment": "Malware payload", "value": "a56d2d760b083b700e159f5f3adfa8ccabcf18a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248665, "uuid": "3770b9f8-4f74-41bc-afb0-7b7aedf43be2", "comment": "Malware payload", "value": "6fe910e152a20e44875a7b79ab818aba6ecd1a55b01432b119c50c817e509eac2ad220c698c7eabc7bbc9663dbd4d677", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248665, "uuid": "8e03da97-0d44-463c-8dab-a8c86427416c", "value": "T1BEE49E472FA1C0DFD4EE44F054AE869C785F5CCDC9BBC5973988DA7D4BE2A127A22009", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248665, "uuid": "5295e1bb-680b-47a9-af91-bf5967a338e1", "value": "9d48f73722f36ae6301afc26a93899b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248665, "uuid": "85b87d49-bafc-4ea8-8bf1-25eb822a2b3b", "value": "12288:FV80TM9r5zTeON8a3qaoDCB6nyqT27X74bozYIrWUOV:D80I9rJTeu/30CB6nl9Ez9OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248665, "uuid": "c5938c12-f2b2-473f-bf8d-af7cf0232502", "value": 670613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248665, "uuid": "57ed46bd-ed03-4cd6-b6cb-3c1ab8cf828e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248665, "uuid": "7f094296-9f03-4e66-9c82-e70e68b202d4", "value": "SecuriteInfo.com.Win32.Banker-KIY.9226.30520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9403c82-fc03-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713280449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280449, "uuid": "fed289b0-5698-48c0-a7b8-01c1b8112d6f", "comment": "Malware payload (Formbook)", "value": "0faf0632777806d9e8c13f1ca6fc3237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280449, "uuid": "db9376c7-fd97-4e47-a8ec-b96a3f577441", "comment": "Malware payload (Formbook)", "value": "4585d06cb13de01241bf014db8d49149de7a77a9a0dc13b9007d08a402a035b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280449, "uuid": "c68a761d-81ab-4472-87e5-92255e9f9886", "comment": "Malware payload (Formbook)", "value": "35fea792d63ba1e9deec1d2988bc6456322772d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280449, "uuid": "e301497c-d1c6-448d-8140-62f3a4cbed81", "comment": "Malware payload (Formbook)", "value": "4d80d6d6820b7bd786ae108e1f930d86a8f4321403dd920484d2879271e9293623a30c205996b38958c84237ab37baf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280449, "uuid": "b9a96f4c-9d16-46de-a47c-54c2be94476c", "value": "T1D615ADECBBB250EEE752D43D39C68EAD75E0EE311AD6091A357DBF1817312958EC2201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280449, "uuid": "dd4c610e-22bf-4d2f-b613-9ca94d5d8ced", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280449, "uuid": "cc04471e-ddf0-4843-87d7-d4a2e573412e", "value": "24576:HDgVtWN/pm/avooyRDtwZk8D2RncNogPgct/R:cpoxZDmndct/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713280449, "uuid": "169143b8-c28e-4ef4-af57-628def4a2957", "value": 906138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713280449, "uuid": "1770b85e-b617-40a7-bd03-b445746162fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280449, "uuid": "c7c3ce6d-5922-479f-a46e-e63c7bcd7810", "value": "160420241245287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613d98af-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281912, "uuid": "385293fe-3eef-439d-80d6-e97043912e71", "comment": "Malware payload (GuLoader)", "value": "169e9a5b94f0e076b4d5cffe40a3bc56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281912, "uuid": "e3034e04-39ff-4cc1-b1e9-a13df98793b2", "comment": "Malware payload (GuLoader)", "value": "4776d59ef021bb573b299cae4beda1cf490384d69c26ed7a881b729dbd8c7ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281912, "uuid": "27d464cf-5b19-4dea-93da-77870ce02a21", "comment": "Malware payload (GuLoader)", "value": "c6b45b728fe85596a6e4e1c4830b62b0a97257dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281912, "uuid": "3b6f317a-fc0f-4d5b-9d2d-0b059e733451", "comment": "Malware payload (GuLoader)", "value": "08295e4291bfa828970b9cf6cd9ce359546982ec2069a55510492d1eee673fd04f71a8bd8c5be9f0cad2f2ddc1ca87ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281912, "uuid": "093e99da-a31e-403b-ab2a-8caa440fc512", "value": "T16DB412052EFF4A56C5B04E73A1A7EBB8A7569EB02A204E476F60770F0EB17C4DB49443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281912, "uuid": "4879d5c2-4258-4b0c-a172-0172407f19a3", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281912, "uuid": "edb37b9b-76cf-4f7c-98fb-c27671e5f257", "value": "12288:fOLiZZFB3YTT8G/XXMXhVnVxDMWWzwxC3+kMZ7p2:8iZVYTw4kVxDNf4Wp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281912, "uuid": "8cd26403-cd6d-47b1-91f2-03008d38f8e0", "value": 494840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281912, "uuid": "10a6d22c-2b04-44e5-ac6b-c569a0d13b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281912, "uuid": "2f825296-a6d2-4638-ac60-69626431db54", "value": "HW#210872-218YAT-THEON-GLOBAL-Y801823-1AHEY361-APL38102823-19011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50508a90-fbc8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713254825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254825, "uuid": "2eb78940-af66-4517-89ee-db84f8020228", "comment": "Malware payload", "value": "9037a614fb2a15a614d722fc88fe63bc", "object_relation": "md5", "Tag": [ { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254825, "uuid": "ff2720b6-34b9-4af9-987b-04b2ae23db6a", "comment": "Malware payload", "value": "47dbf31d6aaa65e7183f330781ef169edb3838dae4454587345741506d336b65", "object_relation": "sha256", "Tag": [ { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254825, "uuid": "be434d9a-bbd2-436d-b9f2-203a06ff8da4", "comment": "Malware payload", "value": "0766493bc1ad17986b982a69b1eb8538bfb065e2", "object_relation": "sha1", "Tag": [ { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254825, "uuid": "3c22e1c5-0967-4a4a-8b2b-506be24bb6f6", "comment": "Malware payload", "value": "adfbddd24aa72b687967990211e51e9fb6a72c749a656937a4d378879d7283c5860ee3e09699430f76c6d3066d5c9d2b", "object_relation": "sha3-384", "Tag": [ { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254825, "uuid": "6c96ddab-a83b-46d3-9149-311c9be798ab", "value": "T141557D41FA90D9A2C0424A79C042FBF3C7B57DB5E920E58703D07E537F33A866EAA654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254825, "uuid": "4eccbcb8-9add-4e6a-a752-615dd7f54d29", "value": "12288:P2y2OPwz22zTDjc+nxm/tw0s4eCfTN6RY1umas1yVaddUxzoM/P8g:j2QoY+x6dcYomZ2zTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713254825, "uuid": "6779a889-6f72-424c-b589-5bf5c23245d3", "value": 1366225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713254825, "uuid": "d4153f68-b858-42b3-8acc-b22e965ff2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254825, "uuid": "881d4fea-b6a1-408d-941c-0c65a36cccb5", "value": "123.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e948f96d-fc36-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302326, "uuid": "c32e2a5e-d0ae-4264-8717-0288063c73d3", "comment": "Malware payload (MarsStealer)", "value": "3cc6ddf90e7492c803b3d20142b126cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302326, "uuid": "80be86b3-a06b-46d8-aaa5-16ef4c7263a3", "comment": "Malware payload (MarsStealer)", "value": "49ab6b67e5bc75c556a1a8248f318943bc697209fdac3f02f2721ded1a375897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302326, "uuid": "e5a4d86f-a2e3-4a7b-94d1-0e63c3f54b96", "comment": "Malware payload (MarsStealer)", "value": "9899b9c40227e604131018ca2f812edf2ef5a32b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302326, "uuid": "9d8215d9-ccc0-40fe-8e2b-52b65166e082", "comment": "Malware payload (MarsStealer)", "value": "bae7cd42c57897871511435bc379be6d131f42f766a9504b8c16b11af058c8794892af2f2116de584ae150d42ac41df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302326, "uuid": "a0930dd9-cf65-4a24-9a52-7275cea70466", "value": "T13BF3DF630918CCECE97D24FCAA86FF39812839E452C9AE54ED4646D33540BDE5F62323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302326, "uuid": "9803490c-a551-4b80-bf54-38a003734807", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302326, "uuid": "570eb9ef-acee-450c-8ec0-1ca69dc6dd82", "value": "3072:UEKfIiYLdDwX49QAT3r5TJhnihshxC4RbgsRzOkqU0+DBqJSp8Bb8EG:/YoLaoXVnicxCaEkFi8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302326, "uuid": "9d2547d9-6010-40d5-86f4-332d8e6f20c2", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302326, "uuid": "fec7da9c-9d54-4dc8-bfa2-04621de4e448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302326, "uuid": "2d818ec4-42be-4fcf-900f-5848dd236c5f", "value": "49ab6b67e5bc75c556a1a8248f318943bc697209fdac3f02f2721ded1a375897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33317bdd-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713253058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253058, "uuid": "a9050c6f-497b-4814-b218-d7f28c828e49", "comment": "Malware payload (Formbook)", "value": "8ad33ef9b2c5ace2b195d8213525809d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253058, "uuid": "80b67f4f-a430-4898-b147-a9d98bbe161d", "comment": "Malware payload (Formbook)", "value": "4b0ee61b0c2873d1e86b99f48ddacae7ce51efc7272048827ae368b98cafe2be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253058, "uuid": "3106d3a4-a243-498f-aacd-437693ff85b8", "comment": "Malware payload (Formbook)", "value": "4dda6258af72ad6e2d70c61238baeecb8cd05ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253058, "uuid": "366d44dc-647d-4605-b527-6035f7b7c3c7", "comment": "Malware payload (Formbook)", "value": "c65d751ac9a76bdd740d2f6b2dd29fade68a28cd26cd27063285469e4e31611adb9624a24776fce0ae879497939cc108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253058, "uuid": "b198f50d-7587-48c4-aea8-892450763e91", "value": "T10615ADAD7210B6DFC817CD76CA981C64EA6038BB530BD603A01716ED9A0DA9BDF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253058, "uuid": "f154338d-1909-4c19-afd3-51578807904c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253058, "uuid": "1d65d49d-36d4-439d-936f-803bf3d2d1b5", "value": "24576:Y1oG8je76qs4LXS+1k1z/hOwmRRhljKQv:SoG8jqs6S+X5RRhlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253058, "uuid": "08298c85-0eb4-4768-8421-f2787284d846", "value": 930824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253058, "uuid": "7342329a-e087-4be1-a161-afd5e111188f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253058, "uuid": "8fdcb79c-4cd3-4855-a9b4-7b666e39cc81", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba62d723-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233958, "uuid": "77e7c453-b19b-406b-bacc-64167bc2390d", "comment": "Malware payload (Mirai)", "value": "3d3e3462e35016280e47d3ad63040c60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233958, "uuid": "bd91a95a-166d-4daa-a9ca-97482468b4a0", "comment": "Malware payload (Mirai)", "value": "4b48159348fca0d073e834a00f3833d04c2d6a804433176abe4df7b8166b7e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233958, "uuid": "5776355e-8fdc-4ff5-ab91-bc42a6b08c3a", "comment": "Malware payload (Mirai)", "value": "d4d34f205e31e800aa6fb3a146cc9761264843d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233958, "uuid": "976ea3dc-4c7a-4f06-ae1c-63cb0438697a", "comment": "Malware payload (Mirai)", "value": "14032e5415d998159f2ca2f13d0deed972de9e1f257a479b5e1fbaba5e4eed2c2839a6371c6efa2d2bd47a772370a860", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233958, "uuid": "631d2ee6-d895-4089-8936-f0966357fc9e", "value": "T1E0B31809F5148753C1C32B7AB78A834D37326AE597DB33056938AFF43BC27A91D26984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233958, "uuid": "3e2a16a3-ade1-422d-84e6-62b068b92ad9", "value": "3072:KzvjzXYFJ4hhFZYA8Ykjh5hRyrFxI5CNGmoQxu1bXiIn:Mv/JViA8Y6h5hRyrfGmoQxu1riIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233958, "uuid": "d324efbc-aac0-4c60-b40f-692b31760314", "value": 116362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233958, "uuid": "a9489619-16f1-4657-bcca-6fd3f7d59bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233958, "uuid": "955e0367-eafe-41e6-9034-29748465d8c9", "value": "3d3e3462e35016280e47d3ad63040c60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef91f8eb-fbca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255951, "uuid": "5f9285e0-a687-46d5-aacc-85ce1ee5a80e", "comment": "Malware payload (AgentTesla)", "value": "b2b8b6b689876d12c90064a9106d60e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255951, "uuid": "c6efc01c-773a-4269-89ff-c2c878b52d03", "comment": "Malware payload (AgentTesla)", "value": "4bb2e6484bc239ec3d37dfe66fd5a72d6de232b000b70ec75c4ac297132f25f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255951, "uuid": "556e0a40-ee07-4acd-bed3-eb9f71cef1c1", "comment": "Malware payload (AgentTesla)", "value": "5fa279fa4e6e8c6d33514e80bbed77823075167d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255951, "uuid": "9fa2dd0c-85ef-4a3a-ab3f-8f89bd72613f", "comment": "Malware payload (AgentTesla)", "value": "bcbd7fc9f829a81090f4e6469f933160dbb84a366748be82ad6c83496b7a8524c3646b3ad589264f1d6a88c20bd7e502", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255951, "uuid": "09fde631-d8eb-4021-a455-348f8040524b", "value": "T108E4120572FBAF1AE97B07B0897158141BBA35AE6632E14B0FC690C71A75FC44A40FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255951, "uuid": "7c638373-ff2e-4545-82d4-1fd5f93cfadf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255951, "uuid": "8014ef83-b10d-464e-8194-d1f1a17b536e", "value": "12288:yrEAvU18dYhl7757+G//SN+depUK/vnIZQMOjMSFlwTAO7vQi6lmmM7IO:333h9ND/qN+d01/vndMO4AO7vCmmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255951, "uuid": "32b5c9ce-1a19-4065-a06f-9e773cb5f6b8", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255951, "uuid": "25fa2093-de7f-411e-ae76-11f744a43c61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255951, "uuid": "073eddca-1dc0-4d29-afba-1349c0f1b45f", "value": "NEW ORDER RFQ QUG24-20037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ccd040-fc3e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713305428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713305428, "uuid": "b4ebdbf0-904e-4cd2-a120-2bb4898ed7d0", "comment": "Malware payload", "value": "01577aad2e4e2059aed8663c99ebb62e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713305428, "uuid": "8573d6bc-ec9c-4b1f-a81c-dedb3e8f58db", "comment": "Malware payload", "value": "4c2c4ad736359d58f9f0cdedcdbd07fcc8971144f1eefc5a913e18bf39362dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713305428, "uuid": "d7b1db5f-9d87-4b06-9f71-7b8a3fe9beac", "comment": "Malware payload", "value": "515c4e812dee2fd8cfbf630e88cf55fd41d36acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713305428, "uuid": "49cd7182-fc4c-43a2-9d0b-e84a89a3e82d", "comment": "Malware payload", "value": "92c2cd5a3c5073eefd318b0ebabe794f08f2ff8d6313caf68d29829b88cbca9ec06b5df74d17b8438e2fb5f35458a94e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713305428, "uuid": "05d6e087-34b6-4071-91c0-8b0df097258b", "value": "T17D263362F3D05E7AC1D6007A850F57844AB6DA152F4FCE1B23406A2E8DF96B4B77E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713305428, "uuid": "dce8d02e-9b83-4a84-b19f-9d3b5c55cb2c", "value": "2f93cd80e5dfeca07d7e8b0f35545fb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713305428, "uuid": "93e2f766-56ce-40dd-bfad-7d9bd547dc35", "value": "98304:h2m/Mw4Ktv0m8I33U5/AQljqOa78ORFGvwbtGqxZ9f3:2Csm8NuQlA8Jvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713305428, "uuid": "91b298da-5505-4da7-ad66-838c2ade44c7", "value": 4498432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713305428, "uuid": "ddc4eb7d-4835-49c2-9dd5-df376cc2c1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713305428, "uuid": "be550278-1822-4763-be72-bb360b159719", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02289b1-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713234048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234048, "uuid": "e6601ac7-4cab-4311-88e6-15c1bcfaa653", "comment": "Malware payload (Gafgyt)", "value": "6c07b7a1e1620ea81fc68c5c92226155", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234048, "uuid": "b4427d04-031c-4a56-b4fe-c9ce55036527", "comment": "Malware payload (Gafgyt)", "value": "4e128016c5771ea3ea369f9d1ce1432e664353d2212903b55421910dd8ffd26e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234048, "uuid": "b19a6fcf-0c42-4e2b-8b32-9341c79d4b36", "comment": "Malware payload (Gafgyt)", "value": "4d591480d74192d7a8ff53d121286ef5373ba93a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234048, "uuid": "94b6e132-655a-43e8-b75f-2d9b18a79937", "comment": "Malware payload (Gafgyt)", "value": "89dec1c27ec80cc506e0a9407be5cad87800616a090da7223d5b05c44f7af0f86198b6b1cb30b248ab5bb98a692cc335", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234048, "uuid": "cdc7d135-3252-4e43-8958-dc463df8de99", "value": "T1EE932C87FA42CE73D06310F016BA6B614971F9FB1C23D682D7647DA0DD611C25A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234048, "uuid": "e642790d-24e6-4db8-936e-83756d778122", "value": "1536:yaw5154UaVgnQYVZt/jEOOjVvRvjEWavARXBrkMz9Oyx/J33RHZvUg:LGG14VZBIjVLYAvrbJJ3BHZv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234048, "uuid": "9867ccca-bf49-4a0c-b97e-46e6011a185a", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234048, "uuid": "0dee634d-1724-44dd-9ccd-a3d17a79ad6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234048, "uuid": "2a12cdb0-c84d-430a-aad2-46aac73b95ec", "value": "6c07b7a1e1620ea81fc68c5c92226155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a040038-fc0b-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713283510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283510, "uuid": "b5f6d579-5f9c-4f8e-900b-b9c3863f6558", "comment": "Malware payload (DCRat)", "value": "3b8b335babae9d4a73824efe54aa2148", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283510, "uuid": "a410714a-436b-4538-8ca6-bfb228ed24d7", "comment": "Malware payload (DCRat)", "value": "4e6333e4c4cb032d90a01f0499d63346da93f702ef1bc8aa6a0b0a8cad912354", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283510, "uuid": "9cbc441e-d547-421b-af00-577f9d9eff60", "comment": "Malware payload (DCRat)", "value": "ebb36ea7e8702f50272952071c18f362b0888003", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283510, "uuid": "cc439cc6-2878-47d6-a2f7-f1de63373176", "comment": "Malware payload (DCRat)", "value": "02bcee44eeb945a82ad448085f688dd769b651c7c7ab02a84ca9fa414c2f95993b95f09bd16e48d0d3d60a5a9dff6607", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283510, "uuid": "bc2f16de-961c-4251-b7a7-b90ba3658e67", "value": "T10A4531342EEA502AF173AF7D8AE47596DA5EBBA33707985D00B103C60723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283510, "uuid": "d14ee400-6ec0-4329-8548-b61406aba758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283510, "uuid": "b01def5b-b3aa-4325-8fe4-078a088893f9", "value": "24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713283510, "uuid": "ce67cc4f-410c-4907-b4c0-866cc351a11a", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713283510, "uuid": "514d9877-6ca5-4b18-a90e-04b1a453e27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283510, "uuid": "a8cf9932-f030-4fe0-8b6a-dd603508ee9f", "value": "3b8b335babae9d4a73824efe54aa2148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88928ca1-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268234, "uuid": "4fd50bd5-1d76-441f-b98d-e0001171e6c8", "comment": "Malware payload (Mirai)", "value": "bf1200bf14f6b52ed1ef8b75568b7753", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268234, "uuid": "d2d0a7a0-1bda-4a2e-8c10-ced9b79ac2da", "comment": "Malware payload (Mirai)", "value": "4ea6db5fae8679b110af1cca107bcf470b60c1066881bcd25aadfe70332b73a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268234, "uuid": "8120dcf6-89f7-4b37-be39-a023e63a12d9", "comment": "Malware payload (Mirai)", "value": "6e26847636874e541cfb48c8adde88b8cff17e1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268234, "uuid": "08ac93bb-40dc-4e6a-bcc0-263f2764538c", "comment": "Malware payload (Mirai)", "value": "1ee1c012fd598dfa7b4f048991ed53298c1bf9365bacb18ac1cfabf12bab8513490f94c1c1555db1234391677366e353", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268234, "uuid": "0e3b443f-36ae-4dbd-a63c-9c42a57a9fe2", "value": "T13CA32A86BC419A11C6C10677FE2F118E331257ECE2DE73139D245B607BCB81B0E6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268234, "uuid": "d66baf6d-e8f3-467c-b70e-35056fa4748b", "value": "1536:uxnkY3RS4sAjoGiIANTThKcNe5zVMN6WCPJadO5b8MVicvwR8KRz/5bYi:83c4MGET1AhMEfRaGvwR8KRz/xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268234, "uuid": "36dca750-e443-4c52-b6cf-0335ef6e2519", "value": 99468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268234, "uuid": "02d34bdc-8b20-4f0f-80b3-67a7b8f11d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268234, "uuid": "f30a3ec0-e2e5-44f4-830e-b9f8473b6355", "value": "bf1200bf14f6b52ed1ef8b75568b7753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e151b50b-fc36-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713302313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302313, "uuid": "ab256a2b-21bc-48ea-bb7f-50df466bae29", "comment": "Malware payload", "value": "0820b1d34fb9c3ea2831e889d8e1d477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302313, "uuid": "a531377c-054f-4c5f-804b-32b84e0de16c", "comment": "Malware payload", "value": "4f16c358a21341ad3fb5a46dc87e1cedb74759373ef97df755b8660ff1e6211c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302313, "uuid": "4c6ca949-a762-4f9f-a8fe-50846c9de663", "comment": "Malware payload", "value": "21f55497fec08821cfa22ffc9f8c2afa08cfa11a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302313, "uuid": "b690e9cc-0650-487b-b784-507d29cb137a", "comment": "Malware payload", "value": "08b7a62a630aa093b962b8a5faf21451e27e460c4ca4bb21b72e1cc2b265ed7775c49e6228ad32bc42378789eeeb567b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302313, "uuid": "d0834e62-f3e8-47ae-bab3-0638bafdce4e", "value": "T140F3D07A6BEDE32DC17D41FCAA353B3952483F0833424C7A958E80884459B5E768B5BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302313, "uuid": "d81a2530-968b-4ae7-b4b1-5918cb96ddbd", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302313, "uuid": "688b0143-a17d-4b42-9b3c-4c771baa5f9f", "value": "3072:UUL4GpcmHp+G4vtwVsWDVLQf9mSuMXUcNi7kG7m3sq0YHFnHJSp8Bb8EG:WGp0PvjWDVLgL6IsMz8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302313, "uuid": "7a5c4b95-f349-4980-b39b-3211f0129d62", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302313, "uuid": "05894994-0c4a-4f53-814b-613e2e5d1f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302313, "uuid": "c609ea8f-51aa-4ab1-983d-46960fa7d9b2", "value": "4f16c358a21341ad3fb5a46dc87e1cedb74759373ef97df755b8660ff1e6211c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5110a59-fc32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713300628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300628, "uuid": "0c3503fe-a2ea-42c9-9909-674cf75ac1ba", "comment": "Malware payload (AgentTesla)", "value": "c85149f68536d2bccb60ad32e88d6895", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300628, "uuid": "0dcabf6a-83a5-4bf8-aede-f2d8f4e43952", "comment": "Malware payload (AgentTesla)", "value": "4fc57cfe6ad19b764721faf9215457a09ddeebc7402c8833f290181af0b20d5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300628, "uuid": "3085a0d8-cb23-4a82-980c-3360edd0cc50", "comment": "Malware payload (AgentTesla)", "value": "703e4b9d6db31ad5b83048b3ebf2fea81492df02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300628, "uuid": "79323ee9-2195-4d11-aa71-27055b152f3c", "comment": "Malware payload (AgentTesla)", "value": "9af8786ec049117544f48fae9de28bb03c09ea2e0f4e9b331bf86cc659bf0b683d225a6bee674e8c50714cb20cc17871", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300628, "uuid": "f976e83e-ae8a-45e9-bb0f-5542099cbbef", "value": "T1BBF4F1583AABBF26D47C87F2696298204BF1B05A7D71E25F0FCB60D61960FC14581F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300628, "uuid": "b33f819c-c8b4-4646-8310-a64cebcd6bfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300628, "uuid": "8b2ea3df-a37e-45f3-8239-794febbec9e3", "value": "24576:3/zD1ArxfnREzkQsImlHqocz5dqIzmarw7w:3/tixfmYQsxFPudLSar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713300628, "uuid": "a5dbac1c-3053-46eb-96d9-a2ce554a058a", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713300628, "uuid": "ebf0f0e4-1485-4491-b535-b870cbc5eee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300628, "uuid": "5949b1e0-7495-4ccd-8f12-ae448460ce31", "value": "z34PDnVzyEItkXaInw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2922150f-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713251753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251753, "uuid": "cd40cddb-fa53-430e-92e7-60c926415326", "comment": "Malware payload (AgentTesla)", "value": "97f5114d90d7ddf5c54761a51ebac866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251753, "uuid": "f9932659-66d9-48df-a422-f29292f04500", "comment": "Malware payload (AgentTesla)", "value": "51113f159f130fe34c4df5acfe467a7be8cccfeb353106be400083f4bfe9d9a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251753, "uuid": "9d9ed5ba-d58e-486e-ab41-cc83f38bce10", "comment": "Malware payload (AgentTesla)", "value": "75de6c6a2bb7fb82cc5aa7d064b4447aea3b0a1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251753, "uuid": "c81c7438-3604-497d-814a-3b73a2b64d1c", "comment": "Malware payload (AgentTesla)", "value": "ac1bf563062e2298dacd933fa7ebdd5b7da70218ac9261ef9333aa3fc811ec49ef65f2d5df278536e1709783cb1b59f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251753, "uuid": "9c81e4dc-a50c-4110-8ad6-2b1ec3f00cae", "value": "T110E423F107FC959D76220BA58E08D84E3A4E9F89F59CB07281D684C85DC14FE32E6DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251753, "uuid": "6a9bbf17-925c-4918-bb42-343f2e3ab3bb", "value": "12288:Q/ASB36TkDPajOAOssN+eptAQ1TIMtqoPNAd5N7/M1BkFTN+wHMr9IFMM7nt8ZcO:Q/JgTEPajOQepthTI2WT/pnHaSHZ8rTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251753, "uuid": "8035315f-4217-4b8a-88a9-42e100932172", "value": 686790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251753, "uuid": "404ac958-830e-4e9d-8cbf-861c1362e9ed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251753, "uuid": "4f513e12-f37a-4276-a138-f5517366dbfc", "value": "PO00221.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e9cc9b-fc2b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713297380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713297380, "uuid": "45348532-e25d-4cba-a700-5dae22c8fa98", "comment": "Malware payload", "value": "40c1327a5e779638cb6fdbb72199a4e5", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713297380, "uuid": "f2f880fe-ac46-46e4-ba1d-873078f8e0be", "comment": "Malware payload", "value": "51ada1691977df7ef25be23f58da9df22a1dd2ee97899d4033625a3813913bb3", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713297380, "uuid": "c8e12713-61b3-47c2-ac42-87c469380dcd", "comment": "Malware payload", "value": "5214cbc9f857f7f30eddef9697bf2e37a840f143", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713297380, "uuid": "1cb8f692-d1c1-41bd-951f-e66bd2219a7d", "comment": "Malware payload", "value": "cb8a1e744f0d74c8a640981600741162b8afe8cf3c90ae9ff569375542523ea7f1974b444926f54c49f5f7b77ef5413e", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713297380, "uuid": "14fe121c-591e-4cce-b878-044faf0b60ae", "value": "T114C433708AA292D01C714EDF9C4F4CB39369D2970DA2447F43A1DD9AC6CD8C8ABAC167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713297380, "uuid": "915fc8ac-d610-4ebb-bbb9-dc96d1c7b4b8", "value": "12288:V/Xp3wA9QQknsnh6eCNjSJ03/ElJcL065D18P2nVeEq:V/5r9QF8MeCN2m8+7D18PT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713297380, "uuid": "66703cae-c6ac-4f21-81fd-edfb982aac70", "value": 566101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713297380, "uuid": "a75ac6cd-61f0-4457-a01d-37ebad157182", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713297380, "uuid": "883af0a5-0275-4218-8997-60df52173d73", "value": "milan_eskuvoi_fotoi.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca38fb6-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713251759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251759, "uuid": "775fac5b-baf8-4ae5-8ed5-6ce34ad3ad8c", "comment": "Malware payload (AgentTesla)", "value": "4805c823c5445ceb4a347dea192b236b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251759, "uuid": "be1a8ec9-9fc9-4da3-9fae-68d529866574", "comment": "Malware payload (AgentTesla)", "value": "52c1ab603123e759e291e2f875bc4e7894b8649cc6b9d6e85d1fbc15801c3dc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251759, "uuid": "0ac2d90a-24e2-4f6d-b990-aebd25685c5e", "comment": "Malware payload (AgentTesla)", "value": "8eee88661870757d0dd7ca7986cdd8057875dead", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251759, "uuid": "20778c14-3809-411b-ba4f-23367cfb3a1b", "comment": "Malware payload (AgentTesla)", "value": "4431d35ca46f681fb6eef67b4d6addbfc7837ebe128447c0c64f7e33545dd8c344f004038a72d8c652d8bd4ba61a5544", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251759, "uuid": "b7b1295f-e112-4a7f-b90f-8ab62f04838d", "value": "T1D4F4124173B8DF32F2BB17F414B865A10BB176A2B16CE70E6EEA40D51550B818BB4F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251759, "uuid": "ce5c2eb4-7f36-41bf-8abd-ff41ceb0768e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251759, "uuid": "06fad944-685b-4ff9-acd6-527dcb2ff59b", "value": "12288:IMtNBJfgAwSGc6vREhkZuywInMdUTSb41MK/Vziw1oc3igz5uEBOi6MyGtkR:VtNL8SGEhk1wInMdUT/MK/Vn1ocSg1uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251759, "uuid": "38ac2234-4829-4f5f-a269-e4fc06367ae8", "value": 784392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251759, "uuid": "cfd915e2-e33e-4dc4-9ebf-4e64384065ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251759, "uuid": "777bf3e3-9b30-46dd-ba65-d4cdf6825914", "value": "PO00221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5711522f-fbbc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713249682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249682, "uuid": "3eb99f96-9801-45cb-b06e-89a08230d193", "comment": "Malware payload (AgentTesla)", "value": "8487896063e9aed910f0549ecb578815", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249682, "uuid": "fd30c9f6-b7a7-46fc-af9a-d7ad6a126586", "comment": "Malware payload (AgentTesla)", "value": "5429ee6ba99710255150c278583cff5aa5550fa9fe9988e99d049cb132f304bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249682, "uuid": "7b14205e-4dc1-4060-9db2-a1ccaa344477", "comment": "Malware payload (AgentTesla)", "value": "27f7e9999f94dbe0ad2f91795fb1fdb958f5db5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249682, "uuid": "e6b7ba62-56c6-4d95-94e8-3f6b744a029b", "comment": "Malware payload (AgentTesla)", "value": "3f072085753c1577b81a498b40bb04a86442a86198da5046b64ed3001cf569948cc3f31d2dfeae5b1be7c68fc8033105", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249682, "uuid": "b2066339-478a-4619-a030-d5d20ffd6aa3", "value": "T1EA94AF5263ED5008B2B33F04A9FA91258B3BBEDA9C79C54D058C5A6E0BE3940CD757B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249682, "uuid": "9848158c-b669-4de1-b0d8-483817de64e5", "value": "3072:qHGRGh6YFEhNe4VTdRnTT8w4TWXZqbEgOdpe+og0S7rQzS18f8d6bb/g52r:tGh6YFYZq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713249682, "uuid": "fddf9b24-25a3-4ade-b6db-0b135bd948c4", "value": 409108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713249682, "uuid": "b4358461-656e-42a3-9453-f4cb54ed757e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249682, "uuid": "2edf5f5e-ad3f-4079-a8e1-b14314269229", "value": "DHL Receipt_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1f994e-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302462, "uuid": "7be353ff-ad4b-4eb8-a3de-5d7ff3f76085", "comment": "Malware payload (MarsStealer)", "value": "588fe99f2631db84a27bbfceca342f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302462, "uuid": "2cfbae89-342e-4cc4-9356-45ecd67e2e0d", "comment": "Malware payload (MarsStealer)", "value": "5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302462, "uuid": "10f0336a-c9aa-45be-9889-a21734d41ef4", "comment": "Malware payload (MarsStealer)", "value": "84349b654c2f549d85dff6c3a548c7e11f79a5e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302462, "uuid": "aa8c6f6b-8eca-4ef5-9e7e-0a7ab41c41e3", "comment": "Malware payload (MarsStealer)", "value": "2c1cce62e8d6f6861223283c5e2b0bf96904a86c4b46f146d90ee326b3cca78cec476bfa741e76f319713de029ee3b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302462, "uuid": "96b0baa5-36b3-49d1-9bf1-36b6d3097e12", "value": "T1B325C83838EE501EF3B3FF755FE4BA9E999FBA732A065459108103074A12D81EE91739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302462, "uuid": "23bb99fb-e1af-4def-afdc-796d504d328e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302462, "uuid": "71090fe1-3a49-49ad-a506-dee3cfd020e1", "value": "12288:Me/cwY1icfinL+r3FI4PpJEtpnxnI+UejPFnOVy/:/YTr1IDtpnv9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302462, "uuid": "15473ed2-be9c-4547-be45-2a5419947bbc", "value": 1058103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302462, "uuid": "1f2383b5-fa95-402d-a8ad-df172476c65c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302462, "uuid": "639676f8-8181-4eed-9fe6-6b5337460e2d", "value": "5452dc39044f0d4fc32236dda5c4ce986ae5aa33e6e1b653b3ed53fdf1ca745a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88d0e5c-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233928, "uuid": "9ec2487b-4e73-48e6-9b80-c5eca81adae5", "comment": "Malware payload (Gafgyt)", "value": "dc8836c838758ac372558f5ac93d3d56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233928, "uuid": "5580877f-df1d-436a-9575-8174df486953", "comment": "Malware payload (Gafgyt)", "value": "54e9786ae1a7570005cd32de206a70ff4dd416a53643b43a023b4b710a633633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233928, "uuid": "c43dd197-49b8-4492-920e-f7b570fc632c", "comment": "Malware payload (Gafgyt)", "value": "fdef27311c0648ecc082b73c393681cb90ab7342", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233928, "uuid": "2ba252d5-0276-46ec-9211-eb37dc91115b", "comment": "Malware payload (Gafgyt)", "value": "2ec5c4a7254aa36aed1db49c8e43bc7a87ce3936fa63fa591e51c5e20dc8e1dcf15e9e655d0b165a1e9f0633b6dd48dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233928, "uuid": "599e07cf-4772-4a53-9b28-8997f518c8b9", "value": "T1AAA31866BD018F43C1C315F3BB9E46887B1667F9D3EF3203E935AFA0275A4D60926984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233928, "uuid": "82f64d28-62fe-4a2b-89d7-40920edc3f7f", "value": "1536:kVgB/g49JX90k6DFXdqFBODicPCuor/OgiWiR3q2kf4qaOqzMY5hZpyaEkq:kVw9JtD3PkigoIRxy4Lbh5hZpyMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233928, "uuid": "cc0ecd24-9040-49fc-b7ee-fa973cbcca39", "value": 104084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233928, "uuid": "a7ad8dd3-8acd-4e00-8fa5-b1c6034624a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233928, "uuid": "0bf0c996-fd4e-4757-9dd8-71fbf4c0da64", "value": "dc8836c838758ac372558f5ac93d3d56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3a332d-fbd0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713258286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258286, "uuid": "bc08e9d3-12bc-4592-ac77-ca75d7f40533", "comment": "Malware payload (AgentTesla)", "value": "ee5c7bba5851ec392238a45a3a8fa08f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258286, "uuid": "c847369c-204c-4d1f-b3bd-750ccad1f70e", "comment": "Malware payload (AgentTesla)", "value": "5586751de290b907937845cb29c222d012c98e46fb2ab28d5c71ab2d5454bc70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258286, "uuid": "89ed18ee-ebbd-49ac-a693-b01b28d655e5", "comment": "Malware payload (AgentTesla)", "value": "88abb7bb8a1149a39098c46eb729c21be3a34a65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258286, "uuid": "6ebac0cb-7b92-4f01-afff-7c2123e8060f", "comment": "Malware payload (AgentTesla)", "value": "538bdda6dcb9941634252a4a1852084e593e120996bbb0414000d487d173d97b226a76ffb48f9f2195958c0dd31ec422", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258286, "uuid": "8ffac122-f8b8-48db-8cc4-06d5b3030c15", "value": "T13AA423E14A4C553FA9F6AFBC86C389CB2B75C135CA0DF1427B17D6E0D4AA12221D178E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258286, "uuid": "f273e31c-ca27-4bbd-b620-e719646f12c9", "value": "12288:3T+RoIgWEXCkF62fnIDM/iKbFTa7s1AtmhU:3T+RzEPHfeKF+aAQhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713258286, "uuid": "ed0ad299-6f1b-46e0-b1e1-b5365f983b9b", "value": 484528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713258286, "uuid": "2d626f77-86b2-4d30-baa1-113ccec73154", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258286, "uuid": "85cfaf12-8c1c-41a7-bcbd-9993d92233c8", "value": "Unconfirmed 790542.crdownload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8e7923-fb96-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233617, "uuid": "7563189c-2fc4-4598-bab6-75498cd10228", "comment": "Malware payload (Mirai)", "value": "288e87c97240130317bb96e61d5ed0a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233617, "uuid": "f68cc74a-b3ae-463f-872d-d97b6bcc9488", "comment": "Malware payload (Mirai)", "value": "55e0776fe58319f45d058fe2c4b1ef41767e1a8b0c497624f8da1421792481c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233617, "uuid": "5ce0c821-7102-4b42-a7cf-2cb5afdb96ac", "comment": "Malware payload (Mirai)", "value": "4789be1eb3cace6284ac8e0aaa485bf34ff44cb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233617, "uuid": "cea85818-d21a-4649-8ca1-9f665d1d23d5", "comment": "Malware payload (Mirai)", "value": "9978687c4d801f7bfb4f00fbc84ded0681158103f1ff505283f3c6d5f5a2f56137c3216a1a5380d9b854d6730f46b97c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233617, "uuid": "4850a957-80f6-4949-9917-42632f715450", "value": "T199B3B34DE9649B29C7E332FFFA5912CE722A0BDCB3EA70119E310B513BC8E565935121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233617, "uuid": "ad22ccf1-b898-4573-a5ea-fd15ba85adf3", "value": "3072:x4TO9IYjy/bJS6pG+cT08MQgvXkunx95P3S:mpBl/kJo8MQgvXPnFPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233617, "uuid": "a489d2d9-00b1-4694-a107-0c8a0b549e5b", "value": 115868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233617, "uuid": "d2b55a24-edfb-4b44-85e8-99565f27a6bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233617, "uuid": "39985d02-aa6a-4685-b162-7b6aec284d63", "value": "288e87c97240130317bb96e61d5ed0a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4daf3fc-fc19-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713289890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289890, "uuid": "2b18833c-552f-4d06-89a0-4b29e67ca988", "comment": "Malware payload", "value": "b504eb2fb8e625e6967e4bccad1088e8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289890, "uuid": "04344612-e6ea-4123-90fa-ce199a7587f4", "comment": "Malware payload", "value": "56c93c26d3305315c2c63442163c6f8d22a6c425013bfe9ee0007849a7f8426b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289890, "uuid": "71dccf31-c4f5-4b42-a27a-50ba3a939e30", "comment": "Malware payload", "value": "9ca5a29c1f66de5367c30854adb9ed173d7a3fed", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713289890, "uuid": "d59a19eb-f722-4533-9fd7-f8d9896d45cc", "comment": "Malware payload", "value": "f87123df8d29424dea08b4d300879b49f6c85468d6e8f646bf5fc7b0d32e20e3cf5b6733eaca129e4413fd47a5ede306", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713289890, "uuid": "3b6d2c46-a918-408a-b27a-bfdaf739fcca", "value": "T1B5D2E1AAC61D6054DF0165B175C7BE74A09458872DAABB06F6127E9183C0E0CAFEFD4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713289890, "uuid": "88f0c169-4db7-467b-807b-53188a373fa8", "value": "768:I+DjklfoxTKo7eI18lhVzEGtD7JkLg7/swgUCQy6xGHr:I4qo4ZE8VKL8m9QZUHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713289890, "uuid": "5632073c-3e59-4732-b249-b80219e9f901", "value": 29421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713289890, "uuid": "e878f51e-6a8f-49f1-a586-80c76984675b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713289890, "uuid": "60dd42e4-a2dc-4ddc-b0a8-9ae3942dd14b", "value": "payload.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec422861-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265395, "uuid": "f0c42de4-491c-46cd-b368-af94f6908d93", "comment": "Malware payload (Mirai)", "value": "eccc6c448ce76cb511c4fdaafad4cd35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265395, "uuid": "82206627-94a0-411a-87e2-3b2eeab4bf5c", "comment": "Malware payload (Mirai)", "value": "587b201b03ee679dcfbad33b73926e5279e5fef7f044780438f66dfa0f1ecea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265395, "uuid": "ec913005-ae89-428f-8827-8fcf05634202", "comment": "Malware payload (Mirai)", "value": "73c4cad2372bde75f77969915a44cf0a39a55a38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265395, "uuid": "03987196-e686-46df-828d-00d6ca6f91f0", "comment": "Malware payload (Mirai)", "value": "f7228c5806b5aa29e341c74a195d70fb48eb0d4cf393965b55f1f5cdf68658871015002c5d6d4360eae8e0036dd2bab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265395, "uuid": "9ddc3328-d80d-4ac7-b8d1-4a4bb675351c", "value": "T1755329D7F811E9B6F809E7374C5348197371F2A10A931A726357362BED3A1A8146FEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265395, "uuid": "58053ce8-b2a8-4c52-b356-990dacc403ab", "value": "1536:q6ckksnB8k2qmZBQeuacWjcW0JcWcByUEa+/fLv3AghlMjONkF6Y:q6cuUqgBQeuacWjcW0JcWcBD/+7vnXkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265395, "uuid": "8302e6ee-5fbc-495b-ba82-fae254ef8bd9", "value": 63680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265395, "uuid": "efbc1741-9f9a-4103-b0f3-10837727e5d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265395, "uuid": "77d561e3-3dcf-44bc-9729-9d74c657538f", "value": "eccc6c448ce76cb511c4fdaafad4cd35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe4e235-fba0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713237779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237779, "uuid": "8d4625d0-2ccb-4f31-89b1-9e356a6cd248", "comment": "Malware payload", "value": "32fa14b08b44ca01e329bc63d5e2c304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237779, "uuid": "06e3529f-d5e7-488c-b8cf-80abbc367afb", "comment": "Malware payload", "value": "58e13e37e2d8484bda8ba700999ad4e78b88ef3f0dd980747e30533849a17135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237779, "uuid": "a68765a8-3865-4e2f-a03f-bb6862872907", "comment": "Malware payload", "value": "94104fe46c238faf3d5ba021f83cf9dde3415151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237779, "uuid": "bb369b26-f4ef-46ca-8276-1e877df4fca0", "comment": "Malware payload", "value": "a3547c79d93c86933da05b464cbe6fbd8c7dfe7c278ca067913ac7724b00f67ac47179a56dc118c0230fb8d22e609377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237779, "uuid": "18cc0934-874f-4cc0-8892-e9757ab1e5ad", "value": "T13AE3CF02BA9B8553C43C43320F51CB332E666DBEBAE187CE16C37D1BB762691287546C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237779, "uuid": "045ea58b-235d-43ce-964a-f7da8a1ae472", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237779, "uuid": "0c596076-94b6-430f-a2d4-7d917656cd89", "value": "3072:qyqC5LCMUYZsFmdFfVbhZejvcGJN6VOvnz3dbEnt6zA:qfVMFZ1fMYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713237779, "uuid": "3e3523ee-ff28-4f7d-9907-afe59f35d68b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713237779, "uuid": "ea7c31d6-f037-4306-9492-b7eb55b74b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237779, "uuid": "e88ffefc-1ff8-4c29-9fc3-0e556ff70f99", "value": "SecuriteInfo.com.Trojan.GenericKD.72333858.1744.9991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46ea6c6-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233948, "uuid": "0f686024-38fe-4e90-b2b5-07dce3bc4163", "comment": "Malware payload (Gafgyt)", "value": "8ed2db72c328bd911538d1b79ce0a9ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233948, "uuid": "d5a26faa-3ccd-4ab6-b572-1323debba39f", "comment": "Malware payload (Gafgyt)", "value": "58f115a8bb05a2a034b68b75ae1c5b83f28e9606931b8352b18fdee2844186e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233948, "uuid": "115a908c-e6a3-4da0-9eb9-c71f18235eb5", "comment": "Malware payload (Gafgyt)", "value": "0d0d6dc4962dd3f33685a415a10330e7e99577c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233948, "uuid": "d1453146-d064-485b-84b1-f509b20c5295", "comment": "Malware payload (Gafgyt)", "value": "bed07606244ce5baba3d8d1d5194d4983adef8f7845b3dfc5ab905646cb9bbcf5b1b38ccbc631ada10632126fc4bff27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233948, "uuid": "261daaf4-c7f1-49c7-890e-f3b2cbb24d18", "value": "T1DAC34B33772A0A23C0E6543141E79333B7BAC7D525B55207B6A09FAC2F1A6D03963BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233948, "uuid": "ec62b3e5-e6a0-46a8-8bbf-34317a006e93", "value": "3072:KdMLrZW8Niqp6rYpphatfZ/zltqmPwAs85Yen:OMLr/wdYpphatfZ5tqmPwAs8Cen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233948, "uuid": "b160c99e-71f7-40f8-94d6-ddca9eecda4e", "value": 127276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233948, "uuid": "fd2b1003-d4f9-4428-8e64-9cf0d5a0224a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233948, "uuid": "051597ac-f418-494e-8744-e508ef9b7bd4", "value": "8ed2db72c328bd911538d1b79ce0a9ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b542c0-fc15-11ee-a120-42010a9c002e", "comment": "Malware payload (VenomRAT)", "timestamp": 1713287831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287831, "uuid": "30c21ccd-f910-45c0-aa65-673c3ab40a43", "comment": "Malware payload (VenomRAT)", "value": "a65e873839228c5b453d6effa5d14d16", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287831, "uuid": "bb009d65-0fe0-4797-97b2-c549e5e3f97c", "comment": "Malware payload (VenomRAT)", "value": "59c388b975d290fa525ffefe5aaecb011219ebd3121a7e79e913d980fb7af951", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287831, "uuid": "7e8f6e92-bbab-4692-92b7-ada0bcf8a549", "comment": "Malware payload (VenomRAT)", "value": "40be429e0e6b41061f3291d10e720eaebf32eda1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287831, "uuid": "66ce9c34-61fc-4b2b-bd73-feb5f331c138", "comment": "Malware payload (VenomRAT)", "value": "266baf4427f4273a24152426b81763209273adb0b0f322beb43a3c261ad4f43d2c0c565a1a4fcf4fa98950704afe7b0d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287831, "uuid": "95be4fb9-c847-4f20-b2da-7771cc9e56b4", "value": "T1E676E0F035C085F06EE36744A3BA3634A737452F3B26151F62E13B82196964FFA38667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287831, "uuid": "317e1e5c-ddd4-45fc-98f4-72ca24a69794", "value": "24576:ClNzlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllg:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713287831, "uuid": "be13a146-5c16-4d01-9f1c-418a7161e0b8", "value": 7221470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713287831, "uuid": "6386ba93-a1fb-4243-85d4-ec0a3efe8950", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287831, "uuid": "44164c19-1ff1-4ee5-8dfc-7d8d2283e80b", "value": "gogis.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf6c7ee-fc0b-11ee-a120-42010a9c002e", "comment": "Malware payload (Adwind)", "timestamp": 1713283812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283812, "uuid": "c33d88d3-c944-4cac-bff9-d90ef51cc16e", "comment": "Malware payload (Adwind)", "value": "979ba6af6f6adf0930ab75ecea1b450f", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283812, "uuid": "1952f104-bdd6-43c0-8c48-60bd2ab9ddc1", "comment": "Malware payload (Adwind)", "value": "59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283812, "uuid": "347101e5-516c-4ef5-ac02-62357e1f4b51", "comment": "Malware payload (Adwind)", "value": "1153c96b460ca99ecb21fd4eb3b90919ba827e90", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283812, "uuid": "dfc10cbf-0f12-4e2e-be40-292f0c43db44", "comment": "Malware payload (Adwind)", "value": "024156a8061e296f3c15ac719779bca7a966c2490fa0c9f6c1b7daf8ddc9572cad74f8e994317a78a9e34f7e9f9d4590", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283812, "uuid": "afaa1617-7dc3-43f6-a070-cc2bc167727e", "value": "T142D4230ECD6A6487B81943BDE9363625EC5549E7FE90C6134C0C4E2D0AB2FD5CA7B1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283812, "uuid": "11b003ba-ad19-4955-8c57-52f667a0af06", "value": "12288:FkQrFVhCTXI38nXLt1+VmnBcN+b/bYBGs4Ty0qZBZUjWzdNkE7LKJU27DG:v/hkYWbtqmnucbFIUjWzdJLKJU27DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713283812, "uuid": "c85ad6bf-5c02-4abf-8fd8-df21d84c0c8d", "value": 649679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713283812, "uuid": "ba01aaa2-7a43-46d0-85a4-a4206c6a9424", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283812, "uuid": "e3b3968e-7c6c-437e-b2f5-511459dde944", "value": "FEDEX-TNT OVERDUE UNPAID INVOICE980055177856..jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c1babb-fb95-11ee-a120-42010a9c002e", "comment": "Malware payload (TiSpy)", "timestamp": 1713233190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233190, "uuid": "d4e89a05-edc3-478c-b4fd-02222f439c34", "comment": "Malware payload (TiSpy)", "value": "b061e656a6d4f38a4c96463347e55bb2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233190, "uuid": "efcee72b-c863-4aaa-a7ef-12e8e2f630fe", "comment": "Malware payload (TiSpy)", "value": "5af15a0e1145cb99f3856b6470c2a18b544bd4385cf04703c46f41b26c42a366", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233190, "uuid": "cd9ea617-ad0d-4364-822b-19b998e2f012", "comment": "Malware payload (TiSpy)", "value": "2d0726873d11a4ea84664023fe60ab747d13d369", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233190, "uuid": "8cd12612-f908-4895-ad3f-c1c8d1144f50", "comment": "Malware payload (TiSpy)", "value": "6e1129548a88bf916d606badf3419d35e3166c5d6df4cc5dd5fa923f48f05bb7ce2d4016fe16cb25131fd957a2024d1e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233190, "uuid": "150a2c84-e8f5-40ec-8637-e4cbec6e8d00", "value": "T19BE51203E962946BE4FAC3762A6126BD21761C140783A329381C37FF667F9EE4F855C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233190, "uuid": "1b3afdde-f1ad-44c6-908f-b2a2ef6e43fe", "value": "49152:0HENhUnA4WPk66xt/gMAJekfLeA7cJU40JnF4yoxUjR4Gitae2ewpDjAjVY:0HENSnNWPkdleNeA7cJur4DWKueRoP+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233190, "uuid": "d6a7ea3b-e9d9-4f3a-80f3-e2ba1d312aa2", "value": 3263415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233190, "uuid": "22090c48-0196-44e8-a679-a50120eef2c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233190, "uuid": "2ec693b6-4e4f-44cc-85e9-62b17d21cf10", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9598ad0a-fbf3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713273410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273410, "uuid": "f164ea8c-ef1f-46c4-93fc-3221480da61e", "comment": "Malware payload (AgentTesla)", "value": "952c5b5ef3e1e8aefc2f1cc35d4d1ba6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273410, "uuid": "2fc4dae9-2e64-4418-aed7-ee93cb464eae", "comment": "Malware payload (AgentTesla)", "value": "5bd77c6c32f5d8767bc5d055f1895c4625e36d3f5556436d8be9237f526963f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273410, "uuid": "21f22841-b691-4ba7-8fb9-9ff72cd23842", "comment": "Malware payload (AgentTesla)", "value": "2f96dda30050d532c2de2575e25ea1f9431fba43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273410, "uuid": "e5d59326-6696-4118-ba74-e44165a7f9d9", "comment": "Malware payload (AgentTesla)", "value": "5149c402c7ef03b72db575abfb2ff761ad883acabf896a7bbbc71118b872bb23da88cce3028c58dbf340cb08a30b3551", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273410, "uuid": "23b160f1-f9ba-4485-adc0-48e57b90288d", "value": "T1B1D4228C72E7BB3EE6381B39D46745200B79230D3418E3561ED6A4D92BE6BC01D64FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273410, "uuid": "80673579-53a5-40a4-9f99-3c99af4c46fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273410, "uuid": "a7477f44-feb7-44fc-99de-caae218cffb4", "value": "12288:EpMIjXAzSNAYTzDJ4x29SV4UwCTeMnjGP9OEikFMav40fcNZjdjSaU:zeAa9TvwazCT1iP96kFOwajdea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713273410, "uuid": "d15bb209-4f2c-463f-9282-f0878f1a9ea3", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713273410, "uuid": "66fc424c-bdb1-4bc5-b736-aeb91b68a4dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273410, "uuid": "71015704-767f-4ffd-98bc-b829318f0288", "value": "Order #60-230958400986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ad62ff-fc02-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713279636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279636, "uuid": "0baad7c6-99aa-4afb-b4c9-6167a1763af3", "comment": "Malware payload (PureLogStealer)", "value": "74610276c52d19093bfc48ac34dc391c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279636, "uuid": "c6ad2b32-137f-423a-843d-b220d92abe0f", "comment": "Malware payload (PureLogStealer)", "value": "5bf6bff01e3a5371d8e839b002fcd48ce8b7b6a3bf029a5811dae4c6e10cdc6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279636, "uuid": "3c5daf5f-a5a1-4107-b215-e80b2e01185f", "comment": "Malware payload (PureLogStealer)", "value": "b33c23dd203f3787dd6ef067ca1f9b69ffb00869", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279636, "uuid": "2ff60433-9332-4306-b8e6-5b1c10a2514c", "comment": "Malware payload (PureLogStealer)", "value": "e045cf85c6545f2d93fa9c3c53e231295a003f64e22ff9bec014b7e4dd58c1589ca21e58cab062d779dec0fb792486ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279636, "uuid": "da747fd2-5207-49d9-8323-922c5a32ca24", "value": "T19134286817860A66F1FE5B37E4F265518774F8B0A7AFD38E184404EE4C77B8289D2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279636, "uuid": "60e90c36-bc79-414d-a959-9d71ed55861d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279636, "uuid": "475aa8ce-8fe6-42ba-87ac-1ca6d2547117", "value": "3072:dRRNAsvXc3zLU6Zm6+yQv6F6E/K5gNvk+g/yD1QrRe7Bjal7AdRI7zr3lMoft7GU:disOLIQ6E/K5gfg/K+07B9OzTGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713279636, "uuid": "69d95bda-74d6-48bb-a91c-4132af01633e", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713279636, "uuid": "75919398-974b-48d7-b8ba-6ede2e13497e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279636, "uuid": "47140412-36d5-4518-9812-c2a55e4e2b31", "value": "Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09160727-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248263, "uuid": "c7e5ca0a-3d8e-4e20-8c9e-ff8eaebe6516", "comment": "Malware payload (Mirai)", "value": "90d891382086a1a8f5e2e73ac85abca1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248263, "uuid": "9c0271f6-875b-4b1b-bebd-f95d4df0601f", "comment": "Malware payload (Mirai)", "value": "5bfec6b9fa11b2e6136b9a60af83a98b87c99d0b2fe8f1d2d8c023dc1f147411", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248263, "uuid": "39c35248-2116-4a9b-9852-e20e8c39d5c6", "comment": "Malware payload (Mirai)", "value": "84fc0da7479dfcbdfdbb0628799d9142911d680e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248263, "uuid": "0f89c06b-69a1-475b-aacf-393703cbd11b", "comment": "Malware payload (Mirai)", "value": "c6d473506bcf27c58337d6f4be95945362a518e52885b0aeab2b81d87a9fc3a821ab35e7e7ffc7a09cb3fa01bbe6042c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248263, "uuid": "e6675ab7-7b00-49c0-aee4-8cfbb6967681", "value": "T10C144B0775C090FDC4DAC1744B9EF53BA977B0AD1239B12B2BD4AB221E5AE314E2DE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248263, "uuid": "a64fc072-93ba-417a-b4cc-265db22c9131", "value": "3072:45TktNb2VUf4dY+AxRb9/qoem+2JE7ZAdPMvhfRHSj8wz:45T+b2Vk4dY+AxbaAFopSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248263, "uuid": "5a1e8229-d455-4bf8-ab2b-11cba4815d8d", "value": 195160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248263, "uuid": "b8230bca-f445-4abb-8a25-cd962c95816e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248263, "uuid": "b2a7061f-9f3a-48f0-a408-f4c1d7efe8a8", "value": "90d891382086a1a8f5e2e73ac85abca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc6b0f7-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233993, "uuid": "92921d46-25e8-4e38-ab4a-08e76af9e629", "comment": "Malware payload (Mirai)", "value": "80fe08742a588d467267c49471cf4743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233993, "uuid": "57de4148-84b7-4a8a-9fd5-883fbbf9da1c", "comment": "Malware payload (Mirai)", "value": "5cdec05a740812e1799b29579b0397bd2c5140402cb0852ad3522b36059d22a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233993, "uuid": "7a4c0e36-87f7-4e39-826f-0d0852fc48c4", "comment": "Malware payload (Mirai)", "value": "50c5e3d09f0b5ad2bc30ce1b02358a1d0422204b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233993, "uuid": "299c4fcc-479f-4846-a721-42c6a0cef7e1", "comment": "Malware payload (Mirai)", "value": "7710e423c09cc1bb41053ac3b3573f19ff9ad12de1f6dbe2e1c9254308f3391db01b57c563ad44da960c3dcec3e8d232", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233993, "uuid": "b4702c0d-89b3-43d5-b7a7-dabc9aad25cb", "value": "T14063F755F8915A26D5D062BFFE0E128E33132BA8E2DE3213DD157F2037DAD1A0E2B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233993, "uuid": "2a23ce00-782e-4b19-91c7-4089dcab6e2d", "value": "1536:E3nhaQqSXTp/SjwL9RhMfXuWfRTxtInarPYtUVsO78v6SKJ:0LZjp/SjwL9RWfj1xIQ4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233993, "uuid": "5f6b9bc0-3be9-45f2-8d02-c1af9271392d", "value": 70364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233993, "uuid": "51eca617-cce4-4b66-850a-e96ea8e18eed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233993, "uuid": "65c82297-8e63-4bb3-ae7e-dc40ef48cb49", "value": "80fe08742a588d467267c49471cf4743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eda0451-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713281505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281505, "uuid": "26648ad2-ee30-4283-84f7-9e4395646e4f", "comment": "Malware payload (RemcosRAT)", "value": "2244bc077c05fd2f5a67fa7ef72559ff", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281505, "uuid": "23ba6aab-3179-4dad-b5eb-88f35415e11b", "comment": "Malware payload (RemcosRAT)", "value": "5d09b001c18384a9d5e8b31b9c4ee5ed77082e0a9b8783c34b3916b1534d2c21", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281505, "uuid": "82383169-029f-4b46-a453-05d162bc6689", "comment": "Malware payload (RemcosRAT)", "value": "a5e42c663a4eaf0468b903ca7aa1f264edba32fc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281505, "uuid": "c5b8b9c8-2d5b-4364-95e2-b445271a60bc", "comment": "Malware payload (RemcosRAT)", "value": "c9c8823d740fea8e27c7e820e632a0eecedd4883cdab2fa87f52ced75c3caa3347d6ce98f729bb51b9afc76d92f7af14", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281505, "uuid": "f4bf06f0-4c42-4a0c-8cc5-a5e2fb3509f3", "value": "T14F64DF51FA818616E466433149F78A9B6335FC519F924B0F321CF32D3EB03A56E27B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281505, "uuid": "84532851-1da1-4868-92f1-436e9edea562", "value": "6144:FuunJRXmY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVM9MI248sD69qlDl5bpI:FvJRX/3bVM9MI5N64lDjihGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281505, "uuid": "6a224be9-0501-48e9-996e-b6fc35eb2d2e", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281505, "uuid": "6fed58ab-53f2-4812-8426-f57f0e3d30dd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281505, "uuid": "bb71969f-0aa3-4fff-960a-ccbb9a9c4db4", "value": "P.O.109961.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fca82b2-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236785, "uuid": "f907ab52-1ffa-4ca6-9675-4398ac8b5350", "comment": "Malware payload (Mirai)", "value": "1e6eb9c6871b4898be8def76c514a951", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236785, "uuid": "1cea9cff-c67d-4fab-956e-e099c0cad748", "comment": "Malware payload (Mirai)", "value": "5d3c3ee1c4a328f2453f0f702c5ba1401a2a2909905de7ec36f278cb5afcab6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236785, "uuid": "ddd92d49-5252-4a7a-8194-1660321b5fa4", "comment": "Malware payload (Mirai)", "value": "815016ca93b6a982123df76c63b71a34c53b4585", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236785, "uuid": "21a4caec-6a82-46c0-a01c-0adf84dd9e40", "comment": "Malware payload (Mirai)", "value": "dfe7572abd6e1ecb0a592c11bf0b4369549a1453e3775a13d732fcf02fe195e36aa89e050ce6c0f1e41995c565d9ff8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236785, "uuid": "4084cd48-fa33-472b-af7b-e9f132f92562", "value": "T1B9434B5172280B17D0932A70353F5FD09BBEFAC021E0F686B99F9B968935D334546E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236785, "uuid": "1efc1dba-f26a-4762-81e1-bf4230ed2d00", "value": "768:DaVVRLWYgnvRYDCi1jAZZkXaoXOqmPdjdFiT+eN4H9qKnZY10U3v:0VUv8CiNn6CTH4dVna10uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236785, "uuid": "76b4d76e-38ca-43c3-9080-58468ad86652", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236785, "uuid": "430ad0d1-b526-44ef-aad6-558871a8f1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236785, "uuid": "cb4ab907-a97d-4573-81a8-0d592da591d2", "value": "1e6eb9c6871b4898be8def76c514a951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c03d3b6-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713256026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256026, "uuid": "cd102dd6-b163-4004-a6b9-fd763f13dca3", "comment": "Malware payload (AgentTesla)", "value": "f2531a6c136389d1b485a6e91b727821", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256026, "uuid": "4e60d305-69d5-4703-b80a-bbec3d989a27", "comment": "Malware payload (AgentTesla)", "value": "5da4a0ab8f5d1c2098f5d37ec8a94e5824e7998b0e8aa094ecf9c78a33be4c23", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256026, "uuid": "e2b5b498-8104-4932-a9da-de6ac232286f", "comment": "Malware payload (AgentTesla)", "value": "95009c631068f0c126dc883e723c2c28ad089f3b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256026, "uuid": "eadb20be-2f73-4366-8247-f86e666d62da", "comment": "Malware payload (AgentTesla)", "value": "eb5411d87774cd9ec57ad77cd75ac60df227c94c793af943dd2df2b143fca1c92897f0cfae15c5f2c9b306c74e05ef92", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256026, "uuid": "9811b24c-7255-46b5-95fe-c0fd90dd8773", "value": "T10644237CFD106980EB8AAF1A3CF75D519D2AE7F70630E4F850DDF6182C4E892925D4A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256026, "uuid": "f4abe629-02ac-4aad-816d-3b650000eb65", "value": "6144:5XooyLhQfNBriuQYmI7G6xrfdVnbERcYGNNBVllYSpmx:O1QfNBeu3mIycrfBV7ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256026, "uuid": "966f65bb-9fb1-42c9-90cd-10835e04d806", "value": 261183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256026, "uuid": "cc0777f7-40e8-4faf-a80b-7f06bffd3d28", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256026, "uuid": "d9ab6b11-2df2-479d-829c-ceeb41dcc0a2", "value": "PO-178 ,PO-113 and PO-176 (TT Copy).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e621e0b-fb9d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236461, "uuid": "0f5ef2dd-e57b-439e-a771-9c1c7d2e2cb7", "comment": "Malware payload (Mirai)", "value": "7f3d1de6b4737a059a28281932727d68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236461, "uuid": "94580309-9086-44f1-b4e5-bf1f0c0b5295", "comment": "Malware payload (Mirai)", "value": "5dcdedfeee84e2d58af5ef35fb158d52da933339c140f58ade42812e984f9975", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236461, "uuid": "92214969-3c1b-4d78-8fd8-ec1cbe2943bc", "comment": "Malware payload (Mirai)", "value": "95fcca9625f2ff2838a358ec616fe5313d10aa97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236461, "uuid": "598f33e6-d325-483a-95ee-3980b8b843f4", "comment": "Malware payload (Mirai)", "value": "7d8e191d3bea0a2094245ce0c6557fea295a8214a8a32add1124206e0f229c5c0e085dd618f481754f39eebfd8114991", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236461, "uuid": "ca90a1d2-0295-4e42-8e59-7750fc677eeb", "value": "T102C34B46F7404F13C4D6177ABAEF42453322DB94A3DB730659286FB43F8666B4E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236461, "uuid": "8c59567e-191c-4446-9ae0-1b4a131d6aa4", "value": "3072:jmjwvZdoLPyTDsTIVxs3Vb0s67fmM/9IPKgzYCor6mWXpAsV:jmjwvkDyTDsTAxw67+M/9FcmWXpAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236461, "uuid": "39a289af-0a87-4aa3-8d69-439e0c5bedc8", "value": 129364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236461, "uuid": "bf5686a8-9f92-4191-84e6-c3294457eca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236461, "uuid": "45babac1-75b8-4664-afe2-27ccd985edd7", "value": "7f3d1de6b4737a059a28281932727d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583295c7-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268153, "uuid": "24953aa9-00b8-44fe-9fe5-3272abc1729a", "comment": "Malware payload (Mirai)", "value": "5983859e0217f7efb38dd215bf326be2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268153, "uuid": "fef4a7ae-4451-472b-9a6f-57c635296a65", "comment": "Malware payload (Mirai)", "value": "5e92122c2de27eadf25c4d6e53ed203eed6846099db1cd46b5aaa141cd6af498", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268153, "uuid": "78e17741-1f2c-4ef7-b4e6-02cfe4dae0f1", "comment": "Malware payload (Mirai)", "value": "2a9d56694c1ba4964f1c09045cd477386047845c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268153, "uuid": "eac28c05-b9bb-4cea-a255-5487ce0d5464", "comment": "Malware payload (Mirai)", "value": "3d3926fe46601faac12408eb08d4f0e58123c72951a1961d5b71b44decad0ebe5f1deb7d11bcb08f8039544237ef6c65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268153, "uuid": "d62acf94-16e5-4cee-811a-284badc4a1db", "value": "T1F1C2E0322B045522D4D01C7FEBFD918A3A8B48FDDD89B6057A18025CFAD11ED357DA27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268153, "uuid": "ebafa05c-4729-4a73-b510-93a10af632e4", "value": "384:FMrRazJ0569cyRyf5hZE9V0RG6ugvIW1UEPvg+u+ISbJz/w6mdGU5ElG+r:gaGg9Yf7ZE9Z6Jvd3PvgHkZw63UqGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268153, "uuid": "22dc7385-374e-4e20-81c7-2ef5a1ce09c1", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268153, "uuid": "b1966b25-0325-4c96-82ff-1141405b49c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268153, "uuid": "e0d0ca55-d01b-4e83-8c24-6f86c96ad5c0", "value": "5983859e0217f7efb38dd215bf326be2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654152b8-fc1a-11ee-a120-42010a9c002e", "comment": "Malware payload (Adwind)", "timestamp": 1713290079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290079, "uuid": "1dd5144c-41bc-44b8-b42b-6716e6d5f3a2", "comment": "Malware payload (Adwind)", "value": "5bca887380e1881f351c22574d257e41", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290079, "uuid": "cd0b9d8a-f0d4-4cd4-a30f-ac12634518c2", "comment": "Malware payload (Adwind)", "value": "5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290079, "uuid": "5c5b2045-5947-41d1-969a-b5279c4a5b03", "comment": "Malware payload (Adwind)", "value": "987634d53966aa6e84c72ad366bb78e619cb674a", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290079, "uuid": "d1436059-4486-4039-a175-d7c3ba3ac894", "comment": "Malware payload (Adwind)", "value": "29dcb562dd92a7067b55dd734b62914555df9300d145613e40c330a2f44fde9073330a734fc49367722ac112e8912f3c", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290079, "uuid": "8e9c60b7-1d4f-48d8-a051-db9bfec0495d", "value": "T1B6257CEA9584172EEB74100591AB2FAF62E0EF4F7225C85FA1BA1FCFFB2551C461424C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290079, "uuid": "d71be827-7b6d-4c8b-b064-16091d21d44a", "value": "12288:k5hvpTSH6kI3/VITSZjbZkgdciA5Y0y9BY7BA0Et5YdtFpGzN3w1xYZWkTSP4Wn:kXpWH9eZZjdkeCjmlY3FeNgwuP4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713290079, "uuid": "8f79adcd-ae47-4aaa-8ad0-58a532311661", "value": 1031156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713290079, "uuid": "c958569e-41a5-40e6-b730-b5ec25b8bae2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290079, "uuid": "c53a4181-d7eb-4bba-b843-41c658a10d69", "value": "gcahfpmhcn.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fe797f-fc10-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713285845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285845, "uuid": "5d728941-fc62-4cbc-9380-20b9617ff9ad", "comment": "Malware payload (PureLogStealer)", "value": "c5dd39b204b859209ec38a1aba1c8eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285845, "uuid": "355dfcb8-4f82-410a-a2cd-876bb5ac38f8", "comment": "Malware payload (PureLogStealer)", "value": "60209ed2588da5b44174095073e31fe775ac8a2e9e02118f8fa1eea4c69607a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285845, "uuid": "bbb26fca-658a-447e-bfbd-275c12713492", "comment": "Malware payload (PureLogStealer)", "value": "0006ad5d81c98fec6e83dc5d4a1e900f4de77bc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285845, "uuid": "6c3be6e3-a0c2-421f-802a-168cdf64efc1", "comment": "Malware payload (PureLogStealer)", "value": "86de973023f3c301d9418fab43efad495bc52d220a76e5445735b95083474949e3d28471396798cc3a2cf706ceb48505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285845, "uuid": "b0ee0910-b18d-4f24-ad91-968fcaa841fe", "value": "T1E086331AE3BD8875C0DC5739BC74038881B0C3A3849167AF706DB3783966FD69A6F166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285845, "uuid": "5e660be5-84ce-4c03-9d07-fed8ca92ebc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285845, "uuid": "6c6b7c01-96f5-4a58-a56d-e0c7377a1688", "value": "196608:ik9RpGbdTgrB8TJJ51GQjrj13SL5VstZ/NeLR2Yj/PR7HZYQtFkM:V+dg0J7QbsvNsRN7i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285845, "uuid": "5a046420-c4f4-41a2-a95c-579455234738", "value": 8342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285845, "uuid": "fad4024c-5c12-4263-972c-ac02daa046f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285845, "uuid": "ee3bdb4e-c7fa-4864-b990-8d925990061a", "value": "SecuriteInfo.com.Win32.PWSX-gen.12913.5952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf4ceb7-fc15-11ee-a120-42010a9c002e", "comment": "Malware payload (VenomRAT)", "timestamp": 1713287810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287810, "uuid": "ac9245e1-94cd-4bdd-8038-00ebc3730a6d", "comment": "Malware payload (VenomRAT)", "value": "a76519720925437e61593d697c22d2c3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287810, "uuid": "c7bb9405-3493-4ea4-b155-fe656a4df197", "comment": "Malware payload (VenomRAT)", "value": "609d44617a0a2884204f59d1350ffa87cef6be04d06c42014957515a6fb12f61", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287810, "uuid": "cb480a6f-a886-43ea-a7b1-d2eafe511013", "comment": "Malware payload (VenomRAT)", "value": "fd9e658d262708c746854082d8a00e9ff998ff95", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713287810, "uuid": "80392214-52c9-42bb-a885-70fe7fae6b71", "comment": "Malware payload (VenomRAT)", "value": "5e2a5a99994edcf2a75bae4defbc718d9aab804e63c872d317a8d72f862580615323c4ff54bd5be2a251af120bb9b7b4", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287810, "uuid": "a6020856-8d89-4149-b097-baf6ebb0de08", "value": "T1FF426035123E39DA03D7BB605399AF75DC500EA249946CA7F2F54AECCE26EC258D072C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287810, "uuid": "314f20aa-0b41-4954-9e34-d3b2e62d3fef", "value": "384:OSJ6w3wSSkOLjX30OxjnPC/0OOjHhw/SFfJ+RATJcJ/A4B4/JdNOJitAJ8tluNVe:OSJxgSoLjX3NxjnPC/NOjHhw/S9J+RAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713287810, "uuid": "8879922f-7dcf-4357-912b-88d7baa12515", "value": 13005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713287810, "uuid": "88e61e68-9ddf-4ae0-802e-1eb8b3839cef", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713287810, "uuid": "fa13ea22-a940-4e7c-9ae4-4ef340bbe3a8", "value": "2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f1169c-fc2e-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713298516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298516, "uuid": "75cc5167-2a7d-4000-8c79-f516f4865485", "comment": "Malware payload (AsyncRAT)", "value": "4410dbdf8f12dfbf1f165276c42444fe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298516, "uuid": "6b011eb8-9000-4d79-ac66-cb1024f144e4", "comment": "Malware payload (AsyncRAT)", "value": "61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298516, "uuid": "e24ec9ea-d6b0-4819-8ebc-602cbeaf1674", "comment": "Malware payload (AsyncRAT)", "value": "41636f267072fec4554293c8d6abe148e1e67cc6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298516, "uuid": "1e8d3580-b9ae-4c8d-839e-af53d90683ed", "comment": "Malware payload (AsyncRAT)", "value": "791ea0961036f2f2d824874c9f0b92566f5b405e99a7f43743d284d34a1b515124dddd0f792a15e982a9c987f90a20ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298516, "uuid": "63a9d2af-d7da-4fb9-b9bc-152debf811f3", "value": "T177B73328D1D6E15AC7DDD8649626DEEAE3FB0CF13156B9007CECE51D482AF4B1008BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298516, "uuid": "b736d823-0f15-4fc4-b5bc-5c88e70fe195", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298516, "uuid": "3695c9f6-15d3-4f39-a3cb-a3e5f020cc41", "value": "786432:Nkmk80dcNz5mU7FgDHNM2RXKxN1bfHRz8CGj7IBLbTSR/4ibob+XAkqdvDjhr:Dk5cNUUJgrNPOFfxFGjMBLKLbob+XCdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713298516, "uuid": "26fc945b-8a31-4daa-b972-4ebce4113b55", "value": 48978421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713298516, "uuid": "1db5c301-3d15-43ae-8892-3bda0d853309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298516, "uuid": "ae75a92b-acdb-42e5-9e06-e17300570cb4", "value": "4410dbdf8f12dfbf1f165276c42444fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0c669d-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268157, "uuid": "cb820180-57ce-4a62-a0f3-5ba8c5fd068b", "comment": "Malware payload (Mirai)", "value": "3598a15ea5d0a81a837a6c3b03e1229b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268157, "uuid": "86b08b67-be03-4002-81a1-2c42ae8cc2cb", "comment": "Malware payload (Mirai)", "value": "623b1d910e58861fa0b9203a2a13a2bc307a17891a0bc7ed6f96ac6dc300960a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268157, "uuid": "d53812e0-dd8a-41b1-8d59-208d16db8548", "comment": "Malware payload (Mirai)", "value": "69f5ded1d7b64394ffdbb482076d2c60506e97f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268157, "uuid": "06e6ad95-b2e9-4278-aa28-8d969e08726c", "comment": "Malware payload (Mirai)", "value": "cb49ae0189c1dc790bf5f99d90611056627eb69a3c93f71038c769b8d5c6bfdabd73830f5f0eaccb332fffca397f0b65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268157, "uuid": "b0305eca-9c37-4ccc-b438-fa66fa13be60", "value": "T15F734BC5B5C3E9F4EC16093D307AABB24E73F53E6139EE97D3986423A942202D60635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268157, "uuid": "165b5603-77da-43b0-8383-2d4905a2211a", "value": "1536:GD8VBnK13Rg74kwVJStv0PnxAOHItu9jpGZp8GXPTbVhid/Sb:G0BKRRg74kWS90POk4uVsj8G7ZUdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268157, "uuid": "dbb19161-7116-458b-9bf2-6dccbc96f7d3", "value": 75120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268157, "uuid": "62d69528-bb35-4345-b592-59bc7971922a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268157, "uuid": "8db709e6-e168-4704-b3aa-b1b7436ccc4b", "value": "3598a15ea5d0a81a837a6c3b03e1229b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efacb068-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265400, "uuid": "ea33b0b3-e1c0-4f19-8710-7d878816742e", "comment": "Malware payload (Mirai)", "value": "3916c4829fa4be0560f69316eb4b8e2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265400, "uuid": "c2b9c402-1e9e-4e51-97bd-ccf3a13a4231", "comment": "Malware payload (Mirai)", "value": "62dda85a8c14c19493d073668c8ce964e683cf874751a0723a95944303625f5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265400, "uuid": "1fc3c464-020c-45a1-a352-4acfb92afd94", "comment": "Malware payload (Mirai)", "value": "2259cb979aa8a18d1526e56073f04322ce5493c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265400, "uuid": "cc96e4d5-6e2b-47e7-b5bd-a8921f16f00b", "comment": "Malware payload (Mirai)", "value": "1a3c988c6d3c595da9bd0603981d605c6157cd8f88d8273e1a6bfda3532c20d3dc82028e4e346c28ef7a2cb8f4eba354", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265400, "uuid": "bd3f6bb7-a71a-412e-9164-282471eeeec6", "value": "T13004E91AAF550FBBDC6FDD3702E80B5135CCA45722953B363278C928F54A94B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265400, "uuid": "70aca3fd-6573-4543-8197-06bd1f0c6edb", "value": "3072:7fBo8gnfa1PNGkhxsFUDDugBlF2DIpQZi:jgf8FwFehF2DIiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265400, "uuid": "44b4621c-46a1-4181-b690-fc2a1aeb4fc3", "value": 189684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265400, "uuid": "9bc17fd2-1922-498f-af6a-33dda53e68be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265400, "uuid": "d519c77a-6bf5-463d-94cc-ac59a49b5f74", "value": "3916c4829fa4be0560f69316eb4b8e2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d394400-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256940, "uuid": "7cf40617-c3c2-44c8-8ac6-4825f3f7fe3e", "comment": "Malware payload (Gafgyt)", "value": "8d9a0bfe035752e0e40528d650788899", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256940, "uuid": "dcef3890-3be4-408f-aefb-ea0a0654b2ac", "comment": "Malware payload (Gafgyt)", "value": "63b8206fbc3e442f325ea7a18ace736af35b54f9b0781f5a9176e6b15880aaa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256940, "uuid": "2e3a25a3-9351-4212-b110-157109e67415", "comment": "Malware payload (Gafgyt)", "value": "a8ab9b5111f49219b329a32985730e99c8fc72b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256940, "uuid": "bc5b540d-1b21-4985-bb8d-072700fbeeb4", "comment": "Malware payload (Gafgyt)", "value": "128d3698a64d8c690ae96a5460519668b9c6d760b1ff67dbef9a9111a43643441f84b0d6e1568c17c4d701322b53386f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256940, "uuid": "8800ffab-9e2f-419f-8a9e-df173a732253", "value": "T12EF34A36E0A04EB3C0476AB5286ADC310F1AD5D3176F2692663817F04B9F4CEB45EF69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256940, "uuid": "904046c7-c2bb-4db2-bcb7-f4817b3b5df8", "value": "3072:aIC6S95GBRKr7nyvF+Okvy5hyl7pmwsweDdAH:az9cBRiq7J5hyltmwsweDdAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256940, "uuid": "6e4a64ab-3dd5-4b5b-b3f3-9f9dda2ce0d4", "value": 158757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256940, "uuid": "18f02e90-bf43-44d5-9300-39072df155b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256940, "uuid": "7e7ec1c5-0a09-4974-ad30-a7d3c7bc87a4", "value": "8d9a0bfe035752e0e40528d650788899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803f8a38-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268220, "uuid": "0efe0df7-5225-46a2-9783-11a068098548", "comment": "Malware payload (Mirai)", "value": "5c0a8a65c31299866102c45cac07a6a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268220, "uuid": "26fb0aaf-fea2-4e8d-af3d-3aa2d5913ffb", "comment": "Malware payload (Mirai)", "value": "6473c4b0d9fc3edf5a6f0acdc38c8884e7ab598cdbe697e4ecc36b062e20e197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268220, "uuid": "b56268cf-633a-49bb-a322-7c5f4105ccc5", "comment": "Malware payload (Mirai)", "value": "645610afc3217da7b6d28377c8b7de791af701f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268220, "uuid": "549cc239-1dbf-456a-8e76-368825bae4a1", "comment": "Malware payload (Mirai)", "value": "12c20fa079550d6369cb92e8413201bd44bac91738dde9278d9b233e87d61a9c880af097f6b72d58c5b7cc0de0e6fe08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268220, "uuid": "af32f237-dd59-4453-a737-95fb00c1b108", "value": "T17373AD72E1686DB8D0654A747E988E729B23A48056D33EF6E781C7650013DECF40AFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268220, "uuid": "4cde1445-4d57-4cd4-b638-d12428dbad46", "value": "1536:3aL/3+5hmwtIHKyNonp81rB9X0rrn9Aq2weKSbEZpp9CbwhT:36vkoIyNopyX0rj9kwRSWp9zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268220, "uuid": "4be1c051-4101-41b1-8dcb-db3209e0d989", "value": 78976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268220, "uuid": "6f3823ef-646b-4fdc-84ea-a5e05ac91e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268220, "uuid": "53964756-1c69-4be3-853d-7f3dd38bb9be", "value": "5c0a8a65c31299866102c45cac07a6a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2008e0-fbbb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713249503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249503, "uuid": "2643669e-45e7-44ca-a2fb-67bd03f0cf68", "comment": "Malware payload", "value": "c9cd68d95f3a217993cc89b8c59bd979", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249503, "uuid": "6d909c07-d38a-4c85-80af-47d71969b56d", "comment": "Malware payload", "value": "6479ce0938834c0ddfc2c0c4aac752c8779436339ab3349b2562bb16a5975f9d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249503, "uuid": "c63e8e2b-88e7-4ce1-8738-c00f88f84b5e", "comment": "Malware payload", "value": "328af8ab7490352d08f609811c588ec4e0322e7c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249503, "uuid": "cc64e84f-d363-4e09-9754-2264dd3eadc4", "comment": "Malware payload", "value": "d7ea270593caa7a69a6bea3cc38a748d789550d6face0eb694a708ab90326b64fb045cef9f2eac197706b672437382c5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249503, "uuid": "0be5eb34-295e-4778-a5eb-feefaf216047", "value": "T134F423BF874BEBB41C9E06B7FE3889E1DBC7BFA6B902B03A11D5076089171E13585056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249503, "uuid": "9100ba87-267c-49b1-bb18-9834c7e7aa68", "value": "12288:Ff9DSMhioYHt1YzoeWLXO2A45i9wgLyIoAWwxp3rtPzzyo5aff:FVeMhq0zKpr5t3Ixr9/y8aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713249503, "uuid": "29b634ea-52f0-4a60-85d9-6b093336a58e", "value": 738300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713249503, "uuid": "c90b6027-837f-44e5-bec1-c0f1b2ce58ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249503, "uuid": "bc0113be-f105-4f18-9496-e1db2c388fdd", "value": "SOA MARCH 2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f0e0be-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713251798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251798, "uuid": "d116d65b-10f9-4dea-99fa-3d7d124203ef", "comment": "Malware payload (AgentTesla)", "value": "cd6fe7916aa332542dbad62cd1642bb1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251798, "uuid": "51f72781-0bac-40ad-a48a-066d3c6305f5", "comment": "Malware payload (AgentTesla)", "value": "65b2f8baf255e384a395598130c91449e0762789ddfd133ee0207a36b12b8e8d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251798, "uuid": "38af97b8-0ea3-4266-a0f4-11ff664dc76b", "comment": "Malware payload (AgentTesla)", "value": "0135a5afee353d6a9cbe1bf8d90ca07acd995161", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251798, "uuid": "fa8eb3a5-0bf0-446a-b6cc-901e5e2380e6", "comment": "Malware payload (AgentTesla)", "value": "b4164243f509446d0eafb084d818fc6b20e762057105ba9d03d9e70111cf6a9316ff108d90964ed299e4ddb129f0a21a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251798, "uuid": "328f2f7b-bf54-418b-903a-0c46e8bdd546", "value": "T1B95423114C186F06EA628AF76EEE80AE7CAB913C4347B535B867C630D45D4B039D4796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251798, "uuid": "8d9a36fb-1aa0-4440-9274-0ff2a2f0ec15", "value": "6144:r/xKjbP1P9Y2KlbNMFEVSETTuqAZDN0OkD6z7NH2Krcgh2NJTztD:rJKjbx9fobqWZTTtAxN0OkM12McghgZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251798, "uuid": "33441ce0-6c56-40a9-ac2a-6a59e187b4bf", "value": 294444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251798, "uuid": "594a3585-4c1c-4dba-860f-0f5107da299a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251798, "uuid": "6f485cc0-a563-4ea7-8595-8ff5b0c3b6e7", "value": "PURCHASE ORDER.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea94a07-fbc9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255252, "uuid": "9639d42f-42c4-4ef2-acc7-16f5cba9a936", "comment": "Malware payload (AgentTesla)", "value": "8f91c4b6d2a19b52f5c3dd11fac214cf", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255252, "uuid": "ebee1dc9-1cf9-4b2f-bfd1-ba4639b36298", "comment": "Malware payload (AgentTesla)", "value": "65cbeba5638760d8837799fd13473e957cfb20b9708691db69c0ff393a75c2db", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255252, "uuid": "fd66393c-d4b6-4cbc-93d8-33d4b8c3da44", "comment": "Malware payload (AgentTesla)", "value": "7ff770acaca1f6025469577fa946367009e987bb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255252, "uuid": "aae205cc-33de-4abf-91fb-e8354fecf7b1", "comment": "Malware payload (AgentTesla)", "value": "f1b34915b435eab40666f72ac7802aac806958d2c19a8db016876ba9046c33c0f808332fcd882ae95501c21ec4e0edf8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255252, "uuid": "57ae9368-03a5-442d-9855-c0084224058b", "value": "T1D1D423DACCF44AC572E1F435DA0ECD586F02CB2975769B06C0A2FE43C18DA9C6B16687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255252, "uuid": "9b655b3e-379c-4cae-bdcd-2a8152fd8c6a", "value": "12288:LARCocqQQxHQNnUOGO6WfDodUqPZ2tGp8CovmH0HotckP/EOKRc+8Y:LAwowKHQNnvCWfsqqs0pMvBKP/1KRc+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255252, "uuid": "115e1e80-414c-43fc-9f06-c70c4dc11adf", "value": 627289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255252, "uuid": "ebc7f24a-1119-46ec-bf8e-1253fc9681f5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255252, "uuid": "353eaba2-a959-4b20-a20b-14f4efabed1f", "value": "Remittance0098876.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2b4774-fbec-11ee-a120-42010a9c002e", "comment": "Malware payload (StormKitty)", "timestamp": 1713270310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270310, "uuid": "a2d799d1-3cab-4e36-97a9-c5a45ce21348", "comment": "Malware payload (StormKitty)", "value": "ceb9e6829d00ad6e8f25b30d77aba83f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270310, "uuid": "dafbabf6-fad3-4523-a85f-9a4a6a22c368", "comment": "Malware payload (StormKitty)", "value": "664582c7357c0ea9f0f6ab524867e1cce887251b11e917ba5c9d81247e57bcb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270310, "uuid": "d7b02520-e01e-465b-9d81-e19ff2be8959", "comment": "Malware payload (StormKitty)", "value": "865128c3a9baee65deeab14f1fdc9a68969df6f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270310, "uuid": "6ec8b371-016d-4eaf-b03f-629a6e13f0d1", "comment": "Malware payload (StormKitty)", "value": "0633ff40265361ed6b2f5cbbb61f0416835cca9260b23fd404e937b784d000ed4fd005ad31bfa4c25e0c1308cdf37336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270310, "uuid": "df3dcd1f-24d5-414b-805f-f033f6fe236c", "value": "T1BA639D207FDA9118E1FBDE74DAE3756282BDE9531907B94648E2741A0E321C0ABC3D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270310, "uuid": "97da89e0-5f96-4036-a850-9ce175f83024", "value": "1536:j+wPW51r8EHsL71ELMt/RYKiq4vo/1oHHbwr/Ye2WcMX6F8:j+wIiEH+u4/O1HHbwse2SXE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713270310, "uuid": "906cffba-dac9-4de8-84b8-95916bb96555", "value": 69136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713270310, "uuid": "ad1c81a0-02b7-4abb-b401-e172928365c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270310, "uuid": "be17ed73-9443-4870-910b-5ea456629cc6", "value": "ceb9e6829d00ad6e8f25b30d77aba83f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbac4cf8-fc03-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713280372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280372, "uuid": "602890a7-429f-44ce-aaf1-5efb7c273c94", "comment": "Malware payload (AgentTesla)", "value": "6846f1fb78fad5224b98b0137e7a862d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280372, "uuid": "5f8dcfa1-67d9-4b02-be0e-462ae1646c53", "comment": "Malware payload (AgentTesla)", "value": "66a0cfa14afdb23dec776fa355b9f89551405989b9838db6398c77ee6c73c084", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280372, "uuid": "6e892b63-4734-48af-8b73-6707bfb93a41", "comment": "Malware payload (AgentTesla)", "value": "f40fa249d6464ef5c1f9e39748162fd5d70e7aaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280372, "uuid": "35f6856b-48d2-4ec4-9547-0e0b8e92c90c", "comment": "Malware payload (AgentTesla)", "value": "d8d8dffdd4d6f2c9baecc947af5aa42fb91e2ef874443bfb3a21538e98b716ac433b582574f70dd4f796b59988eeda18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280372, "uuid": "40e5a6b2-16ab-48ed-a2c9-35a624d6a72b", "value": "T17AD423D122EA27A1F2F653FA291173040F72B87B4548E7059EC4B1EB5AB2753836E707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280372, "uuid": "6cf43136-8c97-4b39-8560-94f589e4958d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280372, "uuid": "fbb4187c-1bcc-46c9-9912-68e71ed56803", "value": "12288:tnteikJg6ZUpq4BRAa0yTow0ADZVY8HnvcHEx0MTOw:3eBJgxpq4B+adowrZfnvckG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713280372, "uuid": "ad98a385-95ac-484c-b3bb-2d7e62cdf692", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713280372, "uuid": "c3873bd8-7bd2-454f-ab89-7681db4de86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280372, "uuid": "b30e1656-beaa-45ac-88e9-0bf12af31679", "value": "RFQ#1047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a6602f-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1713282132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282132, "uuid": "4fed9033-f886-453f-bc63-5db83978f58d", "comment": "Malware payload (DarkCloud)", "value": "ccb43208c3913fac73586ff66702917c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282132, "uuid": "dd98a4be-28ac-4469-89f3-382345a4767c", "comment": "Malware payload (DarkCloud)", "value": "66abc43d3a956272ef47201ca8b7f3e636ccef840489dac32adf72a57fb9f9af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282132, "uuid": "c387757c-4146-42a3-b67d-e08598cd9adc", "comment": "Malware payload (DarkCloud)", "value": "45d30dff3b769afe928c8cf3b555f6c85a591786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713282132, "uuid": "3f5b63aa-ed83-4dc8-8d27-46ba8785f776", "comment": "Malware payload (DarkCloud)", "value": "b9626c59267f9d3e7bf60a9a3ea5608866f13f8a320817ed5a0d42028aa4a764b0626bc9d15eebce0c77c3cf062caa59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282132, "uuid": "ceb79c24-8823-4bb9-968e-1e7dc2456bc9", "value": "T1CB45BE0273D1C032FFAB92739B6AF64556BC79254133852F13982DB9BD701B2227E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282132, "uuid": "950a6985-28a2-48ea-88b7-bc963633f757", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282132, "uuid": "3bbe6069-51f9-45d0-8542-9827bf228628", "value": "24576:iAHnh+eWsN3skA4RV1Hom2KXMmHaeuEMDWbqCcWOKdNJCt7cB5:lh+ZkldoPK8YaeoW2nK7oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713282132, "uuid": "f29618ce-5cdf-4e97-bb4a-1fa26dab38bb", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713282132, "uuid": "7a64e69d-b33b-454f-9bff-5ab0451b0aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713282132, "uuid": "8a54f00f-a918-44c6-8d89-be9fb36c68bf", "value": "ccb43208c3913fac73586ff66702917c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d239d02b-fc1e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713291980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713291980, "uuid": "87dae427-0718-4592-ad1f-f698522e1b80", "comment": "Malware payload", "value": "4786b508296d522bde9b35893599f677", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713291980, "uuid": "d0d21629-96f7-4e0a-aaef-564524b5d381", "comment": "Malware payload", "value": "66ea27e2e043adcfca5352089e2cbe7d4349f1f7e78dd4acefaf451b8c9585c4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713291980, "uuid": "d765cadf-f07d-4e2b-a6d5-ff7f89648319", "comment": "Malware payload", "value": "a05b7bb3931533e0aeeaa4eb48e43befd095b4fb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713291980, "uuid": "3e173a8a-8bc2-4a0f-a172-4afec5de42d6", "comment": "Malware payload", "value": "7e534fb97d76883e6e15edacc8c377eb7a3ceb1917a0c36bd77a10dd54f7ab27677e0f72f5ec1a1a97b5386ca1d4525a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713291980, "uuid": "50cf92d8-0654-4981-9c39-dacac400192f", "value": "T1C0D523127584483AE37B0A358D7AD6A05E7DFE605B70CA8E9308741E2E705C1AB76F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713291980, "uuid": "469fcbab-1cf1-462e-a3a8-27839266bf01", "value": "49152:h+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:h+lUlz9FKbsodq0YaH7ZPxMb8tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713291980, "uuid": "f40e624e-17b2-47cc-810c-31c15aa07ebb", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713291980, "uuid": "ab7d5a88-22e0-4a36-b13b-b454f693e3e3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713291980, "uuid": "b1654d36-5b8c-4697-b686-6e2a42bc78c8", "value": "AdobeAcrobat2.1.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78442f8e-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1713281521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281521, "uuid": "2acaa8be-85aa-47e2-b674-019bec866cf5", "comment": "Malware payload (DarkCloud)", "value": "3d052e45984887167cee3ea93f0c7d8b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281521, "uuid": "c5b31f68-a1a9-4a14-9222-4955309f97bc", "comment": "Malware payload (DarkCloud)", "value": "6742d4234b185e5c6db0a34b173a6c46d5ad9786089f4f09d48b540de88dd7c8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281521, "uuid": "0cc0d243-4d0e-4536-8638-f4fab337423e", "comment": "Malware payload (DarkCloud)", "value": "4a108d7b8ae3c463eaf5dabb74408ff7dc816b60", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281521, "uuid": "e90dd5b9-01ef-4be6-b5ab-26459d1d58b2", "comment": "Malware payload (DarkCloud)", "value": "2bf9c2e4b810c414b8ac7d1c09463c127ca3bc716c233fee2206ebb4f4efe912ae4635aec841452f38804d022ee46b2e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281521, "uuid": "b578b5d7-f980-4a73-83af-96f9f6c6d6a3", "value": "T11B11AB1E18B8F369C88BF1E9F56F02127D845B5F94849426041C165B2274BEC8A2E7E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281521, "uuid": "3041df9a-1fc8-43d4-a5a2-09a4c30fe606", "value": "24:BVewn54qdptQDuQlJYYKWuQFqhjDiFlLnLW:LHn54qnSJYYTBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281521, "uuid": "c92e11b9-2393-4399-8548-174cdaa84dd8", "value": 1006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281521, "uuid": "3ce8002f-dcde-4339-9f36-17f3a09c80b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281521, "uuid": "ca29e8ff-e684-4807-9f7a-3e040a55d880", "value": "DOC499489399YTTY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0207689c-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265431, "uuid": "256a9c33-69b2-4ce6-95a6-039df4e17fb0", "comment": "Malware payload (Mirai)", "value": "48e5f101bc48f62d827cc0e6c13bed63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265431, "uuid": "bc99d8d8-37cd-4174-8c57-5b0c8300324f", "comment": "Malware payload (Mirai)", "value": "674d7d47cbaf753b64c5479a3a967216068c6a9745810030e38c0bb65050e47d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265431, "uuid": "7926282f-3e2e-4aa2-a0de-719b0e3df59b", "comment": "Malware payload (Mirai)", "value": "63229ee3614103a3b91ec8d5510050756f2bc311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265431, "uuid": "4214a61f-bffc-48d7-9410-ec393bd8c023", "comment": "Malware payload (Mirai)", "value": "1048fb1af1963e2b61219e68f7c4aa6ce91f919c64ea448f45930c0e8a6ccb620c00d3f7af8f7609d744871a837909a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265431, "uuid": "a5157ee7-9f6b-4a9c-9044-7f7f986f125a", "value": "T1DC131A85F9819B13CAC52177FB0E438C7B275358E2EE7207DE2DAF52378B9560E2A015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265431, "uuid": "99c5dfff-f093-4ca5-939a-382e7350a16a", "value": "768:CfnOHVUoWNdygGcmUIwoohHHpQq4MdvCjiZIYJZq6kVBYFvAI:hAxmt503dvCOFJIroFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265431, "uuid": "e5d51ab9-4a27-4ac6-baff-972549133595", "value": 42484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265431, "uuid": "6481d8f9-c1f2-48e2-ad9c-41b8edbe2f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265431, "uuid": "ccba79bf-90c6-4249-a893-9f83d7e1b19b", "value": "48e5f101bc48f62d827cc0e6c13bed63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9d68cd-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236810, "uuid": "c93df0b9-0a00-46c6-be5c-4a0eef68a580", "comment": "Malware payload (Mirai)", "value": "c986de86ab0287c8ae9b6588bba47221", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236810, "uuid": "93116623-81ce-4baa-a076-e3cb7d213e3e", "comment": "Malware payload (Mirai)", "value": "67564ba626dfcc51b56ca0386267c9160193140e8e26038595608fd09410d703", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236810, "uuid": "2b63ec27-ed7b-4e82-bf37-5fb9b6a3bdf7", "comment": "Malware payload (Mirai)", "value": "1db7b9f1ceca85c3ce92b0bbed08e5d132e8d475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236810, "uuid": "d59f1c9e-1de7-4d78-accf-74934f619b43", "comment": "Malware payload (Mirai)", "value": "7246ba94180dcb3c9e29d81ea058a8ae5b8126255f55000749227d603274e29da8dadda183d1261687ba7ba0f6cb11c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236810, "uuid": "91428cd9-7528-4c41-9513-ce16b82ab607", "value": "T171338C75F8291E54D15642B4A4288F352F23E2C893933DF356A1C3B28017AADF91EFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236810, "uuid": "7826eb06-a2d6-4fd4-bc81-f9bc9dc70f50", "value": "1536:mamyClrLp7wnwiH4d27X1ol+3XXCr/3a10:mVyHY2oM3XXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236810, "uuid": "5749efad-676c-4bec-a54e-68e82573c9bb", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236810, "uuid": "5876d6ba-7422-461c-a2fd-5d3dbecf63c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236810, "uuid": "09455f46-654f-4e21-90ce-172468fe1c13", "value": "c986de86ab0287c8ae9b6588bba47221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7705c61b-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713281519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281519, "uuid": "7574a7c2-eab3-4ed7-afde-6f7230971bb8", "comment": "Malware payload (Loki)", "value": "fe62c58bcc975e7ebbd268b44a518785", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281519, "uuid": "942dfc70-b461-44ae-8f74-6aefbc999c42", "comment": "Malware payload (Loki)", "value": "67fbf9f34cf2fa287ef78230cfcaacfcf150238e526341bbaa4cbb86d7382c58", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281519, "uuid": "a6297419-169c-403b-93eb-5f3b4b29a3e6", "comment": "Malware payload (Loki)", "value": "696f215f0abe6f1513ddd0a6e8235d99fa5da7fe", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281519, "uuid": "8534a891-3aab-408b-ac19-50b0cb755d14", "comment": "Malware payload (Loki)", "value": "5c093df47fa35ccc8ddfdee287c93052fc38073a38c03d2f68f00bcaeca032681bd2d075e13ff8aec828cb44a4ac4527", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281519, "uuid": "52e52a71-1fb3-4c58-bedc-e7e69cde87bc", "value": "T15E7427E3DAC526298A461AB7EE534B338DB8405C33135E3993BDC65E604395C82BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281519, "uuid": "10e2cba8-0116-4100-8d77-4f7ac74a499a", "value": "6144:6Q1LaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkP/:bKInOiANKdGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281519, "uuid": "d3fbc73d-665b-4d06-aa3c-a8124eea7f59", "value": 370540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281519, "uuid": "4a28a4d2-d3e2-4ce9-8b69-32075a0e414a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281519, "uuid": "99e1755e-4703-44dd-9c6a-dd388e8580f7", "value": "QUOTE AL ZARQA MILITARY HOSPITAL\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87e5ebf-fbe6-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713267858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267858, "uuid": "e2910651-5959-497d-8f07-f06bffb98337", "comment": "Malware payload (Mirai)", "value": "2f4679572348b5d73bc9907d0b1ea507", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267858, "uuid": "b61a45fb-1241-48c2-b605-c06eeed653af", "comment": "Malware payload (Mirai)", "value": "6866c288811523f98482f2b249b061173d979c776d9281570a8c22cbd2d3af97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267858, "uuid": "09008042-e121-414f-b96b-9d606ee1d799", "comment": "Malware payload (Mirai)", "value": "bee714fe121b85766597703bcc245ddca2bdb578", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267858, "uuid": "574e5165-2518-45b1-a5c3-ac2886cca445", "comment": "Malware payload (Mirai)", "value": "94a616e4b799202bf565f5a7c3b6f82413bcf478c882409d1d51229d701835ec44784e82344b8abcfd4cbbc021f9df0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267858, "uuid": "e6441f69-e966-4452-8d24-4e5aca4b5134", "value": "T117E2E06BBC065C89CDFC6D3EC86577A18A65A480328B07CBF319CC4077C694A75AA8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267858, "uuid": "98cd2a04-6d49-4e49-837c-462cd1ef6c1c", "value": "768:573AXTRTEfjNY9MMVAf5FD+W9Dce0OupBWMo:13QT6fjNSW55ld0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713267858, "uuid": "292d1d57-0b32-4b26-8e05-13f42506f3c1", "value": 31432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713267858, "uuid": "e8d072f1-d922-4939-af02-4574eea087b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267858, "uuid": "924a48f7-e629-48d1-b820-97d69dcd5822", "value": "2f4679572348b5d73bc9907d0b1ea507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcecdf92-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713234016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234016, "uuid": "717aec92-770c-4566-a833-24117932a0f2", "comment": "Malware payload (Mirai)", "value": "9d44de6c87ff9d69d3479a83ca64a1e0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234016, "uuid": "07d3dc76-8214-4e25-9d0a-61665b83bcd5", "comment": "Malware payload (Mirai)", "value": "68d5907bd120ee8358121f6ac208ea8d4845b00a2c1db6e71c7bc1a46945fc6a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234016, "uuid": "3f0d1e65-724a-4e11-8f71-8ebf6e58c53b", "comment": "Malware payload (Mirai)", "value": "76a33187cbb67b3db60534ab18ea8255bea5c10c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234016, "uuid": "cf35ac0b-c0e5-4946-b1d4-ca41ca7f471b", "comment": "Malware payload (Mirai)", "value": "bcce60fd0905b2cca254eb480b0773cb64c2f8062ecc309536df2a306382d6b47c94aa2aa03e68eedea0a8b61e35a76e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234016, "uuid": "2313f1bd-98f5-4b8c-a1f6-272ec50ae236", "value": "T17E332B03A94040FDD486C5709ABF9537EA31F9BD1135BB4E27987E602E32F211A5EAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234016, "uuid": "8ac8cccd-a7c5-43c4-a33e-82994e2cd07b", "value": "768:JHe+Ivf1+MMogbhDzZ4zC5tKfd8JXssY0QgCJ9FW7ZoRj/LkZ8AQJguF3stL:VIvgoSuC541iXssY9g/Fajzk7Tuut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234016, "uuid": "1fc3ea39-5245-480d-8534-51b6fd08a509", "value": 53576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234016, "uuid": "b85956d3-2c9c-459e-b7e3-856e8f658425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234016, "uuid": "cca48d8a-67d8-4e0c-819a-8540b7434be8", "value": "9d44de6c87ff9d69d3479a83ca64a1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26da66c4-fc02-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713279666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279666, "uuid": "9b2046b1-31cc-4a34-ac54-c8e7e9f1a291", "comment": "Malware payload (Formbook)", "value": "3cab2cb50468a11173f7abb7d63c75b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279666, "uuid": "fb6f1aa5-8ed8-4225-b2f2-6a6d5a8afd87", "comment": "Malware payload (Formbook)", "value": "6a51343d2fa02ae2b255794576460b49b07ea29e6105abc0816831dbbf3a2197", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279666, "uuid": "789c99e3-08a0-435a-9b02-006f9122940c", "comment": "Malware payload (Formbook)", "value": "4d73453ea724aced202ddc5ef316503e8d54fdfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279666, "uuid": "ae22fa1c-766b-47a8-864f-aad570fa8be8", "comment": "Malware payload (Formbook)", "value": "7d9038fdd5399f85db83fa40a42783b43fed3744e2b116ea27de11138f980146f5cbe457548e78de32efbd7f2d34408e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279666, "uuid": "0a9c0287-fec2-4e04-a629-f9c65b0b840e", "value": "T1812408F0CF0B36199F4B3EDAAC6445924AF58195051638B5AAE807EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279666, "uuid": "5b544ad4-c539-4edc-ace5-64a94ae964f8", "value": "6144:JYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfM0ZI:C2dOs0hFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713279666, "uuid": "85507010-6c6d-4ef8-b3fe-5c9c796b42b1", "value": 211145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713279666, "uuid": "41f0b688-b3a2-4776-80b1-1ff8bb2b8a9b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279666, "uuid": "1d829807-2a44-408c-8579-50131060e940", "value": "orden_0099896754537687897657436786756785654576.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b044a2a-fc28-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713296101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296101, "uuid": "53ecd37f-c035-4e41-961e-5b36cdd11f62", "comment": "Malware payload", "value": "31a627f2a00461e5049a9060ac33c9ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296101, "uuid": "cf45cd79-2526-499b-8556-e5db88c48a85", "comment": "Malware payload", "value": "6a8d081b1a9df5c8f61aff5782a2c43d2d98ec11a971482916231309a12f6fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296101, "uuid": "b7711f18-8e36-4130-a7a9-1b8823b5dc61", "comment": "Malware payload", "value": "044f5c5619686f5a0be94e8bff071b61202ba534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296101, "uuid": "5283df8f-f44b-4f55-adae-aebdd75d8ae4", "comment": "Malware payload", "value": "e8cbbaaeb5ee3804448908682bd0218f3b688691dd24df36fbe42d56ae92421b32d695df8685c00143a387a3b945b380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296101, "uuid": "39292ad3-dd7a-45be-884f-4e8028582c5b", "value": "T18DB52382F3C701B1F8225A31D562C994AE277D7809F4611A3CB8FF1D5B7F1864876AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296101, "uuid": "7d3f8ecc-48d9-4649-af30-4930f8cf4fab", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296101, "uuid": "44b21b8d-a741-46f2-80b7-a56385c0135f", "value": "49152:gxquhCSBqnGx6orrtsl9hDjT6jz9gbKlUnH094vq9M9u8zJ:+qSBqnGxXrrCtT6abVk4vqEu8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713296101, "uuid": "c5d271b4-5e20-4c7e-a9a6-11d6a0754dcf", "value": 2372376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713296101, "uuid": "85cb6b9b-3b02-412c-aeb0-2d6875f5fc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296101, "uuid": "afa91f9a-78d1-4a7c-a869-b414c60750f9", "value": "SecuriteInfo.com.FileRepMalware.18165.2747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd06cbd2-fbf2-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713273073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273073, "uuid": "447801aa-5271-46c2-8cdf-147f80dc7f4b", "comment": "Malware payload (RedLineStealer)", "value": "15a5a210a88d15a932171a9fa25a1356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273073, "uuid": "50c450dd-666e-48ae-ae03-60adbb2beec5", "comment": "Malware payload (RedLineStealer)", "value": "6a92c749f157ec43b1d14cfba29f9ce164ecd3048353a720089f872f13b843fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273073, "uuid": "299c5377-10c4-4a7a-8842-16f797693c9d", "comment": "Malware payload (RedLineStealer)", "value": "7f6290046bd9bb6129af3da4612fad50369eda09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273073, "uuid": "64ef3e5a-88a2-4b05-8182-967a99241690", "comment": "Malware payload (RedLineStealer)", "value": "147c6d078c118e31c0c3fdd8e6742ed6b9c0476309a84d0f937e85ca911a54193579d834fc2c2f73e08dc3a31fcebc14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273073, "uuid": "c6e55d5f-a19d-41f1-9700-23f37c910b3c", "value": "T13626D01577F8DE12E1AF5B72E4F4412487B2E902E523E30F398572A61D533AACD097A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273073, "uuid": "0b6f24bd-2992-4cd8-8716-29ea4692058b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273073, "uuid": "3e8ef7ba-592e-4059-96af-ee34ef47ff55", "value": "98304:dPwGDPsMTm7Gh0nUu7TcY0mmdlv3GLCjcKbbygH:dPfDPtqGmnUu4mmdlO8bbyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713273073, "uuid": "3bae65fe-fff3-4b32-bec6-72c70162032f", "value": 4825088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713273073, "uuid": "d41ee3d8-0dd7-4918-abaf-e94bb3357032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273073, "uuid": "16246b58-a4cb-4519-8476-f7a3de3ec795", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79a57b1-fc29-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713296713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296713, "uuid": "3c007c43-6688-4d89-99f4-3f09c5b77276", "comment": "Malware payload", "value": "f9550b5d72306794abbbd257f21ab6ab", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ev", "colour": "#C13823", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296713, "uuid": "024d6dd9-c23c-47dd-9a09-d4c0fa330679", "comment": "Malware payload", "value": "6a94447715f2799d8b5fe10299fd93fe3d37c1bc89a6aaaa3781c689f0bc153b", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ev", "colour": "#C13823", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296713, "uuid": "58099e6f-96f7-493e-8a0f-92d2a527026c", "comment": "Malware payload", "value": "aa037009bde296a4f041c101a98ef24eb60b205b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ev", "colour": "#C13823", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296713, "uuid": "8c18f3f5-5a94-45a3-a5d2-2e636848e0ca", "comment": "Malware payload", "value": "b5a849638ac9f0b804090f6c23c317655b6d67075d896f7fc5f9cb6f2f528932ce66a05e8e945372f28173058a3d26cb", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ev", "colour": "#C13823", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296713, "uuid": "61e7bba1-aeda-420d-9490-c9f884b751cb", "value": "T188279E13B780813AC06B1A3A9C27EB64593F7E616A2A4C0727F87D4D6F759803D3B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296713, "uuid": "a55727ea-f5c7-40ac-a9f3-f299d4bc538d", "value": "196608:aIq76OCeJgY7AunxbsW6BPug8TVt/Tqz/LUTUjS:aIeueJGunxbsW6BB8TuTTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713296713, "uuid": "520f2324-79f4-4850-8714-0f7b8dbcae49", "value": 21339648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713296713, "uuid": "2afea8e6-f25d-421e-bbfa-e8881a9bda87", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296713, "uuid": "bec268f2-2c66-4348-859f-4f69cfdaed08", "value": "6a94447715f2799d8b5fe10299fd93fe3d37c1bc89a6aaaa3781c689f0bc153b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f75cf3-fb96-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233628, "uuid": "81f6dbaa-37af-463f-8e6d-a897718cff56", "comment": "Malware payload (Mirai)", "value": "e45ecbf54a58c18944075a545a952f48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233628, "uuid": "23058ead-fc31-497a-bd50-8112fd9616b0", "comment": "Malware payload (Mirai)", "value": "6c2c2969f1b126b7c624ca304d66a9808348ec5d421af36257a76f150f499a79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233628, "uuid": "d2869516-d961-4317-b944-fc7a4d482b55", "comment": "Malware payload (Mirai)", "value": "54f89f69422d7bb2a9da239a305b4f7b820dbe37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233628, "uuid": "61ad1a7f-aa10-4aec-b8ce-607d30f245da", "comment": "Malware payload (Mirai)", "value": "7cbdce5a422156ec7e057e6e976cce721090318ac7d00c1e9a42c7a8e48918e2e51d01a95d6a36c625adb3e60e32f36e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233628, "uuid": "62bf9a18-aa9d-4981-938c-46a7b7b63bd1", "value": "T19D534B0177140587D5F35EB03A3F1BE1C7AA8A9220A4B249794FBB5689B1E331947ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233628, "uuid": "e35a3be5-911a-4671-bab1-05440852b8f8", "value": "1536:o5/ndQs0KGwTrVxaWmftJKz3b4ZQmvv5HLB:E/ndyMdxaW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233628, "uuid": "27d5cccf-dc57-4deb-91ce-06540c6f6c19", "value": 62108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233628, "uuid": "27b97feb-af33-4fc9-9f4e-cb01523629e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233628, "uuid": "a74b1c0c-bc3c-4439-ae6e-e81a52cca054", "value": "e45ecbf54a58c18944075a545a952f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9ba92b-fc2e-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713298814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298814, "uuid": "ead3dd15-86ff-42c6-84b4-4f11f439ddff", "comment": "Malware payload (AsyncRAT)", "value": "446035c77554b10722a6482a9a08d592", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298814, "uuid": "ca9a0e72-ac8c-42d2-a12f-6bf17bd62630", "comment": "Malware payload (AsyncRAT)", "value": "6c3e5106d3a3beebcae780dac855de2932c7df511ac3fb0fe0fe218f4fa7878a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298814, "uuid": "dc053574-c78c-4e5f-9953-a34537eaa024", "comment": "Malware payload (AsyncRAT)", "value": "0bded2287c79aa77bf4be8a59567e6aa2ec1b001", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713298814, "uuid": "c9ad7c05-6b14-4b10-a50b-ea00c288920a", "comment": "Malware payload (AsyncRAT)", "value": "6b5d3642bf433d0d8907d319248dea15605e4d516171e50b0bb6eec6b687e0228d3bc848cb858d897e134919022b7b02", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298814, "uuid": "0ad5e531-a53d-4bdb-aa81-74d4f99faa6b", "value": "T1495309013BE9812AF3BE8F7459F3658546F9F4AB2D12D95D1CC901CE0532B829D42BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298814, "uuid": "cf52fb82-b957-453b-bef1-3c6d02f51aee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298814, "uuid": "999173f6-3002-409d-8a6f-99d80ccaabf0", "value": "1536:qmfW6qHdykrVMKuJUYFVBE2UbtAPCZQHL4B2arPlTGdx:qme6qHdykGKuJUYFTUbt5Qssadux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713298814, "uuid": "1e439760-ba95-47e5-95b8-02b8b182029d", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713298814, "uuid": "d8bacde2-ab8a-4e6c-a641-68d5681f9bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713298814, "uuid": "6829f276-a9f3-4c29-ba1c-2ae354f45988", "value": "446035c77554b10722a6482a9a08d592.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a185ad6-fbf2-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713272880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272880, "uuid": "32a7e5f1-f983-4391-a413-14a9854fdcf6", "comment": "Malware payload (Neshta)", "value": "b4b32117b40b70fb1bfeab298ba44557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272880, "uuid": "3aad2a99-8f04-47a4-a2b5-bc1ed0ad341d", "comment": "Malware payload (Neshta)", "value": "6dd5d1309948dac371cf1cc1083f758ea313161d8658d9d3842e3f908bd280d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272880, "uuid": "3ec6d711-bc64-402f-8f53-e654f97a9d58", "comment": "Malware payload (Neshta)", "value": "a74707a387129c37ce14a7ebacd053a8864e2e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713272880, "uuid": "c37a4bea-2a94-470e-a00f-cd9b47b5ca65", "comment": "Malware payload (Neshta)", "value": "55f1ca7f5b23188d59f6e72292d1077d2a983fd9475cc11921b3e0ac503114a7fbfe09e4d92f033a9f1c09aa7ba72680", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272880, "uuid": "e9fbe679-8ad6-41fb-9008-69dae0caad30", "value": "T1AEF40200F7BE6F1AD3BD43B05A5268140B72B5AA6537D20B1EC5A1CB6931F849B04F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272880, "uuid": "7f694aa3-9817-4fc5-a2bd-f61f1f6727fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272880, "uuid": "c38834c9-f8c5-47d4-b579-96dca76bdcdb", "value": "12288:61ta/jCVo69W+WkpmDodcb1NrOvPA/cxSgDXwJWTrDVylYtnh:g8/jCa69DpOodcbnrOw0ZwJWTrpUYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713272880, "uuid": "19e4e8e7-e06a-4562-a57c-511dad3d29f8", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713272880, "uuid": "13381413-fdc2-44cc-81cf-8b6a861b01cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713272880, "uuid": "13b75288-2a89-429d-a399-790fa7660107", "value": "Invoice and receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd24f97-fc28-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713296103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296103, "uuid": "3348770f-958b-4ded-b054-71f8e42886eb", "comment": "Malware payload", "value": "4c7fc3ea97b821d36545c3957b2d0da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296103, "uuid": "cfd73591-ba13-4d21-b30d-35b011809a2a", "comment": "Malware payload", "value": "6de058a8f8cba3bcec77779e831796f64a46ebccecc4f01d22179e78b6f7ef2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296103, "uuid": "eeaf0667-602d-4a0b-a26a-acb2c67853bb", "comment": "Malware payload", "value": "fe1d2a4867e4ac58d7f06857c6d506b16879ee40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713296103, "uuid": "42a9ff3b-e683-4eda-8229-46df6973c67d", "comment": "Malware payload", "value": "e3d52bbc2562465885ec4fb2d7e1b3ea2b310058e320e717f089c605ef938dd3b2a6faedf55928ebbd3ef4b08b17dab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296103, "uuid": "9309f663-e0dc-482d-88db-e8c1bf9a9361", "value": "T11DB52382F3C705B1F8225931E562C990AE277D6808F4611A3CB8FF1D5B7F5864877AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296103, "uuid": "30985c95-6d89-4c38-9807-590fac334a9d", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296103, "uuid": "d4ec53c5-6bb5-4122-8917-8505458edf65", "value": "49152:gx9uhCSBqnGx6orrtsl9hDjT6jz9gbKlUnZj94vq9M9u8zJ:+9SBqnGxXrrCtT6abVZp4vqEu8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713296103, "uuid": "ad963281-8172-4b0a-a692-7e46aec00f93", "value": 2362910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713296103, "uuid": "68c384eb-2683-4fe3-b20b-5459ff206bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713296103, "uuid": "0f2d0913-6897-4b89-97b7-acfce51283bb", "value": "SecuriteInfo.com.Adware.005af3651.12124.22502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9358065-fbc6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713254169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254169, "uuid": "87c053e8-1a98-4059-9b6d-04fab8ea2f4a", "comment": "Malware payload (AgentTesla)", "value": "6fcc661a7e607d148d96a1ef9392a822", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254169, "uuid": "6a1fa735-93dc-418d-b9e6-5434c1eacc21", "comment": "Malware payload (AgentTesla)", "value": "6e688cc52232f08d7b8b32d42415e5cad4228a6a87dbb347e3124a69c28c8b45", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254169, "uuid": "d78d8c56-6747-4a4c-a514-06487c612589", "comment": "Malware payload (AgentTesla)", "value": "f4ab7866cb01087cfe08084733e341666adf1583", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254169, "uuid": "75c08312-abba-4e83-9c64-9c93a24c5d1a", "comment": "Malware payload (AgentTesla)", "value": "5340d63a008f0ec6f3d458939063a4d794919b6afa3372bea1632b03bbc2c0ce4c1e4ad23d6cde6a568d66840c2f44af", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254169, "uuid": "2f70990e-e988-47aa-8f83-168ac6d6f4ec", "value": "T143D423C30C7594E3CFB1569D48D8C279468D439EAB537B20E3E18EE9A4DA2872F475B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254169, "uuid": "f26fd169-c15d-4252-a948-379d352bb291", "value": "12288:JVgGtuqWdkq733MBkrw7iAJMXi/Js4htFomzqoRagFJLTy/0/7:fq33Myw7a4LFlRBF00z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713254169, "uuid": "84f622fb-8ce8-418f-9b1c-dc67d45d4387", "value": 631963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713254169, "uuid": "63f847ff-0391-4794-bf67-cae5c6ba29e7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254169, "uuid": "a99def47-3282-40ce-96ba-f7cfeab97c08", "value": "DSR -AIROLAM - 2024.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa18528-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265373, "uuid": "1eaee718-5c35-45c4-98e1-77ceb81b6daf", "comment": "Malware payload (Mirai)", "value": "946dd4da13088c90005671361e84b73f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265373, "uuid": "0668cd91-982b-4a94-9970-3e1a0072887d", "comment": "Malware payload (Mirai)", "value": "6ec451cf0d61bdc4ed6b1bb08109b69fd149edeffeb32dae6e6254be9d529fec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265373, "uuid": "2a53e1e5-e250-40d1-9a1e-24a746fdb8e7", "comment": "Malware payload (Mirai)", "value": "c111880c5fa95392083d085dc0a4c7f898b25622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265373, "uuid": "e084013c-b6d9-41f1-a93e-de0602b72e42", "comment": "Malware payload (Mirai)", "value": "a684aea8b726767288d057179b926d0785c7f971276ff68d1f031bd4441bc26b6db37e0df8187d60269710fe8ad0180e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265373, "uuid": "b9886f5e-1d3b-427d-a4eb-2aa502953c7c", "value": "T1D2134A73CA6D2F98D078EDF0B8748FB41363A914814B0FB66165C278648BE9CF650779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265373, "uuid": "385cc544-d02e-4407-9162-5320c049d060", "value": "768:FWOXHVsCWNreDn3RMRRuwNH5rtwS0RF7Jfy+I:cWVJwMMRRuwNH52S0Rffx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265373, "uuid": "731e229a-0fed-443e-a7c2-dd9868395ff3", "value": 42532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265373, "uuid": "0a532363-5a49-480f-a3fc-c24d169e56da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265373, "uuid": "cea8f872-e96d-4658-a494-cfb68553d7c5", "value": "946dd4da13088c90005671361e84b73f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa6bbbd-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713248668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248668, "uuid": "c886d2f2-09b2-45da-8134-a3e042614e92", "comment": "Malware payload (AgentTesla)", "value": "f7e68cfaea60e8161208c2143457cabd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248668, "uuid": "259450d8-c266-4caa-bc71-09183ba91b9d", "comment": "Malware payload (AgentTesla)", "value": "6f3ee68a709242ec89c66deb3a5c7fa9e3a96fcde560096d1c8b7962df8a058a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248668, "uuid": "bbc09f71-6d32-4ab4-8abb-f74b9be63217", "comment": "Malware payload (AgentTesla)", "value": "47c70e352f7ede9b53c39ee1f09afebef03a967d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248668, "uuid": "31231a7c-0179-4695-9df5-41f15d19ab1d", "comment": "Malware payload (AgentTesla)", "value": "a60d60510254e263394ee312da3afb859d63a26c820b1e9f81bd78dab1d8d2907b22e5c627a5bea9937abd0e64c09588", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248668, "uuid": "904e32ec-8438-49a0-8401-c113540ed45d", "value": "T136C49B81D98456A4DD5CAB35AA36CD3542237EFDA874A41D28CE3E6B3FFB2D31026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248668, "uuid": "b7ea1b94-7831-4e61-b2ef-1a45d491f914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248668, "uuid": "5ab1d339-19f7-4c98-8901-57a7e2ba686c", "value": "12288:1uPKR1HqJCDzTeE0IRF/fVO5Tyi5DcyvLP7r9r/+pppppppppppppppppppppppH:nqOfeER/fVO5Tp5YyvL1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248668, "uuid": "449351b6-8f03-4f98-90ef-c2378fb316d6", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248668, "uuid": "c6811632-c96e-4521-92fd-f639b15d30e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248668, "uuid": "bb57d6db-f4bb-436c-b589-d04675806966", "value": "SecuriteInfo.com.Win32.PWSX-gen.14523.13498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ea7581-fc32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713300556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300556, "uuid": "6ecbfa2e-cf6e-49cf-9399-6f5577e1ff28", "comment": "Malware payload (AgentTesla)", "value": "c71fea294e5bd3beb3f863db4d43a1cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300556, "uuid": "041a4a7e-adf2-494a-a71f-6404a9ddf351", "comment": "Malware payload (AgentTesla)", "value": "6f786b8f8dd18709b9e4ad44e33cb1074d55aa2f0f3cd1fe3759e8795df0a3a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300556, "uuid": "4ce8da31-e0a9-4282-8a6a-51bfc5d322dc", "comment": "Malware payload (AgentTesla)", "value": "3a8d98955e1dee1ce2a1d95af5515b43f8744d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300556, "uuid": "98fa76af-6c2a-4bfb-94a0-f114b64bb3e8", "comment": "Malware payload (AgentTesla)", "value": "42733b5aea6cba75f11874833a85f545ce254f5d3080a99dc61a7eb7ccd3c040021dd9b42e4a18307e61f962a0235100", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300556, "uuid": "283be3b5-4b8e-450d-a32c-d717d6fd2c1f", "value": "T146F4F16436ABBF2AD9BD47F2486198344BF5705FA975D24F0FCA24D61820FC24981F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300556, "uuid": "75323aa3-3790-4282-9517-330d5a13e202", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300556, "uuid": "d2cc0a8c-4bd5-469d-a2a1-12b1b5242c0b", "value": "12288:a4h+TTJ1/EszZRDuH0z3NjVEejVWciWH4X62Fn6OfdcfelbF0w3:I8CtuH0rNjV9jpiWHZ2x6O+feZF0w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713300556, "uuid": "a3b8c111-9f4e-4c69-b018-f5c2747e730d", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713300556, "uuid": "32d7954b-4a03-4d10-9930-20143fd34747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300556, "uuid": "9e124cad-5d13-41b4-bd6d-c89b7865da93", "value": "rNNA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a804ffc0-fbc0-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713251536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251536, "uuid": "e68e603f-f31d-466f-bdac-aec875baa0e2", "comment": "Malware payload (Formbook)", "value": "fa5f8e3a3d1a7a4c4bc857aa5016b3a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251536, "uuid": "a7d814da-f9cb-4523-9e1d-49080baf9bb1", "comment": "Malware payload (Formbook)", "value": "6fde4f26f7c8bdaabed77424faff317ffbe4ca5fd182db278a210065aa66a483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251536, "uuid": "d472d0cf-4b89-4dc7-9bd4-8aff0db48487", "comment": "Malware payload (Formbook)", "value": "62c3bc0ec85fb051bbafe0e84b15dfff56877ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251536, "uuid": "4e40caf9-59ce-42fe-9fdc-24958b49fa9d", "comment": "Malware payload (Formbook)", "value": "d797ae1467906e70cd80796b04938f65da3de58241b49aff5d5e93df4d91c02b7baabb62d5fda7313290096ce0b6b329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251536, "uuid": "d5902868-5ec4-4deb-a671-2a6140210027", "value": "T14B051261EAC8C00FCE526AB284D6FB39F6EEEF432C128D53635537BF593C1899A05502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251536, "uuid": "1e15a177-db9b-43c8-92ea-5c8649904f4e", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251536, "uuid": "3b99b22a-2232-4f4d-a7e3-9e79cebc1e36", "value": "12288:TOyBItc6c1rvLRaSmLwsHKoDBmP0k8PnPepbWPPw6urWjiYP2iYZ367TCIhhDu:5W2ztvibRtG0kIPepbMwprsnCyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251536, "uuid": "b5f32157-01d3-44aa-bb20-9cdab689299d", "value": 811908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251536, "uuid": "d14a4e58-6dc1-4776-8bdd-66db98bc38e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251536, "uuid": "a98df431-c456-43bc-986b-aba9512683be", "value": "202404153836038.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1161fa3-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233969, "uuid": "f8b59b7b-80af-4670-8a02-c833b4a8fc6a", "comment": "Malware payload (Gafgyt)", "value": "e3c48d60557a393660a2924cf65f3710", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233969, "uuid": "48d39d8a-566a-42e6-95af-4d242541d53d", "comment": "Malware payload (Gafgyt)", "value": "6fedc169cfb545a90a8ebf6bb047600b015830ddddeeaf9d6e2e59675f231024", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233969, "uuid": "602bd15b-d558-4503-88a6-9386ed72faf5", "comment": "Malware payload (Gafgyt)", "value": "8ee05349f7b5b3f0978b818ff04cb54fee41d5d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233969, "uuid": "4cb92ab0-6f9c-40ee-af08-19da80e483fe", "comment": "Malware payload (Gafgyt)", "value": "85528f4436f5f00f4a37de3ac40c8036c637e802ec95bbbbc3a3fec64bec4f4a9b54fd71a7deef366f2ca4b6c9491db0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233969, "uuid": "6a472a1e-2efa-4858-acad-a8255a5e54e7", "value": "T194935ACBE783C8B2C09312B601EABB769A31F9F71921C406DBB42FE0DE450D15959F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233969, "uuid": "7a7186ff-d110-4c3d-bc60-c54557a9e88c", "value": "1536:4yFoU6OTyCbk9aWSMsPwwjvSbFf1Z76TAT6KoP5YRHxJ33Oa9Z0H+27o:4yFosbsSMXwjvwf1Vq8xwYRRJ3P9Z0et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233969, "uuid": "d561fad4-f6a4-422f-97d5-ff9702cd8289", "value": 96972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233969, "uuid": "042c7e1b-47a3-47f4-a31e-9afacaa5ab8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233969, "uuid": "45a5d304-9681-4e61-9e7a-9c76d9a81ceb", "value": "e3c48d60557a393660a2924cf65f3710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d271e84-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713253129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253129, "uuid": "3f4d1991-dcb4-4966-8fef-3054811626b9", "comment": "Malware payload (RemcosRAT)", "value": "817fca5933074f2986f443434eb861ad", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253129, "uuid": "f9ea3ed3-48d3-4c1d-8c76-08a341780d5b", "comment": "Malware payload (RemcosRAT)", "value": "7038b1250cc9380861d92e721d364cb844459f87ecc3fe002b59e97d35926dfa", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253129, "uuid": "9a45b639-a801-41fe-8432-103e29b3e181", "comment": "Malware payload (RemcosRAT)", "value": "25824f6d451f727d5dddc8d64bc6a37f1d99ab1b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253129, "uuid": "6b98726c-06ed-43e3-9724-9b9ef8411ad4", "comment": "Malware payload (RemcosRAT)", "value": "7d10a83b9e295f9f1f384f6ba98c67413298d794de5a09a05d9996ec92237b61480ec8c6aae09df9425c56417b066f12", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253129, "uuid": "c806c451-e854-416d-8e81-5dc7e0ecd03a", "value": "T1D2152368B1544B66D37BC7F984651814A3F6050F7B64F28A8CC6B0DBA7A3B34CA25F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253129, "uuid": "35c349a8-4dfc-4bf0-b575-d3e595d1d88e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253129, "uuid": "11f59574-c8db-40fb-86b3-2c0511abc9eb", "value": "24576:QQxpv7BpjHfIhWvtLp3UevtyA6Qk5aX7:rpv7b/IkttUyyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253129, "uuid": "122c805a-e404-4013-b05e-e5e8603a498a", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253129, "uuid": "87628f32-7043-4b22-86cc-6365e0495a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253129, "uuid": "a2705df2-6060-402c-8b25-20b2183b995e", "value": "RFQ NO- S70-23Q-147400000789975DXT-CS-P-0730RDER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db76559b-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265796, "uuid": "63c1d3b8-3849-4368-a812-2ce2f3d491bb", "comment": "Malware payload (Mirai)", "value": "ea5a7580eb945b007b9f8275f0aef115", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265796, "uuid": "2d788ed7-83db-4283-bb01-879d3a8fa037", "comment": "Malware payload (Mirai)", "value": "70754705be7d3fd6ca6c403678abcce63c832f34d34ac3e99ba12d80cd17e4f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265796, "uuid": "ebbc60c3-6c5b-42ad-84c8-49e63bb7d6db", "comment": "Malware payload (Mirai)", "value": "404efa9a524595728e992e13f9a9a6a7bdb4c047", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265796, "uuid": "46678983-1e77-452b-ba7c-5964412202a5", "comment": "Malware payload (Mirai)", "value": "ad70359b866ec4598e0f4a012f73053454ff86157baee3ab6eef2c8365f28efb1075293fcd0544a2366015d9eb21d6e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265796, "uuid": "17ee6f3c-7fcb-49f0-8054-0a06a9e06d7c", "value": "T143333B42A74D0943C1672EF0363717E1E3AFBDA031E4D684760EBA8A91B1E31559BDCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265796, "uuid": "0c9e226d-7985-48dd-90b7-295a5506f2e5", "value": "768:FV0UJ60WbK/wl+Iq6VQToKGz95DI6FYx0N7HWjE1mqv1PIO:BI0ezjKGz9t9e0JHmSpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265796, "uuid": "242dc929-db0c-422e-be87-f89900f27198", "value": 50536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265796, "uuid": "828085a3-f2ec-4ee8-b20f-054a1248f853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265796, "uuid": "ac88a282-afcf-4b58-bb6f-a72669926cc0", "value": "ea5a7580eb945b007b9f8275f0aef115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30ddd7a-fc36-11ee-a120-42010a9c002e", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1713302208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302208, "uuid": "a9e306b7-5e02-4c36-9e36-523e2de4d564", "comment": "Malware payload (RaspberryRobin)", "value": "026073e82684855a0273380b241b7938", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302208, "uuid": "d385fc7d-93e9-480e-8844-80b006bc7f58", "comment": "Malware payload (RaspberryRobin)", "value": "71063f63480cf26cfb18d82fd8a93ff1523decde32a10bf29f7d6c94b989c384", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302208, "uuid": "3a2293e6-0141-4607-8ac2-ab7831778f8f", "comment": "Malware payload (RaspberryRobin)", "value": "17aceb12a1f1a80cff6a13edff80d0b16461cd61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302208, "uuid": "9d0031ef-6a56-45cd-948c-35d14e17fecd", "comment": "Malware payload (RaspberryRobin)", "value": "34537e0440f2b2c77b95e5538133321eebbbbf826dec9de6104176b1f62a251814d6ef83d027f9475eb8fdcc0f4decb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302208, "uuid": "22b7cfc2-0ecd-4682-8bf7-d9f4df285b3d", "value": "T172B523137AC08473D4A31C334EB9A366A6BCB4B11FA795CFA3D4496D9E309C19A35363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302208, "uuid": "72cca5cc-e479-4d1a-ae2c-220c61aebd9e", "value": "082d9eac0e630d0d5aee6a677ef22e52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302208, "uuid": "b84693a7-9e56-4c0e-acbe-77b2b418728c", "value": "49152:ORXg8t5BfJXAE4D/VzTgEkwmNxnSaK2A2uqcKbWEWqLKL1AvKK/P4LoCW+P04i/:ORXgIBfKE2VYEzmnSDKuqcKKEWYq1ASs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302208, "uuid": "580c5666-6a88-4b5b-926c-11a13122af15", "value": 2422095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302208, "uuid": "41f5f7fb-6be9-4e6b-a9bc-5c314d354d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302208, "uuid": "03c2879a-2297-414a-88ba-574276a81d69", "value": "026073e82684855a0273380b241b7938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455be73d-fbbd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713250082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250082, "uuid": "b16ec244-21be-4d9f-9ab6-ce33a42b00c8", "comment": "Malware payload (AgentTesla)", "value": "617bc573391b773063b7557638fa47eb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250082, "uuid": "2eeb3666-1f05-4dae-82c5-c77d6aa45948", "comment": "Malware payload (AgentTesla)", "value": "71332f3996b0c54f0bcd5fb19433e7e4ca9068fc73c49af3eb260589053e5f65", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250082, "uuid": "2772d212-7070-43da-994d-c30e34f48876", "comment": "Malware payload (AgentTesla)", "value": "e2ab0744b9d84458e8f283c884b0d7cbdf42fcee", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250082, "uuid": "3886a2b2-3419-42ef-8ff4-7c4efa016b94", "comment": "Malware payload (AgentTesla)", "value": "a8dc4e2b89ff9df491fc0178c60a4c30f6d1b6b07fbcae971206c9edfb255b5692c0f708928c2e905b6a38529e1b3ee8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250082, "uuid": "6c4939b4-8402-4209-b4b3-a9792caaa6d0", "value": "T11E44231534548B4D6C67C2B806514B67C8D2A9CB4DABE8DFBCE005B33942706FA1FDBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250082, "uuid": "22171275-66f2-4da9-802f-bd33f156d216", "value": "6144:/y9BouyWrr5bDRPbx8ImDlEbxktQ7oSsupLnXfCB4r:+BhRDhqGCfK7fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713250082, "uuid": "6ff2f3d9-92cb-4e6d-837d-97f2fa98c731", "value": 260925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713250082, "uuid": "1268ee6a-b4b8-4088-9021-9f143a1d6aef", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250082, "uuid": "1d9113fd-ee5c-46d6-ad8f-8dff76c33833", "value": "order Depeng POORD20231109001.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a694ba-fbc0-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713251530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251530, "uuid": "8a0f50c8-3887-4cb9-9bd9-735ac0742415", "comment": "Malware payload (Formbook)", "value": "960339212509a67b8a3e3bc24f517430", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251530, "uuid": "5ae2f416-bcc1-48c0-bcea-5c08abb6bc6b", "comment": "Malware payload (Formbook)", "value": "71fad85530262f9ced3f2260527c71874393744db13a87510f8cda7691f2ff0e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251530, "uuid": "1f96736f-7cc7-47d3-a5fd-07548d974a19", "comment": "Malware payload (Formbook)", "value": "edc945e768c4b2d0ae88bdfa6d0cfc0786921166", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251530, "uuid": "58216cb1-783c-4997-880a-0ee42681ca9e", "comment": "Malware payload (Formbook)", "value": "8688b499ebdb6bc382166ac08fee524d0a3333741335eed3da03e7aba9a3476b6c427c4b3c7f39cd14ca281da62cc748", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251530, "uuid": "976931a0-cad2-4a45-b396-c4876dc24b4f", "value": "T19C051261E988C01FCE525AB284D5F739F6EBAF432C228D43335D37AF5B3E1499A05602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251530, "uuid": "fbf7e1bd-01e5-47db-a56a-e2cb8e4b9438", "value": "12288:2OyBItc6c1rvLRaSmLwsHKoDBmP0k8PnPepbWPPw6urWjiYP2iYZ367TCIhhDu:8W2ztvibRtG0kIPepbMwprsnCyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251530, "uuid": "185fc633-8cee-4011-a1fd-cf8ad8d01f7e", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251530, "uuid": "e98936ca-da31-4853-8ae6-35450e7ef7e7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251530, "uuid": "ed871e14-b560-4c5b-9292-0eaf34c4f6d1", "value": "202404153836038.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb28fa8-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713281451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281451, "uuid": "f9eae578-0636-451d-adf5-aa5c6cc590a5", "comment": "Malware payload (Formbook)", "value": "10171b262b1469e58eb426f703a87a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281451, "uuid": "7f2c1334-75c1-42b9-9144-a4de33e32b7d", "comment": "Malware payload (Formbook)", "value": "725bf5a2423aebe392e33a95d519ff0070f06e04dd97ee27d211c6dc46c19768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281451, "uuid": "a81fd77c-123e-422b-9f56-9cc0d6e13ed5", "comment": "Malware payload (Formbook)", "value": "e3265da31d8cd8d6a0cffaa7cf3996d7e0ed9490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281451, "uuid": "543f03f5-27ea-4eeb-8aa1-86bc5263ea41", "comment": "Malware payload (Formbook)", "value": "869e8a940b3e9e8e0cbd1d7d956e61e63d18de4202fd938b3608afff2c7b6ae76086be06060470d910018ab6bc1862e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281451, "uuid": "beed4a6a-0010-48c3-9d85-75cf06c60dd7", "value": "T18815ADECBBB650EEEB51D43D39C68EAD75A0FD312AD2090A367DBF1817316519EC2201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281451, "uuid": "d5f5dbad-1f10-4be5-b907-ef03242ba500", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281451, "uuid": "96c8f8c3-fed5-4284-b935-c773ed332602", "value": "24576:HDgVtWN/pm/avooyRDtwZknjS6zVTStNfXvt/u8u:cpoxkj/xuXdux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281451, "uuid": "3935c040-7f5d-4035-aead-85f30826c3e7", "value": 902994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281451, "uuid": "94ce1c0a-0b3d-4e2a-9cfc-97057a880e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281451, "uuid": "1f55bf9e-52a4-419e-a413-bd73d43ad73e", "value": "16042024124528724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1b81dc-fc36-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713302358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302358, "uuid": "d3cde624-9569-4c42-993a-b0f9a04228f8", "comment": "Malware payload (AgentTesla)", "value": "4e6c08a0a42eacf32c3cbcd25edd27ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302358, "uuid": "1dd082db-29de-404f-bdda-d60ef6dab483", "comment": "Malware payload (AgentTesla)", "value": "733b661ec13286e0675507c443e8c5508366cdab4f0ff91e11bc13ebea5561fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302358, "uuid": "d0a2d71f-a208-4ab9-8d16-03ee6b007006", "comment": "Malware payload (AgentTesla)", "value": "1222e0a9d11e5d9c065bf5c3d425ec7cc4b072d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302358, "uuid": "abd1e044-db4d-4c23-88ce-54da4d10284b", "comment": "Malware payload (AgentTesla)", "value": "db7490843075b53dc813924092ebe2cbfb479e72f229ce4eb39de2bf2b7d5040f1ee466d2126de134406d266871d17ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302358, "uuid": "06632d38-20f3-48a9-ba94-a70247497ee4", "value": "T17207394933B55905F5BE7BF2047108472770AC624A13D71E4BF178A92A33783CD6AAAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302358, "uuid": "727153ed-e94a-4bd1-b35e-0c26c9b51598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302358, "uuid": "71db59d1-67a6-493a-a2eb-d331abbe15a1", "value": "3072:NNAjbNIVRUOwkAkH+wWtaizGlIQZboLRM9ua/aHyvZR7d2id1Zl:NNkxuRUqT7aGlVbAWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302358, "uuid": "ca9cec33-af54-4272-baca-c44af0953820", "value": 18031744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302358, "uuid": "1897593c-58a2-45d1-81d2-8567be5115db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302358, "uuid": "3df70a2a-0b51-40d3-922d-3c1879f275e9", "value": "733b661ec13286e0675507c443e8c5508366cdab4f0ff91e11bc13ebea5561fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cae7f7-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256988, "uuid": "ce6b763a-3fb5-4410-8110-1d4faa5a4653", "comment": "Malware payload (Gafgyt)", "value": "1049dc0c0322f226f3f5f5d70834754c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256988, "uuid": "9736c6de-8b30-46f0-bb14-337efb386df7", "comment": "Malware payload (Gafgyt)", "value": "733b95cd2068d540c3e9dafcc19d75f5ebead182d08b12e0efc073892fb7441f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256988, "uuid": "c1b8c6df-84c8-4ca2-8cd7-850ee926b28d", "comment": "Malware payload (Gafgyt)", "value": "389fbce90617686eee029b50a4e6034a3c4883cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256988, "uuid": "bc3a7367-6b93-4dd9-b64c-16a0579f1249", "comment": "Malware payload (Gafgyt)", "value": "a7bd0b807142c50979c4b192615ddb288ffeb1a9c82d6036a79a9f41c8d0997d6c5427f3715a1fb1ee544425690a299b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256988, "uuid": "0cac9aaf-ff8c-4d92-97fe-9379bb82c9ee", "value": "T189D329B9F342C2B3C44706B1115BDA3B5D30B6F7176E6A06E3681DB0AE628C23499F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256988, "uuid": "196cd70e-60eb-429e-bbfe-c2664d484747", "value": "3072:yclx0/BSAMipV3SwwaY5zj85h6Naqb0mJswdytNr9:y3tD3wj85hv7mJswdytNr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256988, "uuid": "79b1c2fa-0e82-47e0-a405-362c96e011a9", "value": 142599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256988, "uuid": "d92ff132-f330-4f71-96bd-593f687ded70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256988, "uuid": "ddc44621-b149-47f2-b44d-7d97bab7c6f8", "value": "1049dc0c0322f226f3f5f5d70834754c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7072538f-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268193, "uuid": "e6362277-60ff-4796-986c-6813a2feb7be", "comment": "Malware payload (Mirai)", "value": "df0ae6b21261e9ca0f5800669b6d764f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268193, "uuid": "be26386e-19d9-4ef0-8260-00d84438e90b", "comment": "Malware payload (Mirai)", "value": "73eed0fd61f5eac05cc9e0bd73d7112accb22e37c3fc31df3494e3c9d3dc58b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268193, "uuid": "9fdbc815-0f31-4068-8e4e-cedc1933d06a", "comment": "Malware payload (Mirai)", "value": "f15b71ea7c8ee447aed7754975400db09568c09e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268193, "uuid": "837ff856-65fc-43bd-a20b-6aa8f20d5027", "comment": "Malware payload (Mirai)", "value": "6a20c06690fd84fe0a3a445de8cad76f4657768852196e131f2ec73e9cf878e3b50990dc394458364df4466047d75d2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268193, "uuid": "19ae1a4a-c28b-4830-bba5-d1367705d005", "value": "T185D2E1703D72E257CEF39733B3393E771D918459EFAA5337D055A28212640AA16DA7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268193, "uuid": "939165fb-4e70-47ad-9857-9e0cf5fa257b", "value": "768:6PdSDzjy82uFWhvR1UtgIxpD/Oy25f7GlkihyeZRo2z:+SD12uFQfUtd7DW95ilkJeZRo2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268193, "uuid": "202e1711-4444-42a4-96b0-178e5e46c057", "value": 30104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268193, "uuid": "ca23cff0-b15c-4f80-9a96-293ab2d11db3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268193, "uuid": "12c6420f-8a9e-47c2-bab0-7e72272c030a", "value": "df0ae6b21261e9ca0f5800669b6d764f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3573fa-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1713281635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281635, "uuid": "e4c98ef9-3fbd-45a6-9d8b-e4e04b169d02", "comment": "Malware payload (STRRAT)", "value": "6a74e1e28f313cc8c418f925ee17b238", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281635, "uuid": "1ce74998-0525-4568-8226-75f23a6cde7c", "comment": "Malware payload (STRRAT)", "value": "7475c3b0aacef66709e7cf06d4a7be5756744f6d5870886989bd631390e63c05", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281635, "uuid": "271063b2-85e5-4061-98a3-3eca35953085", "comment": "Malware payload (STRRAT)", "value": "ba78c5839698224a212dd32b114ba12a8ed738ae", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281635, "uuid": "e8a9e461-f080-44d6-b1ad-36329a716883", "comment": "Malware payload (STRRAT)", "value": "5f61486b0d01a3175ddee865b24b52da3088e67e11a1e4c3e9bdd1187a9264151a8cc0af69e46d58f01c41a63100bd68", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281635, "uuid": "e17985e2-9e61-4cd0-a7f2-de5076a4dd51", "value": "T1E7B4123E3ABBE168E007B53109498B65FB0D2229C144919BF6EC19591F34D4FAB13ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281635, "uuid": "4460c4d4-8ff6-4a9c-b74a-e1156bd9020c", "value": "12288:P1KaSGr2bZw4wuDSlj0IKMRdyfMgY+Tc8kVy6H:P71a23uDSlTKMSMy6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281635, "uuid": "9ef92b14-f249-4a76-b4a7-701d1dd75451", "value": 533558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281635, "uuid": "ca7e014c-7c40-4fbd-bf52-a24ea36e35aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281635, "uuid": "466d2bb0-9098-4719-a0fe-ed0dfdb2da4c", "value": "PO N\u00b0202415-0004 PALTECH_pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deff299b-fbbd-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713250340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250340, "uuid": "b9b5f931-f8b1-44d5-92fe-eefe11e906cf", "comment": "Malware payload (GuLoader)", "value": "b8fb62e7276787dac013c1a65fba8a69", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250340, "uuid": "53c5f065-68a9-44ef-a5f6-e065a5c1b770", "comment": "Malware payload (GuLoader)", "value": "74aa3a512c4449026ed41bffbe4219819305f37027be77f3bfbb9ac5e7a845e6", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250340, "uuid": "d694dced-d635-419c-bb77-224a16443cf3", "comment": "Malware payload (GuLoader)", "value": "f1f7f2da59484d112d43aee37b7f7919917a0f56", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713250340, "uuid": "e0a1788c-89c4-441c-b60d-d73d2ad0caf5", "comment": "Malware payload (GuLoader)", "value": "33347b7a8bf4a67bbc04c5ae8ddd3bd42a0dcfacdbeb76307ececff7a1fa587afac270b488e012e4b8aa2202acdd2a58", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250340, "uuid": "54bbcc23-8f85-4610-b144-a134454d76b6", "value": "T1AE141224941EAF0101743386A842CE439A7F6DECAA54941EF772ECD4F61961C6CB36DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250340, "uuid": "628194d2-6329-4d61-b3d9-d181f7868971", "value": "6144:HgLPwgr/IlW0WkJtAJar4j7t3xsZa91baGRL:HZ0/IlH3us+3f3aGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713250340, "uuid": "3a89a381-f48f-448d-9f78-87125e147dc0", "value": 196946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713250340, "uuid": "428683b4-a999-42fe-ae3e-05363a5f7820", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713250340, "uuid": "7190cf47-3db3-4cdd-9cd5-0f1838e4aa80", "value": "PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_0000000.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae35a67d-fc0e-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713285047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285047, "uuid": "3d653ab8-6f93-467d-aa3c-2585e84995b2", "comment": "Malware payload (RemcosRAT)", "value": "96bd8f3d1b8badd184f3b8de29a26ab5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285047, "uuid": "084f616b-9733-4550-b0d8-c79b71653783", "comment": "Malware payload (RemcosRAT)", "value": "74b7cbd3c66d01a6e25ccbe17375138c6a32699c61bf170e18ffecd6ebd55237", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285047, "uuid": "7116a73e-19d6-4714-9c92-53345a5f82ad", "comment": "Malware payload (RemcosRAT)", "value": "5bbf4c72f5d2adc0348ac73cc1f70608dd1d554b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285047, "uuid": "8d3a026c-d776-4d8b-8803-c4e258694440", "comment": "Malware payload (RemcosRAT)", "value": "8abe75a4fb038281bb1eb595a2bc86c0657b6815008e24ddb81b1cbac7b1e7841f83df8b85493678bb08ce956176b31c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285047, "uuid": "6968d293-bd21-4579-ac5a-988848e2fe97", "value": "T1EA73192EE74F0965EF51E63B435A4B4A09FCB33D73C500A1396C97743BAD81E4A62878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285047, "uuid": "3e57d01e-ac69-4cac-b6fe-106102f4b10a", "value": "768:pAkZM0MJPzLsiO293TlJwfhlP528HODEmG0leH18pjHFhV6xjSiUv3TknfBbEGfF:6kZPMhEE2hpfHcEmxleShF2oPIfBbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285047, "uuid": "e8bc5110-7715-4973-b8a4-9f22062e47b1", "value": 75171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285047, "uuid": "eca377cd-f1e4-40dd-b014-65d48c342890", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285047, "uuid": "69869e5f-b009-4195-b1b9-bb7f9c9ac341", "value": "96bd8f3d1b8badd184f3b8de29a26ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b9b8b6-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713281523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281523, "uuid": "0dc02fd5-916a-4623-abd2-5e09381eb572", "comment": "Malware payload (Formbook)", "value": "98b3dbde5bd59536650bff9e88df827a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281523, "uuid": "643a283f-43db-441c-bc23-757edcc52de3", "comment": "Malware payload (Formbook)", "value": "74fc7f4f9d1789c40449c4e0536f8a77ca7c46d7c748fce0caf8b8f57982e291", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281523, "uuid": "133514d0-e8a3-48c2-a53f-fbfb2fb50e22", "comment": "Malware payload (Formbook)", "value": "0ae0179f5ee2a7a25e54357f98b31240e98f5c45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281523, "uuid": "a6467b14-8cf5-4d79-93ba-da1efa362367", "comment": "Malware payload (Formbook)", "value": "734a1e811bc2f88f24e285e7670fe0601a59d512fd7c4ebdb7db10370a45a24ad377cb93744ce3fc23ecd26a0f51f65f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281523, "uuid": "b0b153fb-93e8-4829-96bf-4250494816ce", "value": "T14A544BA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281523, "uuid": "e5334dcc-1c76-477b-8bff-478af1ce572c", "value": "6144:L5dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOeG8a/XvFas:1nS2Im7f/gzTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281523, "uuid": "a53281ae-c43c-440f-83c6-183e9ada6ff2", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281523, "uuid": "c41c5f5e-3b18-414b-a672-3669287ee152", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281523, "uuid": "c96ac752-edcd-4782-b2ff-85513ba3e60a", "value": "Payment Receipt for Customer-PH00236855_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20235d3-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265350, "uuid": "e79c45da-7c6f-4786-be1b-e5b876d23e95", "comment": "Malware payload (Mirai)", "value": "dee474e7f021b0dbc56c673770084c0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265350, "uuid": "c8db8b75-4d0d-4c97-9126-9e961a1f7f35", "comment": "Malware payload (Mirai)", "value": "7544327e5a967b79453b4f7484c0057d6b85211cbb1072089c834fe40da091bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265350, "uuid": "f4bcdcf9-1f83-492b-89e1-df0c66a2770a", "comment": "Malware payload (Mirai)", "value": "9e73d16fd8deba0b21893a14704ca34071fee9ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265350, "uuid": "2435bd5c-0f82-4bf8-b9de-9dd9071257e8", "comment": "Malware payload (Mirai)", "value": "3bfc6bef16698c68b752314c1e2aedf8970954abe229d6bc29a2cd800f2d5c039f9c7362cebfee62b6637619ebf7e368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265350, "uuid": "9d9bb4cd-2a0b-4491-963b-c19986985844", "value": "T1F304971E6A228F7DF6A8873047F74E24976D23D617E1D680E1ACC5105F6039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265350, "uuid": "55f1d689-928f-4f86-8e4c-c6454955102b", "value": "3072:uTOy+1dRVBk6/sYZPtnvsrM36NidLPcpM69:uTOJF0Y5ZbcGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265350, "uuid": "5665e828-af57-4488-b36f-75aa1a52d144", "value": 189684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265350, "uuid": "edc72aa5-aab8-4fc2-8f24-7ffccf63e6e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265350, "uuid": "22fc7e64-e7c9-4e15-ac08-f91f4caf2ebe", "value": "dee474e7f021b0dbc56c673770084c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56241eb-fbcf-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713258108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258108, "uuid": "d7c2e60f-3fbf-41fa-8da7-a4ddd7058ee1", "comment": "Malware payload (Neshta)", "value": "2f8cf1eacce33f87429c022d57a1ebea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258108, "uuid": "44514e59-e9ef-4702-b209-489659c758d5", "comment": "Malware payload (Neshta)", "value": "75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258108, "uuid": "758dc0e6-7432-460b-a45f-175b29347247", "comment": "Malware payload (Neshta)", "value": "a9ebe3f2e6de49eda0493cbae362d2b033461243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258108, "uuid": "57ae1f1d-f9f9-4ee1-b248-a73122e6ea4e", "comment": "Malware payload (Neshta)", "value": "ef91e781ce23827abe936614927bd3f53c78dd69aa937c50fd7ffbcb1e3dd26c53d08a4e83bd67284350db1f0fa1c065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258108, "uuid": "316e4089-8991-4498-8c53-81a78a3d2243", "value": "T19DF41218A2A6BF09E7BD43B058314C150B77A9F626B6E35F0EC290C71975F848B81F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258108, "uuid": "fb8a2681-f845-4637-a4ef-eda695514e94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258108, "uuid": "73898bd7-dd37-4cbd-b087-b2c5ac657363", "value": "12288:mtOoZILRpev2DcHXpER+tNEty+8vzCxrml3bREqKzztrXWqahU5/R7tOjaAqVh6g:muJD+XqRuKtsbCxKl3b2qkhWRi/RBOja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713258108, "uuid": "b08264cf-19e6-44c0-ae29-68196b3a01ed", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713258108, "uuid": "6beae55c-83a7-44ec-bdd9-db678c5bc90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258108, "uuid": "a3370f7a-1e7a-40c2-80b1-3a3475d1482e", "value": "SOA of March.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9397cd73-fc1b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713290586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290586, "uuid": "31cbad8e-6d71-453e-bc56-693a89ce6618", "comment": "Malware payload", "value": "60817831fc3ea259d45c9a537172f080", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290586, "uuid": "9a14a03b-aa31-44b6-aeda-d899f0a7d0f6", "comment": "Malware payload", "value": "75d89fd4aa29e97e8859bdf734602490da0f90a4fd5213f737857d971c82e80c", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290586, "uuid": "04faf597-fe9e-43df-b6b8-c3ba628168d3", "comment": "Malware payload", "value": "bc6be7d44565b13e1008a3b962abc9bc6ee44217", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290586, "uuid": "c23b0a1a-b6da-44f6-8ffb-2216ae6d88f0", "comment": "Malware payload", "value": "94735d6b2e881f886692692b37646040ef72868179588aac6b487fae2e3dd0fc2e954f9806d3adc9e1cea7cc94ef11ad", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290586, "uuid": "7a2502f5-d460-432c-a1c7-39846466dbc7", "value": "T18A0533D11A56D1C680B5935C793F43694922483ECA3DB7F92ED2FE8A110201BDBA72DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290586, "uuid": "2e46f8dc-8511-46cc-bb04-beee7f407dab", "value": "24576:iDv3cPduvcaRMi59YF7neQfxdIhjRT2Wrp:ij9kBi7kLeQydT2Wrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713290586, "uuid": "da3e73e1-5190-4446-a086-ef5493d810c0", "value": 795674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713290586, "uuid": "702410d8-a5df-4203-bec3-86b8eeb53298", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290586, "uuid": "8aaf96fb-8fae-4349-95d0-9032544d03ba", "value": "fykbmgsz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995705b9-fc1b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713290596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290596, "uuid": "279c2578-5c02-43da-bcf9-a78815d6eb48", "comment": "Malware payload", "value": "32f61baa669991fb989439babaf493ff", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290596, "uuid": "ad2420a5-4244-44e0-94d6-94d7390c259f", "comment": "Malware payload", "value": "75db6f949461cb03a155dd26c781a3c9e00edb917275f3b4d306b7094ed06a14", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290596, "uuid": "d55b79d7-14f5-4f2a-8ff2-52e8423e5342", "comment": "Malware payload", "value": "4242d545077e3e643854e3148e00c8283533b9ab", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290596, "uuid": "2843d4d7-d7c4-40ee-8237-1385ffa3a52a", "comment": "Malware payload", "value": "91bf35c0f3f96a12b11a12f4d3ce826582fb225cd665e48d5c132130234887ea192a60e496c1c053b43b1da329b03dbd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290596, "uuid": "27ee945e-8e16-4559-b33c-bb7a193dd710", "value": "T14A31424EF4C7C14847F39AD8E0D28C18F2629007A23B8874BE4CE9862F354DCA2E596D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290596, "uuid": "54d949fa-c56b-4c96-a684-dd1865b84c83", "value": "24:/seK+C6uS9ciJ+p/Mb2vwtIjAaAs3iQe1sLPbLsH+U/jlhJSf7V7iOtXYOcqVx3:/F1CT5i+xFljAaAZthJuVmOGOcqL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713290596, "uuid": "db1df331-4a96-461f-9ba6-e9fb8021797c", "value": 1629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713290596, "uuid": "d2549292-fbfe-428e-866b-bd8acab81050", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290596, "uuid": "4e0c9ca1-d1dd-4027-8e7c-1a43d93bbae2", "value": "ndvdikok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a7720d-fbea-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713269376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269376, "uuid": "21bc2362-27fe-42c1-b28f-c08e8dd751a6", "comment": "Malware payload (Formbook)", "value": "bf78f7d9bb46ae5314ec7b6d9e651b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269376, "uuid": "2b2cec0a-659c-450f-bae0-f33a726aadc7", "comment": "Malware payload (Formbook)", "value": "76023ee62db39b5f6e730247c677494d69ead6467e2d2d313ba0f7a87f9ce977", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269376, "uuid": "2f93f499-1b30-4a95-998c-a3e76cd4140e", "comment": "Malware payload (Formbook)", "value": "78424f07e9a07b41322a2a91fa71a7db42a8dfd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269376, "uuid": "0e34498f-5d55-4392-b6ff-55011720eb79", "comment": "Malware payload (Formbook)", "value": "b2489b54e81353e79c36837b78135ef06999eeb962b19d1752838c039c77d77e8996258b4b388c47e005667c60dadb0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269376, "uuid": "3d0ade27-f4b3-44f2-b842-23fbe858b605", "value": "T1F7E41286B7ABCD96D09C5236C1D300040370974BB573D74B7BC9225DAE827EA8989F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269376, "uuid": "6bf86d81-68b6-4e52-8db8-ab93df5f431e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269376, "uuid": "820953fd-6499-4d21-869c-80b23bf712b5", "value": "12288:pCazT37rXbgicYSDZQcwGTjM5ucgZgvZ3f3bIq/bVt3zA8mH:pFXbgicYO3DToeq3f3bN3cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713269376, "uuid": "1498e4f7-077a-4bc4-96e8-a9027f2ef16f", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713269376, "uuid": "558593b6-d544-489f-ad15-a54afeb69a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269376, "uuid": "07c280b2-065d-4e89-ada0-86a16968515a", "value": "TT Invoice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62472f6d-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713257003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257003, "uuid": "ad02ce61-80e1-4833-844d-45475f47084a", "comment": "Malware payload (Gafgyt)", "value": "93e6c40e9304a662ca4883399e283ad3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257003, "uuid": "35622c76-d3fb-4b62-8bc5-ea6255adc6e4", "comment": "Malware payload (Gafgyt)", "value": "767a9d9030f329cce6e5005e05b79bfe7ec22cd9249cfe56ccbc0ab7bbea0cf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257003, "uuid": "0cc41a50-7efa-4c1f-9cff-fe6cdf9c2705", "comment": "Malware payload (Gafgyt)", "value": "b646fe9e2382cdb43f4b8b15ed70c4fe0bdc8cf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257003, "uuid": "c11c894d-cd2f-4655-8b04-976e9ab39efc", "comment": "Malware payload (Gafgyt)", "value": "3ad787daddb2c7640656e22f9da9d6ba507b010aab38d0a315bb6d915c32970faa43a17cf6885a39c1badfd9709d81e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257003, "uuid": "97720771-a9c5-490a-80e0-218b026bfa8a", "value": "T15604E53B67260B23C0E5407011E76633BDB5C7CA30B862D76BE06D9C6F2A9D43592BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257003, "uuid": "b837a428-1476-44ae-b29d-5145c7f503a9", "value": "3072:rztMPFGnxxxlqjNM7CQMfKogRphapfzPtJPMPvZy1lfpDm4wABHo9n:rznxwmmtBgRpha5z1JIvZyFDm4wABHoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713257003, "uuid": "3869139f-9edc-4349-bbc7-e613e2826ccc", "value": 186316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713257003, "uuid": "d87fefa3-fcc8-4d01-9c39-90edb9c84945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257003, "uuid": "64e39020-7cfb-4849-b107-412a9778657c", "value": "93e6c40e9304a662ca4883399e283ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6ef74f-fbd9-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1713262361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713262361, "uuid": "e1076b5e-9234-419e-abe7-b18b06808a28", "comment": "Malware payload (zgRAT)", "value": "9d82dc826bcac1bdd4c41bf79577af27", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713262361, "uuid": "c0f21f63-d1b9-45cb-a6d9-fb9edd1ef017", "comment": "Malware payload (zgRAT)", "value": "784233bc80ea7857c39dbcd9c929a626093fced8c54224e742c4d0e1d128e80d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713262361, "uuid": "3da2ac6d-008a-4701-85e0-cee0d7e31b25", "comment": "Malware payload (zgRAT)", "value": "c38360ef0e8acb8f34ebe713ab83ce85cf3fe503", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713262361, "uuid": "2e03e04b-c260-414d-8ee6-67ba12490d6f", "comment": "Malware payload (zgRAT)", "value": "383d847c336383c21a73e07f27ef7455ed81c42923f67585aa0bc9d2abaacd5bbcc9bedafed6b826258962164a536e85", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713262361, "uuid": "68b0d499-936d-4be5-92ed-43e1ae0053b9", "value": "T112D423802F99547ED7475F328CC0646063F5B5352F83EA92E429BBDA25A80FC8905B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713262361, "uuid": "b3be4f3c-a749-4c8b-a546-83ad09219426", "value": "12288:Wl5v7S6ME10osQYaJMbc9x+U6moHOLLZUEUUFMANepGEZArfRGdLc:oV+3E10WYaWAH+DHOL4TefRGdLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713262361, "uuid": "52553c53-0848-4ca3-97bd-47274b7ece6d", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713262361, "uuid": "6ec3090d-3a22-4b22-8a19-c74cee9092fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713262361, "uuid": "de3707d8-2695-45dc-a3f6-c9b50a81aac9", "value": "9d82dc826bcac1bdd4c41bf79577af27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c9370c-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268177, "uuid": "f521385f-229d-47d1-a4d9-65683cb79a68", "comment": "Malware payload (Mirai)", "value": "b0d298f6ab467cf3357e8baea7368c2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268177, "uuid": "4ed45c60-2511-41d6-851f-02f367cc5dd8", "comment": "Malware payload (Mirai)", "value": "78aa5515a570279d780b81c2ffe731450ee4fc27bc011fb05de9bb28fe9f6657", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268177, "uuid": "1c4c01f7-d632-4930-af45-822e2e81db09", "comment": "Malware payload (Mirai)", "value": "b77579f3c86c50b935eb5d8a09ae0deec1abaaec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268177, "uuid": "ff5dbda8-4453-48c8-890b-d6884ec70e43", "comment": "Malware payload (Mirai)", "value": "6cc3b638aa43cb54b659c96d09bbb167a9d361f8a6da47a131dfcf6f126902ea5c4add5619baab8eb5b0da89428b74b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268177, "uuid": "317026a2-2dd4-4bbf-b6ad-fa693c18611e", "value": "T13EC2F171A2648892FEFB55BAFC9E73C35BB0C1943A6C07817940AFD1AD231571D0A6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268177, "uuid": "1ddb2aba-442d-45c9-91ef-4e113d04a6c7", "value": "768:ZRxXNLE5qqwPNQYPGTkYpdWj53zzlvKNNwgXK/4uVcqgw0RsWXU:BXNA5qP1PGzkj53zh0NLg4u+qgw0SWXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268177, "uuid": "dfd56002-ccbe-4084-a529-7a0cccaf8b2b", "value": 27976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268177, "uuid": "de8795a9-5f1c-431e-8e5c-f69e681a2393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268177, "uuid": "573e7860-6b44-42c8-93c3-30d009932b47", "value": "b0d298f6ab467cf3357e8baea7368c2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17458e1-fc15-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1713288032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288032, "uuid": "32d25241-a474-4a89-b75b-8dbd914ba45d", "comment": "Malware payload (zgRAT)", "value": "e43faaee4f33af47b9b5fefdfa1aef77", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288032, "uuid": "43328d27-4542-4d86-9a73-b97939158cd8", "comment": "Malware payload (zgRAT)", "value": "79d6bbd408fa231a9ed7d24b4dfad0e46c4c9f568deaac3424b37e2d8a1d3251", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288032, "uuid": "bd7b6023-70ff-436a-b37e-9b315a88cd17", "comment": "Malware payload (zgRAT)", "value": "d7d18b4a8d807b11061cfdb56627fe68a4790920", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288032, "uuid": "0a211749-559d-4357-9543-05f32da3537f", "comment": "Malware payload (zgRAT)", "value": "c81b2ead1120d18376a5c9f1b4b930c8db00f674104eaaccd42e5648b0efea6a558b4d9eb400b879506ce934c67925f5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288032, "uuid": "6dd30204-f683-4857-ae87-3d88a96de7dd", "value": "T191160122F1770141C2EAC97FEEF60080DD58793D8C5EDE42C1656FAE66AE61640F0AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288032, "uuid": "b06e48bb-b48f-4481-9781-74cec3593a92", "value": "12288:BSRCuaQb62tcrsvGcTjmlwNLrHGML/5A66AeiAsfCffZ7EbjB:cRaR2Ic+lOnmWunAeiAKCnZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713288032, "uuid": "59c6e9a7-5c1a-470c-9d7b-a79c8ca8022c", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713288032, "uuid": "4661ff16-0b37-4fd8-b731-2eb134830cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288032, "uuid": "c67dd698-f4af-4421-83e5-59b64d36de12", "value": "e43faaee4f33af47b9b5fefdfa1aef77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f248ca40-fbcf-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713258103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258103, "uuid": "a0e84dd4-ad54-4227-b082-f0fb77aff9a6", "comment": "Malware payload (Neshta)", "value": "8bbb3c9c479caf5639b1553b05fc3de8", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258103, "uuid": "2761696c-731b-4aa1-ad25-71238ac5c391", "comment": "Malware payload (Neshta)", "value": "7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258103, "uuid": "1564d1af-d4c3-4717-84cf-6f7d92c4c323", "comment": "Malware payload (Neshta)", "value": "72134b608cff3a830b3a468ce166a65ae1e5d152", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258103, "uuid": "161d500f-b6b8-4ea7-98ac-660ddd5f0eac", "comment": "Malware payload (Neshta)", "value": "346939fb2988414c6caa37c7a745568b83d54e80cd75bfaad4cb140df45badd1ad1df174dd4b76567d5cbcab44052943", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258103, "uuid": "ee907616-b16b-4df4-9f4f-0c6d2c501792", "value": "T1BCE433BF8C027655F5AC2652782ECCEF3C6BC6A233CC66BD419F5A5304F9A54D6C6028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258103, "uuid": "57d448c6-ff3f-49d4-bbbf-cb5bda366e76", "value": "12288:4otWvEDeHDpE50FNOtCyMZzCx5mXLbNEqGFTHrXWawhA59R7tqjiSqXnAbaZRG:4oJDYDq5mQtu1CxcXLbiqwrWnS9RBqjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713258103, "uuid": "1526e2f9-0c08-4430-8281-fe64581ad58c", "value": 696156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713258103, "uuid": "75466e7e-8606-4b35-8998-cbb9d1cf4938", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258103, "uuid": "22c2a0a5-c9ce-4785-a7c1-aad218b43db3", "value": "SOA of March.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c0c02d-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713281513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281513, "uuid": "c5c3cd7f-64ea-4506-92c3-391db026f622", "comment": "Malware payload (RemcosRAT)", "value": "3656be2ecdf6e61566462ef1488090ad", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281513, "uuid": "6da0cd72-ed67-498a-9daa-de00e193c3c0", "comment": "Malware payload (RemcosRAT)", "value": "7ae95a8a8acbb5edb84c2972ac93b61f525c74d9731d2d72af88e53a40faf01e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281513, "uuid": "e3dfbb7a-7907-4aef-a3bc-2a16984c2cb0", "comment": "Malware payload (RemcosRAT)", "value": "09de9cf6875a005f44bed96ed5ef95903b1c79ef", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281513, "uuid": "2afc41f7-aa3d-41ed-9a81-ca49d8092c24", "comment": "Malware payload (RemcosRAT)", "value": "ff6365d0538c87af7f27be9df07c205bb30f8e5b6354acd6761ce6c5ab81cd338f61e08e4db44a454cdf289e5ca23f65", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281513, "uuid": "c838d557-8244-48cc-8b58-641616a11913", "value": "T158F3015C37B5C89AC0025C394CC8C5C751157CB2AE03AA4B76947B3F263EAC3E7679A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281513, "uuid": "46cfb122-028b-4311-b0b6-4c08edd684b7", "value": "3072:AXkJAg15J68xcYy/iCkku4+CyX4l9WGodWRtFxNP8l4eXa0H1G:AXunJ1cYy/ElCwW9zodWtF0l4en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281513, "uuid": "024f80d0-4a3f-4ef7-a050-0495a8a5bd78", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281513, "uuid": "08b79319-cdd4-4ec9-b445-a87aeb33e97f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281513, "uuid": "4c1b077b-b00e-47aa-9e50-9336c5d8b7a5", "value": "new.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd31c8f3-fbc6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713254175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254175, "uuid": "1815a6c6-fab4-4a2a-a893-5a7a52384a6c", "comment": "Malware payload (AgentTesla)", "value": "529a483f705a652ad2943e48f22cc037", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254175, "uuid": "03b641a3-dd6a-4272-8c7a-203d63184810", "comment": "Malware payload (AgentTesla)", "value": "7b360b7d9ecc11f7eac58a50bca9abbb0ffcafb81df863eb24190d32fd3c6de6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254175, "uuid": "db74be68-66e7-4844-8286-d092f18b338d", "comment": "Malware payload (AgentTesla)", "value": "b93f46e467c2f620884a9afdd70aaf8e0b6f65e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254175, "uuid": "61dd6316-6b4a-491c-875b-a23e492450e1", "comment": "Malware payload (AgentTesla)", "value": "e6c3d99f613d08190fd4bd411a05d80e8e681b6973974f21572d0d0ab4d327553b9d2d0151792c9698f0578a991ed976", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254175, "uuid": "f09a44ad-4c66-4d9c-9028-87b0e1b31a3f", "value": "T1E2E41202329EEB56D3BAC3FBB421851457F1941E0DBAC78E8DD170D62CD2BA0C566E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254175, "uuid": "8aa33425-76b0-4b3b-b712-83d9f20ccff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254175, "uuid": "7eac698e-15a3-41aa-aa04-2459481720b5", "value": "12288:daAvWzT370N692rKClw/znsMxiMDH+hNT13k8LrMNT1DKjlLw:VN6UrKClynjiMDuzXMNhD2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713254175, "uuid": "9441906d-da82-48e0-ba2c-eeac9876279c", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713254175, "uuid": "a6d5c980-c0a4-44c7-96b4-89389cf5af76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254175, "uuid": "01d2c7b4-a670-4c43-9c76-7e16823361be", "value": "DSR -AIROLAM - 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9152ba-fc16-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713288343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288343, "uuid": "d44e142c-5dfd-4ba4-982a-288513ed919c", "comment": "Malware payload", "value": "40260ec0efaf05f754300253b7a9c03a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288343, "uuid": "060fe7cb-e25b-4224-8c3e-1ea7fa8dd930", "comment": "Malware payload", "value": "7b3d2d8930ade67726e4874572985506fc0510a9ab9e176aa69b505e397c8ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288343, "uuid": "73114bdf-1f53-4d22-8c9f-356a041f28ec", "comment": "Malware payload", "value": "1d68134b19400ac8570041b1e1c5b19f1c4ef3d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288343, "uuid": "6e42d96d-44c0-4e7a-b20c-cb9a6f5c1797", "comment": "Malware payload", "value": "47fed13d28aa242c49b6b5255708e21decce8a3133ec17be0c0dc9412b1d16d82d365a4f580e14a83f513c879a4c7b45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288343, "uuid": "2cffe35a-44a7-4330-a73f-4984fa4d4708", "value": "T1B5D3B4BD2CE44863FBBB23360857122A6C994F5703D9717907E7366CAB372D8E01B516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288343, "uuid": "0ef9439a-d563-4f5f-b5ca-51343669bed4", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288343, "uuid": "ce8b4def-3d54-4e15-aa68-c9aee6a76217", "value": "1536:LndwttufsqHwqjWArz0D4/z/A0qc6I0BMMMMMMMMMMMMtmg/vSB+Ywa4vyFZAk:7dwWsF1XDWLAlc6BJtmg/kM2wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713288343, "uuid": "f30e5d81-e1c9-4d9c-9f70-61d7bbf80b90", "value": 130087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713288343, "uuid": "577e540d-f0e6-43ad-93b3-599c5ec514e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288343, "uuid": "e4f1858c-1dca-41d2-9299-52609f042c44", "value": "40260ec0efaf05f754300253b7a9c03a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed289fa-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713253051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253051, "uuid": "c0a56ed5-e681-4147-a825-7af3a7f5c7dc", "comment": "Malware payload (Formbook)", "value": "4e88079897055866905d378acde5ce2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253051, "uuid": "e07e767a-e1af-431c-97a6-4bd0ede1e97f", "comment": "Malware payload (Formbook)", "value": "7b692628c5a43cef1780ecd6223c6fa9e40a1e45932db8456738ecd61700544d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253051, "uuid": "af77db47-1a9a-49ca-b7f1-5d241cf534b2", "comment": "Malware payload (Formbook)", "value": "d47024ed8831278975eb9b6c27a8c751d0ec83f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253051, "uuid": "6780432c-82c8-46f4-93a9-7977b149ec5d", "comment": "Malware payload (Formbook)", "value": "16d4442181b53e69052f546a3ac204f6c15ba136cdcf8328d21a615bd6ec865d1c05f2e7624bb740cb2fbde617c98454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253051, "uuid": "39fb868a-5f3f-48f6-a6a3-d4bc3e745d42", "value": "T1FFD4014473EC9F27E6BD4BF45130646887F6692A3071E28D2D8670DA6AB1F40AF51F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253051, "uuid": "e0b6c85c-e0f6-45d3-8466-9d74782a615a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253051, "uuid": "e7b3f5c3-d265-42dc-9ee8-9b8a611a9a24", "value": "12288:Rynte5DllKZs5kErYVM6MneaMR+b+XH5TTljamhTk5JemT:werlKZs5kErY26Mnenwb+XxLGJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253051, "uuid": "d607a53c-12a5-4e51-9032-3c3eef3f496a", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253051, "uuid": "203160b6-f9e6-4d5f-9a3c-e8ffaa2f1b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253051, "uuid": "60f9b18e-b536-4908-b6eb-f9eeff0f9717", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef6b951-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713257131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257131, "uuid": "f53dcbcd-689c-44eb-ae26-b23fef024fd4", "comment": "Malware payload (AgentTesla)", "value": "dbdc42871d120c5e49736f7fa3a7dcd7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257131, "uuid": "a49d0f8c-a13b-4099-86ec-06f87e8df981", "comment": "Malware payload (AgentTesla)", "value": "7b7cd7c473233e30c6b5f3807b33b4f9b5234bb1720b2332cdcb31677d714009", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257131, "uuid": "715f0763-4b71-4fc9-8292-0d0faf1345f7", "comment": "Malware payload (AgentTesla)", "value": "07475184de80d7edc6b557a0dd14c00d1be9ec8a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257131, "uuid": "b7093c9a-c53b-4010-897e-056dfec3340e", "comment": "Malware payload (AgentTesla)", "value": "65cb6dd997a4f2f0288fe1d63d1cf08b06ff8c4f6a2d10b971b9f5fc66822e7cb8554e6d5dae429b64b36b3c3f2d6c23", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257131, "uuid": "bb619305-235a-4e85-ae90-878cb2e40839", "value": "T199D423728607650B3871DE7487279CE02F3741A631FF5E13887F2A986ABB10019EF9C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257131, "uuid": "e2ea8a35-8bf1-49dc-a575-6bfe8c23bf52", "value": "12288:LA3hrnn+W7eDDTEsvW9tmfKmunjGhWEoczsi7XhnN:L4hr+oe3EsvW9tmfKmuniFCUXBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713257131, "uuid": "170f3fb5-d261-4fcc-824b-6242bf710fd1", "value": 653826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713257131, "uuid": "4cb30140-4a66-44e4-9438-c9192447f9b7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257131, "uuid": "be2b6623-24e8-490f-8c80-77884d833d8a", "value": "Purchases Order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea54cab8-fbb0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713244775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244775, "uuid": "8877d5cc-a008-4252-91d2-b8ff064f2b4b", "comment": "Malware payload (AgentTesla)", "value": "287bf90df8971d58712c0279e4db492c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244775, "uuid": "91a4f3cb-56fd-4b36-9e98-5589c53e06e0", "comment": "Malware payload (AgentTesla)", "value": "7b84515dd5dae03b609288beaef3f6124bcaaad22df52c405ae9a051a9b55db3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244775, "uuid": "95f9c067-33e9-4c82-921f-9be7945d00c5", "comment": "Malware payload (AgentTesla)", "value": "256c6c333e968a77af9d72b2fdc65abce5c0d85d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244775, "uuid": "73fca12f-ebe4-4090-b1bf-5acc5b7d1c9c", "comment": "Malware payload (AgentTesla)", "value": "4bc1d72b7d50b9c7a39716a5001d9f61730a66f58f7d680e6859cf15c2d853a598c779e28b11f1fc7ff65cc8319e9c74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244775, "uuid": "04daa124-69a4-46a2-9dbd-b8e8a87b31bf", "value": "T127E4124472EFAF49DBBA47B0856258141BB979ADA072E34F1EC5A0C71A31FC08B50F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244775, "uuid": "74ab0ab2-7c69-4318-89cd-f005773666ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244775, "uuid": "f212b3e6-fa2c-477c-a050-6d5764283ef9", "value": "12288:2VhBxByJHATX74/8tFCFxeZ/2X326hgOJtdqNkIG/ukAyS5hG/DFMk2CmgK4cO:23BeH/k8eZG5hgOJ3q6IEufySDOqWmgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713244775, "uuid": "4174e64c-29c2-470a-b81a-9215d81233bf", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713244775, "uuid": "f2074638-d340-46d2-8bd2-f8ac80e4ff73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244775, "uuid": "528a14c8-0ee8-4b4b-9c0a-ef31c0f9586a", "value": "SecuriteInfo.com.Win32.CrypterX-gen.13367.14994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cad792-fbdd-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1713264033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264033, "uuid": "85e802b4-91a9-4381-b032-ce4ce0248512", "comment": "Malware payload (DBatLoader)", "value": "dbaeec2b22d9f9e51beb7cc4370a13bc", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264033, "uuid": "fc0e2479-5395-4aa4-a3d4-9b3d67256143", "comment": "Malware payload (DBatLoader)", "value": "7cbe8b93eb50d735f8cc9378d88a99013cb0aa8d7e9a30152f861d95d99f0384", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264033, "uuid": "907f720d-3c6d-4317-8563-74b5cd6ab9da", "comment": "Malware payload (DBatLoader)", "value": "7c745b0a73de683cf64182167a87e9b8127a118d", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264033, "uuid": "47528c28-3413-44d5-8485-ce54e3c091de", "comment": "Malware payload (DBatLoader)", "value": "dea0b5b830510f44d85ccd3361ec5cf1d21dc8eb4a4980ee808f671ab6c573571693571c54a54c7c30aa23efe7c8c517", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713264033, "uuid": "c11ca299-dbec-44db-8717-1a351ad44b5c", "value": "T11A355B23F5A4C822F00A1D79CD0697F0D836BF223A2758943ED57B495E3EA533A75293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713264033, "uuid": "05938746-bb19-4ed8-a814-a83c2e6dd6c7", "value": "ecd0012299b0e655dab241f2e23e3bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713264033, "uuid": "02f9b142-922f-4a2d-9870-784cb04e444a", "value": "24576:0JIq+wADGZYx4t/yVrQ9JO85sfip46OV/b7D9jv:eNAXCSfs8V/b7pjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713264033, "uuid": "d0cd21f3-cc96-485d-aa7f-daf856495dc8", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713264033, "uuid": "0083ebd9-862d-4f35-927d-7c1d032013e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713264033, "uuid": "a32d63a2-bcbe-4daa-aaaf-4386738cfbf7", "value": "disktop.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662c7cca-fc0b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713283638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283638, "uuid": "03b6a1b8-0556-41a3-82e1-bdc3e337fb0c", "comment": "Malware payload (AgentTesla)", "value": "b2f3173adb50e33e57b1d47ab9e6dc29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283638, "uuid": "63ecf6f4-fa86-42da-9be8-9e25af21fd4a", "comment": "Malware payload (AgentTesla)", "value": "7e7f02e7ac8a525256a238e4f7306e070b36199c265d8588b9a5d2193c1ae7df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283638, "uuid": "a627ea1d-5976-4805-a793-8d15e3ee246e", "comment": "Malware payload (AgentTesla)", "value": "e41f468a2f4cd21acadd1deae2509b68b3e9b545", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283638, "uuid": "c3e3df4a-07d9-4fe9-9413-bc585c632e70", "comment": "Malware payload (AgentTesla)", "value": "4d41d54f64458e02ec81f8ab64573163862e9402f85a1925a3bf7ef6f3f9c3bf6ca2bb5e171fbb6be341be81df1e9924", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283638, "uuid": "0b61ecfd-a83b-43bc-8263-0f60dd43f07b", "value": "T1F5D423DE27A9433AFDF91BFA971105140F36395BF1A8FA4A0D86B6D02462F509B42F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283638, "uuid": "76582d30-ccb3-4a0a-a4b2-734a58b066d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283638, "uuid": "fd6eb41a-db27-441d-a607-432ae68a2fc1", "value": "12288:ZnteKVK1ydfurWWjFQxRfESxwry1pReyDVQzuuuHneIxRKh9L+JqDAow0YIc:reW+QfuaWjFcRMSx7eyDWquuHpxsL+JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713283638, "uuid": "12314175-fa35-4dc2-957a-05ebea6a8528", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713283638, "uuid": "b5105338-ac47-4c5b-b26d-a9aca3b3d37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283638, "uuid": "0e485609-3c30-40e9-98bb-69d1d0e370ca", "value": "SHIPPING ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3261db9-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265379, "uuid": "fc7b076a-79a6-492b-b010-c6f77092d50e", "comment": "Malware payload (Mirai)", "value": "2a8b0dc84f54d461dc512bfa9e9c0135", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265379, "uuid": "8e9bf6f4-c780-49a4-bf98-b3ff01df2e9b", "comment": "Malware payload (Mirai)", "value": "7fae2bc614d4b3e4393f540811699856e9764bdcb3fd5d0c5f0677587198b6e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265379, "uuid": "e3ea3549-4bc3-41bc-9afe-8ee21951f96e", "comment": "Malware payload (Mirai)", "value": "066502e713339149ec0a8ecc79f5503f9f02942c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265379, "uuid": "4330f23c-4f80-4963-a2ea-d5c47aa14ba6", "comment": "Malware payload (Mirai)", "value": "ada8849e9d37ae6ce2089d439fc945f7a788403f4b754d6366754b3ec4876a05f8b8d1a48af6f42272c8e913a3fb3b95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265379, "uuid": "35cb168d-a798-49ee-9bb6-4e27a84cabe1", "value": "T15033195AF981AB11D5C1127AFE0E124E73134B6CE3DE73129D286B3177C796B0E3A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265379, "uuid": "d8fe7598-22a6-47f6-9ead-d59c3e7129bb", "value": "1536:AInXfs6KOJaEZQdMqmipvJTCm3/G5XYM:46XJa9RvJTCm3/Gtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265379, "uuid": "1f95fa9b-cb76-4651-9986-4fc0c0f63e9c", "value": 54772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265379, "uuid": "58bdc732-f8d0-4b9a-a1cb-8a5ce6e7db84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265379, "uuid": "5b2008ee-20b4-4313-9eaf-ea6d5fcb5428", "value": "2a8b0dc84f54d461dc512bfa9e9c0135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95aaa078-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268256, "uuid": "817b853c-2f46-420a-9ac3-c6ada0fc9f2d", "comment": "Malware payload (Mirai)", "value": "6b2a75284f0e5037b4aafdbe5dd7ffa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268256, "uuid": "c783a393-b9ed-480f-afe8-7e2f54d548c4", "comment": "Malware payload (Mirai)", "value": "7fc383af55f3a49e3de49a47268ce877de50f9074e9432d53788e55fbba98bb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268256, "uuid": "36d9f400-9ad6-4d1a-a4ca-8289631df99e", "comment": "Malware payload (Mirai)", "value": "1d04fb8942c7865d6900cc381c8f78de36603823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268256, "uuid": "b91fa7af-293a-41e3-bd05-f5724a3668e7", "comment": "Malware payload (Mirai)", "value": "a7f6ccbdb339d40f47df2917d0b4aa4fdd2f07c47717553212fdd87c16cc949afd6017b35c0ebdfdf99eb08c61624df3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268256, "uuid": "108e1ae7-c1ef-40d1-b048-3d0fa607cabf", "value": "T171B3960D7E218F7DFBED813857B79B21965833C927E1D585D0ACEA021E7028A741FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268256, "uuid": "0ae4f3cd-330b-480f-8264-c3f74767f1fe", "value": "3072:7gSfmqSBUF8cipNeRFGZIN47E17m86FnTPOvhu:dmqSBUF8cipcaIN47E17m8ET8hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268256, "uuid": "bf913133-d415-4aa4-a114-a90fbd897211", "value": 108964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268256, "uuid": "61804f75-4d3a-4f44-8d1f-a45d5c797333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268256, "uuid": "00a081d8-2626-4c1b-9734-ef2eebe85aea", "value": "6b2a75284f0e5037b4aafdbe5dd7ffa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2cf058-fb9d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236455, "uuid": "04cbb37e-0213-45a0-b429-779178e39783", "comment": "Malware payload (Mirai)", "value": "ecca7694ff99b8ad964851c70b010cf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236455, "uuid": "f537890d-821d-41e8-8c35-d71487d82d9e", "comment": "Malware payload (Mirai)", "value": "807ebc82750a17f7f9dae13d0b86e14fa036cd05991aa5ccc7aa788339db17cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236455, "uuid": "b309bd4c-3d63-42d2-ac10-1474cec5b263", "comment": "Malware payload (Mirai)", "value": "1213f63b0877aa8ee79a6790beb13877003359a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236455, "uuid": "aaa856c7-3c49-464a-ab34-8415466031ff", "comment": "Malware payload (Mirai)", "value": "9e5a9d783b42fc6e7af96c6fd686be86e63d529d8e6782743ad57d73e0e7b9fa52debb1c26d506562a8602f927596e99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236455, "uuid": "8b60e971-b317-434a-a822-fa6e1630636c", "value": "T1BD73A61E7E258FEDF799823447B78E216A5833C637E1D2C5D29CD6012E6024E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236455, "uuid": "945c8996-3d85-4797-97d0-fc0597f83209", "value": "1536:qztcPRFA6olzsswQBOsFz9lPU8ubdC6MbobAzwbFa10s:qC8nwQBOsVmbdC68zU8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236455, "uuid": "4962a62d-aec4-4b4e-9f50-fe40feb991bb", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236455, "uuid": "b919183a-92bd-4763-8801-dced86fe7c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236455, "uuid": "82d9fc70-5583-494d-97ab-3d12e078e142", "value": "ecca7694ff99b8ad964851c70b010cf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922b90d1-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268250, "uuid": "b28be663-eae4-44a3-a511-68d9a4fe02f7", "comment": "Malware payload (Mirai)", "value": "c5d42f3e029744f0a8b02680d19f4851", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268250, "uuid": "9c55298b-d487-40fc-8f56-a9f462f96aa7", "comment": "Malware payload (Mirai)", "value": "80e6d71e1f9eb9b4f5b791bd2b2e382768c1fa99838d7fed5edefb13a6e86709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268250, "uuid": "39bdb0a2-5b93-4a88-b55e-5e3b0163910f", "comment": "Malware payload (Mirai)", "value": "346d4b30d6e093f8bbda816a17f8372fc8e75dd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268250, "uuid": "b8a405c3-2cc5-4057-8555-79c4d8859feb", "comment": "Malware payload (Mirai)", "value": "2124f497d88f088fe9463ab5b4953ac2594f8544fdb3496e9d009c25ec9caef9f11e52e1a26d317b664dc6040eb62179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268250, "uuid": "98305694-c399-4ccb-abe9-836cf3aeec55", "value": "T1D6833981BC41A622C7D21677FE5F018E371553D8E2EA32079C255FA03BCBD5B0D6BA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268250, "uuid": "c7b322d0-bc8d-46d5-92eb-d56f6ac7b112", "value": "1536:j01gPv9OCDGQvZUsKmKx33eZtU5vWmYPNeiiW/cHvgi:j01gPv9sdx3wgYPNF1cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268250, "uuid": "f395c270-bc06-4106-bc6d-ef41c834ee51", "value": 88408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268250, "uuid": "797ad823-4e2e-4264-9d85-3f232831ee35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268250, "uuid": "da904805-1e28-464b-883d-e69337d40cbe", "value": "c5d42f3e029744f0a8b02680d19f4851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f893124-fc03-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713280244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280244, "uuid": "a5eea7e0-b316-466f-bab8-5344d92a0b70", "comment": "Malware payload (AgentTesla)", "value": "5f731c605373e3d531daaf6f90070806", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280244, "uuid": "91fd1b87-d70b-49b3-b125-173a91ecbf57", "comment": "Malware payload (AgentTesla)", "value": "81d09835289b7c6466a5321f39e0081a6c905614d303f79e15f0f6bcbf993fee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280244, "uuid": "dd68a530-528d-4107-ad74-540c5ee97ab6", "comment": "Malware payload (AgentTesla)", "value": "6c1a44be89024ffbf1c895dfdba695ecb3f66f44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280244, "uuid": "f1eab5a0-f2d3-4357-8707-701dd42c4ef8", "comment": "Malware payload (AgentTesla)", "value": "367c501a710702e0796ac60a7aa3b9125d748db494afee689137f5155a0fa8ed22d64d536c67625086f942903b740151", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280244, "uuid": "ec88592b-baa3-4fc7-bd37-7b479be3edc4", "value": "T16925AD0273D2C036FFAB92739B6AF24556BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280244, "uuid": "be3980d2-0496-47dc-89af-5d2d02d7c5b6", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280244, "uuid": "86dd11c2-bd58-4820-928a-e5097f36cd0c", "value": "24576:lAHnh+eWsN3skA4RV1Hom2KXMmHa9PF53D8RJnqA5:Uh+ZkldoPK8Ya9953A7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713280244, "uuid": "257a36b8-6336-4e07-849b-5f784758cf3d", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713280244, "uuid": "3315a8a4-11ea-4010-9b6a-27da4639237d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280244, "uuid": "c59a49a2-7897-4aea-9bb9-a24dfe6fb8b8", "value": "Comprobante9404638600.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb87f2a-fbb7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713247682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247682, "uuid": "dfa4a4fd-d27d-4a33-b995-205111252545", "comment": "Malware payload (AgentTesla)", "value": "a054288c62a8c96b4393e0d7616a3d6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247682, "uuid": "4128b610-42aa-4a6b-810a-a58c29034147", "comment": "Malware payload (AgentTesla)", "value": "837c9f462983fee07c9648d487f7ff5e1ec82c9b45d0ae9337f8c452cd0e6b5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247682, "uuid": "e65a7ff2-c719-4763-9618-ba7c3fbb1233", "comment": "Malware payload (AgentTesla)", "value": "79cb13055b7831afc39dd91ec5b32205b962b2e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247682, "uuid": "388b86c2-db82-465c-acb9-c3d62fd5aa37", "comment": "Malware payload (AgentTesla)", "value": "be90e5a8eab862cbf6e298a8a8098bb9d972ed23ace161913756b39cfc6d03e6db1a20da18f2a5609fc27f65dffdfb8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247682, "uuid": "82ad3204-ad27-4878-86b2-d6fee8b4adb5", "value": "T131E42218346A4B22D6FE83F660335415A7FA5D9B491AE3E94CCD31C5BA03B00CA79F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247682, "uuid": "d60d876a-6a76-4c6f-b308-7c0336473722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247682, "uuid": "34f68904-bb95-4ed9-a9c3-1d4171b60921", "value": "12288:EaAv6zT370OC2qoICt4VhTYFGf4KGrV0nQQCqqWLz1HL9wtT5wjBMOioRw4RjR90:6PlsMTYF+ZnwWR9wtT5wjlwwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713247682, "uuid": "451bc5de-08d2-4fed-9b1d-ed7e30063e48", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713247682, "uuid": "055060fc-282a-4ca4-a13f-33c4166b7621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247682, "uuid": "f2a76fd6-663b-4365-937a-92677a09aad3", "value": "ghVYKlWkRxFNuDb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2c6fee-fc36-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302336, "uuid": "8a254455-3ff2-4b6a-8055-d38a750ee478", "comment": "Malware payload (MarsStealer)", "value": "1ab082bcacef35f0b0c3cd2c034e466a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302336, "uuid": "3520cfd0-28dc-4a77-94db-5895c4ea6b34", "comment": "Malware payload (MarsStealer)", "value": "84f1f3bc8664335e0d492a278be9d9bd89a3100908f874ac39f77f3431884c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302336, "uuid": "b218b982-1e2c-48a3-b5e1-4ed57aafda08", "comment": "Malware payload (MarsStealer)", "value": "09eb3321a411daa11aa42908b62bbb3f22ceba12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302336, "uuid": "f3437529-fda7-4594-9aa5-64713b6ff2ce", "comment": "Malware payload (MarsStealer)", "value": "bb5b3b6a9f311970f2d57e6373d920849ecdba42526d41d74e20e82808ac29d22d86d22b6b3e304076b655260179ca6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302336, "uuid": "70ae941f-fbb4-47c6-9fb8-d81d9cb07f67", "value": "T1C5F3F18DA584EB7CC6B54BFC1DE0A7F281BEFD45020ACC49610BC1DB13DA7589B27216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302336, "uuid": "7eeb876c-4ef1-418e-906b-fd3a113dba6b", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302336, "uuid": "6cfdcb64-db3d-4376-a48a-6c51677e30a1", "value": "3072:U+SH8FyTAgkDtKW0BFr4b8JXTp55PyGNLU0JSp8Bb8EG:gcFM7kkBBq8xz8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302336, "uuid": "e179387d-ad95-490f-8390-7af5f1b374d7", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302336, "uuid": "b527bbf5-1679-4010-8036-c6e02d6019b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302336, "uuid": "1678582b-2070-4fbd-a27c-5b07c0ee52b2", "value": "84f1f3bc8664335e0d492a278be9d9bd89a3100908f874ac39f77f3431884c43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde6e59d-fc31-11ee-a120-42010a9c002e", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1713300160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300160, "uuid": "97063cf1-2688-4025-9658-ca985c9aac96", "comment": "Malware payload (RaspberryRobin)", "value": "4abca4ce3b4f93811359c9bfa0069878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300160, "uuid": "cc8b3a8c-77fa-49bf-a7f8-25ce3457d221", "comment": "Malware payload (RaspberryRobin)", "value": "8523f06f8b50885c4b4895a09eae4acf06b4852966c7acd8ce0e2d1d9727f568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300160, "uuid": "04296eec-ddfe-4394-9ff6-d8383f71fa57", "comment": "Malware payload (RaspberryRobin)", "value": "d4574fbd9741d1945c6d02cbb33fb398e9bc1d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300160, "uuid": "52ccae67-3aec-49e4-8338-cbfcfea628cc", "comment": "Malware payload (RaspberryRobin)", "value": "7f5eb893397fea1c465e270561e8457870f7a4d256a7058ec46c4f81916924dea411b7ea6ec86076c7ed3bab45e32caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300160, "uuid": "63af0169-9726-452b-8750-5d910561e270", "value": "T12FA5223277C04971E5B7663B582147526A3CB8301F2A4ECBA3B16E2DEF349D1D924B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300160, "uuid": "8b7dfcfb-60e4-45d0-a469-7faa5a85337a", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300160, "uuid": "04949880-6783-4472-8dbe-01ba4c2b5b08", "value": "49152:XcL4/T+kFc3Rqvn5LqahIxhudvPOyWyLRotSR31jc+FDoxolTx:XcL46kURgtDlIytotc31jc+hqolTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713300160, "uuid": "47704758-049a-4c35-8a34-4b18c2cc618f", "value": 2237084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713300160, "uuid": "5d8a1585-a241-42a8-9816-254b7468f9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300160, "uuid": "f46b0912-fc7e-4651-942f-8346294b601f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f028fd37-fbff-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713278715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278715, "uuid": "797d5863-14d6-4b4b-bd99-d5ed8578cd05", "comment": "Malware payload", "value": "c6eb4207ca47cc818762e65b72946aad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278715, "uuid": "01bede1c-08c5-49b5-b2c4-d9ae3c75ab72", "comment": "Malware payload", "value": "852ac38e42d2d6999c5e583e50c76348343c021859b98ba61ea5a6af931be841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278715, "uuid": "dd8eea84-2e73-47eb-8da6-dd4947103b98", "comment": "Malware payload", "value": "33dfb0d3573b2dbfa14d236d800b4b6ac443825a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278715, "uuid": "2128a934-1bdc-4088-8f57-907f969f71b4", "comment": "Malware payload", "value": "8a947c00c991675d31f62232dd5eef758627cfb7ab1ec26b7b92c70e51b61e1be2ab5497e7d886cb4fe72c0224d2b057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278715, "uuid": "c0417803-82c4-4b3f-b07f-be3a12f501be", "value": "T1D35412359FF9593EF3BE1B3178767A141C7CBD03AAF8D1DE518AA20940B2904D529B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278715, "uuid": "767cad3e-2f33-4c58-a1e9-5b7a15f7f0cc", "value": "6144:Z7Utp57JgcC9umP9mQwFpaSPBu+opYh/MLlRjdV55Y14PLckdK:a7Ydfbe8uBuhpk/wd5HjVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713278715, "uuid": "b308e7e0-deda-4edf-a7e5-cfd974219fa9", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713278715, "uuid": "7ebf23df-77d7-4208-b894-90d1ff96b548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278715, "uuid": "ce7b110e-6737-4b10-b5df-c9d515910ade", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffe150f-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265777, "uuid": "481152ec-51ed-4658-a18f-24fac18be813", "comment": "Malware payload (Mirai)", "value": "475eb443631f92cba990324492da1267", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265777, "uuid": "ca8e6850-c425-495c-9ae8-b9381eef3f42", "comment": "Malware payload (Mirai)", "value": "85be01d13b3cfb03850853b17ad8c918b99847d26578f2510c647f6fd239b97e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265777, "uuid": "fbabc650-b641-4114-a605-5da84d995abf", "comment": "Malware payload (Mirai)", "value": "781de615029a23c5406ff82bab025ae5916dcfe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265777, "uuid": "aad36f80-a1f9-431a-9da0-de6fe591d0cf", "comment": "Malware payload (Mirai)", "value": "83c354c045c99af0113b7bb3c1f17fc00ef65812fe6925ca1f37c02b195b999e8631dc687036e1afba572ff3d53d7e3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265777, "uuid": "517909fd-32f4-4a80-87f4-5f313f3fb1b8", "value": "T19EC36CB2DC192FA8D164D9B4B4B88FB81B53A58541572FB969BBC3740087D8EF500BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265777, "uuid": "1fef512b-8737-4dae-a28c-d99cb1947b10", "value": "3072:Am9Mxs30R0rYULqfSzvPveREEH3giVB1HLpvV:JKQ0zULqjH35THL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265777, "uuid": "835da457-8ace-4497-a13a-08a9c7708b48", "value": 121828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265777, "uuid": "e1941687-ea1e-409c-8977-2eca9507cc04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265777, "uuid": "22018685-d45c-4bab-85d5-a5bc52e9fba2", "value": "475eb443631f92cba990324492da1267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d596b1b1-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713234003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234003, "uuid": "0a3faba3-b638-4d0d-a9ac-05b0713bbba5", "comment": "Malware payload (Mirai)", "value": "24f2499e3b56b6cb6bc4691d77686507", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234003, "uuid": "58146551-cae1-4577-97ec-331590e5f373", "comment": "Malware payload (Mirai)", "value": "867b23b0318ed43064ec5444587fd845b8b726bb30d6e3b2782bece8f770bc13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234003, "uuid": "558a778c-6ade-40c9-b632-6df8e4cc049b", "comment": "Malware payload (Mirai)", "value": "fa402a3908ebbadcdf5170ba31646290eaa23ec9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234003, "uuid": "85f92225-5154-4b7c-9127-41f5026f9346", "comment": "Malware payload (Mirai)", "value": "040ba153f64bce599ff86266d0bb789de1ca7b527a3193cdb831ec74054fd3b0a7249a782ee6c503a20c1ea6c0252b55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234003, "uuid": "b463b9e7-11b9-4731-a1a7-6206246de47a", "value": "T147D36B536A4379B8F2B300F8D69363ED2DB319281F5E91F26881A13BDB711C94679F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234003, "uuid": "1d40b043-5813-488d-afe0-990ff67d2bd4", "value": "3072:oWGcYatyMd3Hyut/1k0gzH8bVeKriGgfVq:IcNs0gifufVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234003, "uuid": "eb0b0813-bab0-477f-9b9b-25cc4b11fee1", "value": 132656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234003, "uuid": "d5adae21-0ff1-4fd1-bbf2-4a2edcd7b1e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234003, "uuid": "41f3269b-74dc-414a-af60-ec2493e835a9", "value": "24f2499e3b56b6cb6bc4691d77686507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffe7848-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1713253106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253106, "uuid": "49b9fe21-ecb0-4e90-87c2-5bcbd7c94896", "comment": "Malware payload (DarkCloud)", "value": "5800ace6b81e2c2b8c9234fd725a61c1", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253106, "uuid": "b9b31ee2-42a4-4cbc-a912-739aecc1df75", "comment": "Malware payload (DarkCloud)", "value": "88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253106, "uuid": "464043a8-8b58-411f-8371-e4b198202db9", "comment": "Malware payload (DarkCloud)", "value": "fb93c12d01d41a35c81422dd28cba8109842ff6e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253106, "uuid": "813a4432-73ab-43cf-9393-6b76b89de9eb", "comment": "Malware payload (DarkCloud)", "value": "3d2fd532c515229a39ffd1c18235c735d8ddbcf7b331a283af3f3179594bae26ab4e6362df5a51c03a9e79a49f2a8438", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253106, "uuid": "7e8717ed-cf00-4022-9411-e24c9199f9b5", "value": "T1EA05225AB7ABCC52D1596A3AC1D705210375AB8722E7D31B37C920548D81BE6CE88FCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253106, "uuid": "daf21db5-54ab-4bcc-abcf-fc941077ede3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253106, "uuid": "0055c095-e219-4c13-8796-ac6fcb9d163f", "value": "12288:pA4DFzT37rQY/Hpf9PdsQ7scdcnYY97PuNlB/QRzIOslxN8w0sNFRzmvo/Pwetu+:KcpQUTP2cdcjj9RGCbYRKvo/PPPHvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253106, "uuid": "abf2e0d2-8f3f-4dd7-9c11-3cb5049cf9ca", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253106, "uuid": "5a1c5493-e819-4456-a84b-405c0a7da6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253106, "uuid": "7e2b3483-7200-4b28-9e0c-d5be05fcc356", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0339cbc6-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713302370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302370, "uuid": "7579939b-27b4-4bac-8d51-501c772532ec", "comment": "Malware payload (AgentTesla)", "value": "0355cc404461cecc1e67f289eac9998d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302370, "uuid": "52fab131-ae91-44e6-a58f-9296df678ba2", "comment": "Malware payload (AgentTesla)", "value": "888fc25420157ea24e1c2eb4d34f5b671acce00d1d66a6218c0d5d508d377c19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302370, "uuid": "e5a460e5-02da-43e8-b01a-71237f019ab0", "comment": "Malware payload (AgentTesla)", "value": "58ffe2b434b43c3da9835571317c9dde2313eb6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302370, "uuid": "453b0efd-6d48-4189-a012-c1e03434736a", "comment": "Malware payload (AgentTesla)", "value": "cdb8de66626bdcfd0ea0e93c7b522f588260db3b6748529756c481eeab15f6bd475c8d0103bdd46460e7bf2b9664ac14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302370, "uuid": "2ca4874f-6eb5-415d-843d-b2f5a22784de", "value": "T1D9040749B7F4490AF9BE6B3248714C5963B0E4925923EB0D4FC244A95F33780CD9BBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302370, "uuid": "a67ea74b-1276-48ef-a835-9f0c4b5f78cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302370, "uuid": "b6807c55-e98f-401d-8ffd-2e38d68146a6", "value": "3072:9YGmjDUF6vkH+LGP34o7KerVUzeeDXbwa21D59ua/aHyvZREd2ib:9YG6DU+Vbwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302370, "uuid": "b44db4fa-3346-4eba-be82-87deb402dbcf", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302370, "uuid": "bf28e0ad-eeaa-4622-afd5-e7604546a79d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302370, "uuid": "a43a34ae-f983-4a2c-a4ba-30780d212768", "value": "888fc25420157ea24e1c2eb4d34f5b671acce00d1d66a6218c0d5d508d377c19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f65a61b-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713302551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302551, "uuid": "e1d4ed14-9255-4bde-ba85-05d2b08ee3fc", "comment": "Malware payload", "value": "82132dee9a07a607146d757091782517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302551, "uuid": "78810e44-1b52-4d23-81f8-0661f83691b9", "comment": "Malware payload", "value": "8996579058ec9c3a04bd2496bd1807da60fb38c2ed8408c626c5686119cdc8e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302551, "uuid": "712dc650-a5c4-468d-a6d3-e7c030ae0ec2", "comment": "Malware payload", "value": "6b74a77a35f5e60d94541fdc49b63716d0224e46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302551, "uuid": "2319c052-1445-4ff9-a213-9642d8c7ebc3", "comment": "Malware payload", "value": "858220020feaeb0a7690b1c8bafb3bf056bf5d09dc8fb4798d26c617787bafcb643897738f453043e30bcb8b73d5268c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302551, "uuid": "7a008b52-1e03-47b8-8f12-af7c1f644c62", "value": "T12CF5E63828EE101DF373FE789BD4BA9E9DAFBA732B065499105103478613D81DE91B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302551, "uuid": "b44691b6-ea9b-4da9-95b2-92e3aaf842d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302551, "uuid": "59d0a848-bbe1-4ade-a66f-f41a98bc25e4", "value": "12288:hFyN37FMCwa/5zCoehaSiNM5JWFnOVyVI:jqADNqPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302551, "uuid": "6b29af4f-600e-4e32-8477-cd527081ebb5", "value": 3542681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302551, "uuid": "4058d5b5-b45e-49b0-99a8-7f60851ed346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302551, "uuid": "9866da9e-2a56-42e0-93c4-0f9785dbc6a6", "value": "8996579058ec9c3a04bd2496bd1807da60fb38c2ed8408c626c5686119cdc8e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58be0166-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713256128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256128, "uuid": "dc878941-e976-43c2-ba09-5779151c7d9f", "comment": "Malware payload", "value": "b386a61d20e6c8e2f00ae48b1e976742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256128, "uuid": "213a4ba1-8211-4909-9fe0-d33019fc7618", "comment": "Malware payload", "value": "89bfe0c1288a071e4d0a9fbb3a5e64077cbf194629e5121f6da2d265a314d1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256128, "uuid": "23a88e76-d486-40ed-aed5-ac38920f1303", "comment": "Malware payload", "value": "0984bb34275cb7f61b15f0fb11476a70a4798c85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256128, "uuid": "f0340079-9d8e-4aed-88d0-802091fba9c4", "comment": "Malware payload", "value": "7968fda73aa6560742e6495e6ccf3d017792bbf8e7d722dfa3c235269663a1b858225598b245d0038e8eb762c3f8aac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256128, "uuid": "023db18c-c694-4810-ae48-3da39f71e661", "value": "T19ED7336BA378A63EC75AD73D4A73ED100237FD5360095C3A22E42D4DAB31C718D7AA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256128, "uuid": "ce35491d-31c3-4b54-966d-039a6e9f5cf3", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256128, "uuid": "15f5628c-ec42-4250-804d-40a3594e1972", "value": "1572864:CqQwCY9adAvnuiNrci/5Br8h8jM3beK6Z4N7sMjBdZux8:Cd7dWt93r8h8UiyoMVj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256128, "uuid": "c88c3783-2a45-46ae-9641-8bccae09e9d4", "value": 59711208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256128, "uuid": "0ab58348-a85a-42d7-bdab-2c10d117a092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256128, "uuid": "a0d47c63-d107-4d2f-9430-1a3ca9c961c0", "value": "SecuriteInfo.com.W32.ABRisk.OHBC-4438.7709.13683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4784794-fc49-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713310505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713310505, "uuid": "46062c18-154a-4fea-a07c-cc83c12ecc2a", "comment": "Malware payload (AsyncRAT)", "value": "817d3b2845b7869b9fc71086755bef75", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713310505, "uuid": "401545a3-0135-456f-a8fb-e90a0306e501", "comment": "Malware payload (AsyncRAT)", "value": "8a2abd6e386df2a7e44e4bfa90a327b92eccdf343341ef7a984b3b2bd796c1fa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713310505, "uuid": "c4238b54-2693-45c5-a398-b59eac54301e", "comment": "Malware payload (AsyncRAT)", "value": "62afe642e08e778593a54c053af79cb2efecbe6b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713310505, "uuid": "09aaafbd-fc1c-4567-bcc5-465527bb4226", "comment": "Malware payload (AsyncRAT)", "value": "aed696028513bd89509a1ef960c77b0f1f2db776ac10de860a0c8eef4f76e0827de30cac25d6f40d5e92115486ba3765", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713310505, "uuid": "1b6c8ec5-464b-43ec-9a18-d1c59d6a5b14", "value": "T1A734AE1C36B0EC73D66759748D7CCBF06B3E78615B70925BB2882F6F0E702A1A621352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713310505, "uuid": "054cc82f-219e-4431-b46c-5332a2ff204e", "value": "bb932f22c2276e59bc42407b6728e8ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713310505, "uuid": "57e67ba1-382d-4f91-8868-034df0aa3f10", "value": "3072:GHAEvKLe+EtqHInlgz3OWtd6IwYbF2u5u1SkLRaQedb:nL7EXlgzzOI3beUJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713310505, "uuid": "fd3e9e4e-3f23-4418-8386-9f36a32db2aa", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713310505, "uuid": "540cb0ab-8280-4b38-9f0c-e2207b182942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713310505, "uuid": "e34a2540-6c13-485d-a5f9-503e3ed30fe5", "value": "817d3b2845b7869b9fc71086755bef75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563309ff-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713281893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281893, "uuid": "4a77d028-ece7-4eb2-9d78-a985de68e92d", "comment": "Malware payload (AgentTesla)", "value": "80efa79eccfa246506bd8ee651b8d257", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281893, "uuid": "5d47d049-49a9-4dd9-ab49-699fc02870ce", "comment": "Malware payload (AgentTesla)", "value": "8a3b1c3b243c320115b7c69a84abdfac2556e4bcab2f5780ddfad508c6618d4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281893, "uuid": "a45a47b7-9ac1-41b6-a6ee-ffa4a0323da3", "comment": "Malware payload (AgentTesla)", "value": "d5a40009a48be4e0457a47467932e08c240023bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281893, "uuid": "d8cffc5f-30ae-441d-9f9c-3cdd90509b72", "comment": "Malware payload (AgentTesla)", "value": "25f94080b0547d00187751bd0eb623335c54fa8e54c9b0a04a8d841c43766dece9bb7091752cee88d3fe931d34d49e7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281893, "uuid": "f3732681-8446-4d0a-bc1b-efb15e991cd0", "value": "T1D574D05CA6BEF828FE203E350C9DC6A49D2C75C230235DC56E7440A126DBFE909D3E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281893, "uuid": "f7a6adbf-a135-40b1-b673-3ccd93b4ee7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281893, "uuid": "caffcce8-8581-4416-a6fd-ba404613005d", "value": "6144:tv53vHkEKiNW2bAn8RuWVkmJssgKeyNodsTfjCzxLetbHTy:l53/mOxGUsruaetj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281893, "uuid": "5f591a66-8cad-4e6a-a557-665923289608", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281893, "uuid": "bb42a01c-90c8-40e9-8334-e2e989122a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281893, "uuid": "b5651e4a-fc3e-4103-93d7-5ab0dce75f37", "value": "hesaphareketi-01_1713247729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47b60aa-fc03-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713280441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280441, "uuid": "640f7736-28da-4bb5-b220-636c589b9a3e", "comment": "Malware payload (Formbook)", "value": "8697775141186b697fe8cbc59ac8bef9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280441, "uuid": "5280483d-f0e7-448e-955c-1a11c0e1ea13", "comment": "Malware payload (Formbook)", "value": "8ab1bc56f445ec6d0724d02781a5e8c29a06a6f1cf3c7a9a203a6f902cb7395a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280441, "uuid": "f791a00e-2ac1-4c61-ada6-88cf261510f2", "comment": "Malware payload (Formbook)", "value": "9af828ffe7e94acb103713dd42c7b7dd56a7d972", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280441, "uuid": "2085c870-96aa-4106-b2dd-50e7b821b868", "comment": "Malware payload (Formbook)", "value": "6923ca01e73043f1ce1733abc6fc0431f57845ac056b2d569a0d9eb98e7a34b157fcfa2a783f7891879be9b9b8573542", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280441, "uuid": "e4b409a5-3640-4f50-8a63-e31e268cf419", "value": "T12A25AEECBBB250EEE752D43D39C68EA975E0EE311AD6091A357D7F1817322958EC2301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280441, "uuid": "c8a44f34-52f3-40c1-9f2b-fab8ec8b3f39", "value": "24576:6DgVtWN/pm/avooyRDtwZk8D2RncNogPgct/R:FpoxZDmndct/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713280441, "uuid": "e707811e-4fab-4546-9749-f28801ce732a", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713280441, "uuid": "ea5fb6bc-76bb-400b-9061-4c07399d6946", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280441, "uuid": "465bc8b9-9763-42e4-8216-c06014cbb70a", "value": "160420241245287.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce7127c-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236780, "uuid": "4fb28089-1414-4fc4-9d46-1b6ae3a76473", "comment": "Malware payload (Mirai)", "value": "6448d6a1dafdb0757a888003af1bb51d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236780, "uuid": "bc7103d9-255b-4235-925d-fe6d5535ce98", "comment": "Malware payload (Mirai)", "value": "8b13054079014535b3ecbfa1c0f03ff56bdd129fedca59f5b7622908587d87b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236780, "uuid": "3711b023-5bee-4e76-9882-4037f96dc082", "comment": "Malware payload (Mirai)", "value": "49090da20c40ad35ed24b90e799b157e0fa3beae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236780, "uuid": "1b5ec2f8-97a2-42b5-913b-1ba489ddef41", "comment": "Malware payload (Mirai)", "value": "adb123e2e58cd8d5929db3e6db1df49705551dba435ac85d5b9dc8d30f028b84a58fe555b340d2eadb1307c2504809da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236780, "uuid": "871f3884-4f5e-46cc-b99f-82addb387d92", "value": "T1EB43289BF8019D3DF40AA6BA94274D0DBD3063C113830B3667A7FEE3AD721695C52D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236780, "uuid": "67416632-a4e7-46d4-af10-5274e25e34d9", "value": "768:yUeGmdS2VqXbQUHA3/J3Qflu11JovgYNuud7Cy2+z2XO8Sl0WnU89yAWyQN6gHxf:hZ8upF7j2+z+O8SuWZ9yAuN6A1rLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236780, "uuid": "7bf330c4-4d07-4553-9a14-e5e8078ca7e9", "value": 56464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236780, "uuid": "9226feef-9ead-433c-aaea-f1a69c76dd15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236780, "uuid": "ab011b6f-4312-4e44-826b-20b1f93d0cc8", "value": "6448d6a1dafdb0757a888003af1bb51d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7298bbe4-fbd6-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1713260895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260895, "uuid": "a2ee87ad-d6e8-4f4c-8fcc-8972cb0ee33d", "comment": "Malware payload (IRATA)", "value": "fc1717dcb2b85501d6af3f2c15f681fb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260895, "uuid": "09fd045d-7926-4110-ac6b-ba44c8b4ab4b", "comment": "Malware payload (IRATA)", "value": "8b1660cc87654e10f3809b0eed81c25382b94c7962da1d896614d5ef113e5e80", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260895, "uuid": "531cb8f3-5546-4dfd-913d-b11dc6c34b69", "comment": "Malware payload (IRATA)", "value": "5295f93df913e307bfe451bdf5c795bd5ef291b7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260895, "uuid": "b74d262f-cefb-4335-b674-c3e7385f8030", "comment": "Malware payload (IRATA)", "value": "4fe99fa89445e5e14bbb0f5ecdb1d1c87164bba5bd2b583dbe6b8916bbef063a7cb09f06e9af3556ecf85ec1eafa55f5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260895, "uuid": "f3eae6db-5130-4846-979b-de9f748ff084", "value": "T1EB951283F725A86BC4F6D3322165123A903B5D28CB47BB863D5933F934BBAD84B915C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260895, "uuid": "3b189ae5-2061-4994-840e-97c95ce371b1", "value": "49152:r/TbgckgdPw3kv+GDCjoOXHO5NQEVhD0UYrjPt3Y:zHgckgVw3XG+EZ5NQEV90FY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713260895, "uuid": "54a93250-b7cb-403f-b9cd-e37a6a616e90", "value": 2012208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713260895, "uuid": "4351e371-9c54-4446-9912-c5ef9fdcfae4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260895, "uuid": "c03f78c6-9417-4488-bb0a-521eda0d51ec", "value": "Mad-rat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e933dc4-fbca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255654, "uuid": "07d6c9d4-a78f-4bdd-b8b5-49ac124a00d2", "comment": "Malware payload (AgentTesla)", "value": "5779ce3611d611c170b29240c4e2e1d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255654, "uuid": "90980ec5-5816-40c2-80d9-e82518bc44ee", "comment": "Malware payload (AgentTesla)", "value": "8b9b9705edefa8c599c6035b2ec7df05063306f7a5f0def6c0cd1476536d823b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255654, "uuid": "8796ab58-8109-4076-93de-2f1e36b47ce8", "comment": "Malware payload (AgentTesla)", "value": "2d0cfc3b0e0b9eeff91e1ea6dfc11e73002abf2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255654, "uuid": "c39196e8-78dd-456e-b72a-9bc7e4471a34", "comment": "Malware payload (AgentTesla)", "value": "5bd98fcebc9d9463389bf7b8e97cc4055e07d9e35d9fe815ee8c40829a1f560f5b591f576cfba8c7a649c0685cde5a08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255654, "uuid": "2a891723-63f4-4a4b-8863-f5bdbfdc0d7e", "value": "T1DFD423C30C7594A3CFB1569D48D8C379468D439E6B537B20E3E18EE9A4DA2872F475B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255654, "uuid": "90deb888-5efd-4d18-b458-41b5825edbd5", "value": "12288:zVgGtuqWdkq733MBkrw7iAJMXi/Js4htFomzqoRagFJLTy/0/C:5q33Myw7a4LFlRBF00K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255654, "uuid": "6924fe10-d48b-4cbf-a10f-f40aa4618fee", "value": 631975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255654, "uuid": "f0c42e81-37ac-445d-8dec-71a1bc61feee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255654, "uuid": "2398f40e-560f-45f1-afa4-554b6b63e358", "value": "YEN\u0130 S\u0130PAR\u0130\u015e PO .2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6649bcf0-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713257009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257009, "uuid": "b4543d65-33f1-49c4-8b17-c0db0a776286", "comment": "Malware payload (Gafgyt)", "value": "c551b347ee5e13dd63eecaf9de26a4e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257009, "uuid": "bdbe6eff-2c1b-4e04-bd48-f750221852fc", "comment": "Malware payload (Gafgyt)", "value": "8be86fe897c9733061db0859ed0db8b67989177979b4bdb92b1a5f2b8116fdd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257009, "uuid": "9cb725b7-e3d9-40bf-92ce-e6248df2303e", "comment": "Malware payload (Gafgyt)", "value": "e13259e6553d77790426f175b3b381da4ed19735", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257009, "uuid": "97b1ae93-2a3b-4b27-888e-24e72fe487b1", "comment": "Malware payload (Gafgyt)", "value": "2e05e06e597c3c2d335adb6e68ca339f101ca9a9b2ff53aa4464ed54e8f611642633f688b8afa6cd3d1e7325572be337", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257009, "uuid": "59764c93-bf3b-4b8c-a0ae-148aa89734ef", "value": "T152244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB03FC2B9A1D75925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257009, "uuid": "39005b6e-adc2-4dc1-b108-42fd4a038091", "value": "6144:FZzyacCwXJ4DbpW0va5hbL6nWgV7Ocgym0wfB5RyAn:FZzyacCwXJ4gF5hbLi3gym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713257009, "uuid": "0e991e39-8e30-4c2f-b80c-7f5a27ecc575", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713257009, "uuid": "de3c1776-d887-4db4-acfe-ce2d777cfdc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257009, "uuid": "7f1ab764-dbc2-4b4d-a5f4-ae6198a954e9", "value": "c551b347ee5e13dd63eecaf9de26a4e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ceaf57-fbd5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713260465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260465, "uuid": "6cc0364b-256a-4a8d-8ff3-508a4c049b31", "comment": "Malware payload (AgentTesla)", "value": "0e0942c25252dd6b7b9060403237c23c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260465, "uuid": "03d54b5e-e6b0-44c9-aa50-cd3ed777c5ba", "comment": "Malware payload (AgentTesla)", "value": "8c304594adb8d9835dce06ef5b3c130b7fa299c76e88d204c998401b71266859", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260465, "uuid": "6f232640-ad3c-43fe-9711-72e054a92786", "comment": "Malware payload (AgentTesla)", "value": "97b3e794940fbbc152338a012f8d9b90b0dc0fa9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260465, "uuid": "d232bba6-26c3-4432-a4a1-5f6f9742ea6e", "comment": "Malware payload (AgentTesla)", "value": "61e6648364a4e392c7b5d77eaa2ade1b2ce8c887cdadc84b03fc9b36ac8c9e5b1816edf60456bf9d05f96ac2c9de6bf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260465, "uuid": "b160349d-932c-4282-9923-fa048eef0084", "value": "T1C2F4E19466BBBF2AD57C47F2593188300BF5A55BB831D24F1FCA60DA1961FC04982F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260465, "uuid": "d5fa2a71-7b47-482a-a5cf-581e8d11d6ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260465, "uuid": "db97a437-537b-4659-b67a-f209fb75f70a", "value": "12288:vQoWn8+ezuooAV0LM3GQOUUZPJ/z0ceVmB2htTGGKWZ1Qy2Sfsuw:y8JLx0IpOUUZP+ceVmBmBGGj3QPSfDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713260465, "uuid": "758bb988-f32f-4cdb-9018-ac491a0d39ac", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713260465, "uuid": "642fc5a6-cf24-48a4-b4e1-ad7266f6bcdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260465, "uuid": "3d611614-153d-477c-864e-ffd71ab39030", "value": "RFQ#1047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2458813-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713253352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253352, "uuid": "1a29ed6f-0b76-434a-aebb-27c8fe6e897b", "comment": "Malware payload", "value": "573123285ecc9c9d6e72284fe7feca08", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253352, "uuid": "6c148491-526f-4d0f-876c-3771d9f50f78", "comment": "Malware payload", "value": "8ce3934b08f1922abcc647f70411f884d1528f2d774c782ec7a7ee92c1e476df", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253352, "uuid": "04caac00-2920-42fb-8bcf-556a6378469e", "comment": "Malware payload", "value": "8939371c0084825b91d919affa394ed564768de3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253352, "uuid": "9ed06990-5054-441b-b78f-8fb7fc4cef00", "comment": "Malware payload", "value": "6a6c6c7009f602df4a3da9db23883573bc0d17214670da165df66e3dc8e64ae6101379e7a32a2572fa0207c9ddeaff58", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253352, "uuid": "5049eb07-5ded-4f61-b755-916dc5771776", "value": "T12164E051FA818616E856437189F78A9A6325FC416F934B0F324CF72D3EB03F45E27A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253352, "uuid": "06b02298-875f-4a77-98f1-30ae8e1e05e0", "value": "6144:QuunJwsY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVJ6MI8OI5yezo3irlx8e4:QvJwh3bVJ6MI8ATo4Jq8UhoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253352, "uuid": "1b7b8a57-7270-44bb-97b2-e95c2f64f754", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253352, "uuid": "52101250-4097-4272-ae10-ab2012728eb8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253352, "uuid": "61c0d35a-60be-419c-8d36-e1da8366baa6", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71937ee5-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713281510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281510, "uuid": "473ed78a-bc74-4d52-948c-bcb770ef984a", "comment": "Malware payload (AgentTesla)", "value": "3c4e8ae62e269c2f16af58c9ea32e37c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281510, "uuid": "8e884b66-9db7-461c-9493-6f8dea13dbeb", "comment": "Malware payload (AgentTesla)", "value": "8d4cdc191f9fd842ef21c3c21a432446a82e82883f94edce796393c3ce7fca40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281510, "uuid": "ab395686-1b89-44d9-a432-e3b9dd44c995", "comment": "Malware payload (AgentTesla)", "value": "f3135ef6aaae083288912876236f69302d169495", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281510, "uuid": "ef7206be-9b28-41a2-9060-6309ef590ec8", "comment": "Malware payload (AgentTesla)", "value": "1a4af393c046238b657dad3f5017558d5255809db066cfb47227a1cc76147af87eaee30f0278c6ef7d0bdc29ffdc6e52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281510, "uuid": "61464772-4501-4b43-8d21-eda46010fd45", "value": "T140546A2ED34F02698F920372AB1B1E95A6BDBA3EB39051B1341C433533D9C7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281510, "uuid": "deb3c90f-424c-4248-aaab-af2e860af2b6", "value": "3072:PsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKME9XOUVwOsMmU2:gKMeKMeKMeKMeKMeKMAXOE592", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281510, "uuid": "009d1203-a9c5-4441-bb3b-4c3f1162d018", "value": 306484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281510, "uuid": "70e44043-7218-4452-b52c-d6b7692e2b41", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281510, "uuid": "e960e1ae-f229-4c5b-bc57-ca400e849eb3", "value": "MV SUN OCEAN BUNKER INV.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a69110-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713253123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253123, "uuid": "32f3dfd0-a728-4492-9593-8fb964681b72", "comment": "Malware payload (AgentTesla)", "value": "c80973c70f85bd1306dde3638c065b4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253123, "uuid": "fdc4eae9-d23b-4d7d-8eaf-a47cb535bbde", "comment": "Malware payload (AgentTesla)", "value": "8ebab1052de946555f1e0e4a7f60d8a65473600b199662479bdd9054b135fadc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253123, "uuid": "7d0abbac-7c9e-4ab6-b3d0-f5e7afc486ce", "comment": "Malware payload (AgentTesla)", "value": "ec78cf4edb5755a7436f405514f7915bee8453c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253123, "uuid": "c6fda31e-283e-4733-b2f3-6ee33ddf59a4", "comment": "Malware payload (AgentTesla)", "value": "b58e6ec9ea8025c619c9316995e26dff294352c35c70cdf535da2c7682b9f3ed69d790aac77e541101293d3ccc529014", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253123, "uuid": "facd52fb-1479-45b3-bb3f-8abdd294d4c6", "value": "T14465331428FC4B92DBB907FAE6254514B3B386265472FFDC0DF120DB0DB5B208A59B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253123, "uuid": "9535eec6-fdc6-409f-b0d6-6899e2713b69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253123, "uuid": "98a2cc44-bdaa-42a1-adbc-9db71d47a01b", "value": "24576:jCfeRVeaNWTOFd2GwGba52FW21pX/9xd3vlKqNLzCpy+katRjthXibCHn:xOTOFd2GwCa5D+pX/zl9RzvCR7Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253123, "uuid": "ce63984c-8ddd-450c-baaf-0ae65eacf1f4", "value": 1465856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253123, "uuid": "92172337-eba5-4af8-b0e9-b59fa6e3b1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253123, "uuid": "8df8a167-6db3-46f4-8a7d-ce1c8e6abb79", "value": "DHL_46773482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ed81c9-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265332, "uuid": "e801ce7d-72ab-40c7-bdb4-5b2e7001e384", "comment": "Malware payload (Mirai)", "value": "87025a388f2b6c749985f50b137d82a9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265332, "uuid": "bebf3adb-e124-44db-9e31-4ddb08c30b1f", "comment": "Malware payload (Mirai)", "value": "8fdd2d341429950f578eadac021f638da0f1d21ed95e6022bd9c0be77c5dc8bb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265332, "uuid": "09201cbf-9adb-40c7-a7b5-d5d897b28bd7", "comment": "Malware payload (Mirai)", "value": "33ed092dee8a0365c0d2a9ac53d477284d239f90", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265332, "uuid": "24df4f7f-0fad-430b-90f5-4e2ca54fa8f7", "comment": "Malware payload (Mirai)", "value": "3b71c0bc3c326d62dc2e1cd290336781a9ad4bf4bc06c4b0a5e1f58861ccb3ec946e118aeb8cf67bff3d00900a20262d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265332, "uuid": "e96ff4eb-920a-4afb-896b-92d3efacc808", "value": "T1ED433B0764D080FEDCB9C2B88BDE972DC633F4792355F20977D4A4A35A4EE21AE6A540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265332, "uuid": "d660026c-fc6b-46ae-b6ee-1631afa8f0e9", "value": "1536:xAwHD5w0w1O2bmltwtFgOgSNggv1gEggggggggggggggZgigduglUNggg:xAwHtw00SlOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265332, "uuid": "c49c85ea-75f3-45a9-b44a-e45adb727a75", "value": 59112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265332, "uuid": "68bf0743-b768-45dd-a3ec-3ec0b434f094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265332, "uuid": "a43f8f44-e2d4-40be-8857-759337f09e2e", "value": "87025a388f2b6c749985f50b137d82a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b00fdd-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265791, "uuid": "55916d6c-e2ab-4886-bc03-296e4c4b3d0f", "comment": "Malware payload (Mirai)", "value": "b47dbf3589e9285f2b69fbedac69c7e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265791, "uuid": "eec3f78b-2c21-4214-8733-975535a84c4b", "comment": "Malware payload (Mirai)", "value": "9183ded2f0497088f48cdbf0dea314616ef43ae5673b89622454e92ed40b504c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265791, "uuid": "16dca96e-04ef-4457-a07a-8014683fdd47", "comment": "Malware payload (Mirai)", "value": "404c5fc04607d537aba0b21f429e6188c35ae5ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265791, "uuid": "24d152c4-eed5-4007-85ae-7dc0fddec80c", "comment": "Malware payload (Mirai)", "value": "a48e5d684ffa48bea858609341d37cbe84a8a1a513d515ec965be0cf4a2e6e2b5861c494190dc8506a56b8e24635e47e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265791, "uuid": "87316fb6-6368-4040-8b78-24d3cbfa27d2", "value": "T1C6234148FB59A32EC6A1F2FEEF5941CF76390B9477FA3D268231414923C87386536524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265791, "uuid": "f78b62be-aa10-4e72-82b6-2e6b382ab5b1", "value": "768:bVgcIPbm0m3yuxVqvl2mycHv39TA4C1SCR08/xGCTaK9OyLep2vtaM9o67jbdtSa:bVgXSmd39TALjdJ9PQl2bmD92p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265791, "uuid": "a90cad5f-ba9b-4740-9918-15decf5cb468", "value": 48703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265791, "uuid": "94dd2a9b-c444-4ac1-9ac4-875c7d18b5f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265791, "uuid": "353e2717-9598-440d-997c-9e8b041e1a71", "value": "b47dbf3589e9285f2b69fbedac69c7e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b932b4-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256975, "uuid": "497b8739-ab56-4082-981a-d0b7bf9d91f2", "comment": "Malware payload (Gafgyt)", "value": "100902f00c5512cc70f3aa66a409f1a1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256975, "uuid": "c3d6a7c2-4266-44fe-b9b4-bbe42aa8eb8c", "comment": "Malware payload (Gafgyt)", "value": "922ca59ef38c7018899f7a908bc11d93c06e5a48b06d1fc01b4bcd737580a0df", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256975, "uuid": "6fdf067f-1d48-462b-addc-09f4f830125c", "comment": "Malware payload (Gafgyt)", "value": "6695deb87d293089d785a5eef2d0e2e904d06b98", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256975, "uuid": "46268ab9-d2be-4443-bb32-50f3dea2e1ea", "comment": "Malware payload (Gafgyt)", "value": "53dba97d07f8574d1fc1dba518eecac62516cacb9148c4a04715970dbe80592c3620b0d1efd2cc8904c25d55bd3bdd2f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256975, "uuid": "7a3cb38a-e0a1-488e-9104-fb8d65ff0d09", "value": "T109F30933F2D18CFAC04342B027FF9AB2DE21F1FB1776311727602D605E5A9865E59A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256975, "uuid": "121d0acf-8ae9-400c-8925-ba4532c2443a", "value": "3072:xUL2FlZkJoC2gQXalWvRbfFphahpCn38nuVAlZl3nmBT38dAY4:xDvhFphabkBwXmBT38dAY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256975, "uuid": "e8a72e91-453e-4846-a322-7122b38c0a2d", "value": 159108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256975, "uuid": "6c53dc5e-2c3e-4182-b513-45a0ab763904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256975, "uuid": "1f9b0df6-3f7d-4757-8015-55606e1a6a5d", "value": "100902f00c5512cc70f3aa66a409f1a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559c386e-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236795, "uuid": "57e73db0-e941-4ef9-93f9-1db4d3a0217d", "comment": "Malware payload (Mirai)", "value": "41655f175483129a88f03af8d6f20a5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236795, "uuid": "dcf4a4de-d890-4a1a-896a-7d50104ff3b6", "comment": "Malware payload (Mirai)", "value": "926fe5de270436bb8acba007c93a1bf89e08c6595ba212989d37ef00c90d7764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236795, "uuid": "5872b21d-8d38-419f-b204-d627ed6e0e0d", "comment": "Malware payload (Mirai)", "value": "eae5afcd12e2d3356d67b90a98ac783265d78b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236795, "uuid": "273467b5-20d4-48bd-a3b4-32aaf86978cb", "comment": "Malware payload (Mirai)", "value": "e2af8196e716b647aab0b3247be96c05657d54f0093b44ee06c4b674084d5372588898607b9d2a5584104f316a5f579d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236795, "uuid": "2574d5a7-d498-4682-b01b-5aab85d8ac49", "value": "T1EE435B21BA352E17C0D2A4BA20F74B24B5B517DA26E4C61ABD720F8DFF211506513FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236795, "uuid": "29963c14-cffe-4c9d-b7ed-0bbf0f1ad35b", "value": "768:6MCvorOQHgTKrdjkoMTfu3u9y3kwR/7eL2w9vpEjmN4gpywO+EZ/Jh+lV0UnYA:pCvtQHGKrdj2Tfu3B3kI7QbTYfiV0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236795, "uuid": "fd82a6e6-e204-4959-8b44-a660fa2c515f", "value": 60500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236795, "uuid": "0cb2b625-9caf-4556-b228-b221dd2ca6a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236795, "uuid": "fb4cf831-9aaf-4fa2-ad02-a46528ec5c5d", "value": "41655f175483129a88f03af8d6f20a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87bdefd-fc0e-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713285038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285038, "uuid": "10c13e57-f81b-4a92-8a64-3e03335e5028", "comment": "Malware payload (RemcosRAT)", "value": "002863a1610420fbdd33527b235ae720", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285038, "uuid": "86dd2163-f2c6-45b9-9f69-0ead6f7dda6e", "comment": "Malware payload (RemcosRAT)", "value": "92a8482b9e7ca1ad4d86c76cab2ed363fa995cdfa50c919a3714c28c7016020c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285038, "uuid": "9a9bd4cf-10d8-43fc-9fe1-89f6e1fc2bee", "comment": "Malware payload (RemcosRAT)", "value": "0e954b555b08faf3dae04019947ab06f751dddb0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285038, "uuid": "30a490bf-9076-4109-b68f-e7d3a53fd598", "comment": "Malware payload (RemcosRAT)", "value": "ef1287a6c505dc2dfe48db4430f793dd2693555a86402882ccbde4dfef7bd13b641f2889082e1cea044f399999d0336f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285038, "uuid": "bc9a65ce-c302-4dc7-abe1-bbb3cab286d9", "value": "T14A639F2EE70F0955DF55A67B434A4B490AFCB33DB28540A179BC973437ADC2E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285038, "uuid": "42b6b781-22e9-4ca1-8e95-55c80491df1f", "value": "1536:4l1SraAXer10fWIydP+5F1ooej8PKRecB4+itb52sDWtvUCUUSVpRA/o:MS+AXer10fWIydo1oxj8PKRecB4+itbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285038, "uuid": "abd12a57-a113-4c5f-9fe0-98591196606e", "value": 72385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285038, "uuid": "ea9c3073-a730-411e-a115-bdf7b0d99ae3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285038, "uuid": "a98161da-5b80-4d68-bf2f-6305b5f0e007", "value": "002863a1610420fbdd33527b235ae720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff54b18-fbbb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713249509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249509, "uuid": "323de020-e0a6-488a-8901-c204d88498df", "comment": "Malware payload", "value": "f323861a7331c33c2b0094c778f7d1d0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249509, "uuid": "370b095d-485e-4a70-8212-0db738bfd67b", "comment": "Malware payload", "value": "92bf414b664c577fce8a8ae8d3d54527c9b7ecda4abc3ae3174bb0594afd752d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249509, "uuid": "b1e11bfd-05cf-4701-be38-bc303acfb341", "comment": "Malware payload", "value": "74b8f12c1e2a6f35c95c8b38a3532dfafd545f93", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713249509, "uuid": "b99888cb-e676-4206-a54c-7945e8b2c282", "comment": "Malware payload", "value": "b6210b0a6f565307a44aff0bcbb7c93f54f4a53301a9114184e75f085896f4f002b59531c5185c742f7fdba091c4a638", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249509, "uuid": "f3ee2098-687d-4223-8688-675d9d075206", "value": "T18AF423BF874BEBB41CDE06B7EE3889E1DBC7BFA6B502B03A11D50B6089171E13585056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249509, "uuid": "c798a039-84db-44a4-a473-978e8d8ce7c6", "value": "12288:x99tSMli6YHX1QxKu0LXc2ic5U9OgL8uoMOwRp3VjPzhkU50ZK:xzYMluyxUHl5hTuPjFNkI0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713249509, "uuid": "e75c8ff8-f770-4930-a57f-3be3b6bb7173", "value": 737956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713249509, "uuid": "fb275aab-fd39-4182-8516-3554734bdab4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713249509, "uuid": "254f344e-c8a6-4ce5-82f9-79ae74e0ae59", "value": "SOA MARCH 2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6793f1b9-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713281922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281922, "uuid": "d738da65-0813-4033-be70-2d2b74bf61d4", "comment": "Malware payload (AgentTesla)", "value": "f0df8ff6334732825c1178f312880fc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281922, "uuid": "f1a36562-e52b-4189-98b5-78fa2f095d97", "comment": "Malware payload (AgentTesla)", "value": "92c2d0f631f4ede99b0b53802aead30383ae5539be8e785b3efe8d5cc85dcc05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281922, "uuid": "953c3c5f-3ab8-40d4-a035-2c56a593f7d4", "comment": "Malware payload (AgentTesla)", "value": "1b2dd1c1e33467ecff88bae457753366623bb4a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281922, "uuid": "10db4c59-bdb4-4b27-9127-bf49d49c738b", "comment": "Malware payload (AgentTesla)", "value": "d92aad570c1d2562f34040e1ba831b8d5602a13ad95e0c5f774e8c0fc977ebdb4de996026efbb9cb2119f86a3742cba4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281922, "uuid": "1e00492e-11ba-4bea-9495-32525f103307", "value": "T11C45CF0273D1D062FF9B92334B5AF6115BBC79260123A62F13A81DB9BE701B1563E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281922, "uuid": "b1de42a2-ea23-4a2a-9083-6fc3073ffec0", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281922, "uuid": "d78f41ba-8a9c-43c8-bb02-f94c78bd6c56", "value": "24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8a/oNJV2Biue6Nd:bTvC/MTQYxsWR7a/W+iv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281922, "uuid": "d0a6eec8-fb5b-4e50-83b1-6b9912a441dd", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281922, "uuid": "594f95ba-a8d0-4b5c-b075-dd5a764613f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281922, "uuid": "a83c9ef4-b248-43c2-a7af-5939ce69bcf2", "value": "OSET BESAFETY Mekatronik _ Siparis 0058114343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebd4a28-fb96-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713233321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233321, "uuid": "2902c075-4369-47bb-8475-76a48921c3a7", "comment": "Malware payload", "value": "53a91e0aa7be826797fe4f3095198fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233321, "uuid": "1386ad75-df8c-478a-9016-c3da95714589", "comment": "Malware payload", "value": "94b6cf6c30f525614672a94b8b9788b46cbe061f89ccbb994507406404e027af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233321, "uuid": "0c109d75-ba31-4fde-8eeb-26d35168f29d", "comment": "Malware payload", "value": "978160045a03fd26b8d01c487dc4f9aafaa3adfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233321, "uuid": "e6b92320-e590-4424-8bc5-a55f7ff4e2ed", "comment": "Malware payload", "value": "09cafc5420aedbbadd331fb72cce3d34050daa6db8ecd1e0bda8c83c8f7a995efb2d11d4d6293054312c017b86190a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hunters", "colour": "#EACF0D", "exportable": true, "hide_tag": false }, { "name": "huntersinternational", "colour": "#CC3A9B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233321, "uuid": "4b9d1e5e-5a38-44b9-a0c3-14f4d6448585", "value": "T18DD44B07E29150BCD06AC2B483576633FA72BC4D4625BA6B07D4BB312E75F50AF1EB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233321, "uuid": "1c271833-0dee-4046-a64e-b85aad9a1883", "value": "f77c5676d5c99563373eadafab25dc94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233321, "uuid": "9cdea9a8-0c15-4050-a901-05e831a4aa7d", "value": "12288:5+v+q0Uf6RnZJQn8L57U6JxOztO1rqJBokGC5:5+8Uf66USHSqJikGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233321, "uuid": "64948741-7f5a-45d3-9a39-85e160328e2e", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233321, "uuid": "95337769-5b14-4b94-9aa4-3e96e1d76e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233321, "uuid": "f92e03be-931b-4a74-9066-04445ccaadc0", "value": "encrypter_windows_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacde4e0-fbf2-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713273096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273096, "uuid": "5e65569b-1ba7-4c3f-ba9d-87311dcccd4a", "comment": "Malware payload (RedLineStealer)", "value": "cd86be81ddf241013be032803530ddeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273096, "uuid": "64150fa8-876f-4559-a289-8ac0479a58a0", "comment": "Malware payload (RedLineStealer)", "value": "956c0fd36c2f21f37b8782caa8e5f337dcf9083994c28080d2f42a3a2cfcdbbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273096, "uuid": "8c7f11c6-e4b4-453a-8827-172a252d98ed", "comment": "Malware payload (RedLineStealer)", "value": "d84462a3afb848584ed6e871a3ee02c3213c2c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273096, "uuid": "2fc30083-80d8-4e8a-8eec-9b7718a31af0", "comment": "Malware payload (RedLineStealer)", "value": "42fd2f00983bb9c0e155cf3537b8d186937a26b48bd897ed7d24cd3647d671f1614c5bddb26f6c5ce694060f887d4a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273096, "uuid": "fc20d444-5c0b-4b6c-864c-253ed0180a8e", "value": "T1ED940201B5D2C472E97359360824EBB1AD7DFC700F20AEAB639C16B94F345C25B25D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273096, "uuid": "9807c574-0a76-4197-a09c-c9a08362ed9a", "value": "b09f4628c9b8d8436d8b37442f32d236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273096, "uuid": "5986c782-79f0-45c7-a242-8e58afe3f7e3", "value": "12288:4+Pv3L1UTL073jVoHfO5jN/maLPXjh6np3:vv3L1UT473jVo/KjEgPzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713273096, "uuid": "a2d29561-e023-4f15-bbe0-09436213103c", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713273096, "uuid": "d92e83c8-a53a-4ebe-b513-eec81b6d5bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273096, "uuid": "1b4d5f16-a319-4907-b4b9-4752b35ccea2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6be52f8-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713234032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234032, "uuid": "0a13e9bb-567b-4376-b0f8-60b737637cc1", "comment": "Malware payload (Gafgyt)", "value": "7ecf8eecc88b7d0167d649959c00907c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234032, "uuid": "838018a3-5a1f-45db-bee4-7689adb8d62d", "comment": "Malware payload (Gafgyt)", "value": "97a23f6b36a16ccb7074c0c5bf17a0ebdace2c42b4b6a94bbaaf10c75c5c342a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234032, "uuid": "67661188-0500-4cc3-a961-6ea3810b9566", "comment": "Malware payload (Gafgyt)", "value": "d435e825ee4d441d4b7f28c0504fea7c94696f53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234032, "uuid": "c69b3248-539a-4841-bca3-f3bc8dab1d2b", "comment": "Malware payload (Gafgyt)", "value": "f4265d7b4072d7e762e6f2b1f220cfa73572817c9df30d557975c8060c28c888e8154a74c5be7ea919522a95da7cc6e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234032, "uuid": "ce1d8e4e-fc44-4fe8-b940-9b7cb42f8ff6", "value": "T1DBF3F851730B9C6FFC6A0B701AF2CE7167D8A5F22A75858AE36A7F4C0E601D25D09EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234032, "uuid": "944c46e9-3672-4b7b-98d0-7b11968f630d", "value": "3072:w4i4ZAEp/tH4Jd5wrh9p9JphaPJCD6Tj:/p/tUghvphacu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234032, "uuid": "89511ae2-8bf4-4a07-9b4a-860dc94c5a28", "value": 169568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234032, "uuid": "a9d77c1f-d30f-49de-b38c-495266d1613a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234032, "uuid": "37a6771b-ed3a-46c1-94a5-8945334d27fd", "value": "7ecf8eecc88b7d0167d649959c00907c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192243ed-fc02-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713279643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279643, "uuid": "1dbc07dd-6678-4db9-900b-6c17dd4e99a8", "comment": "Malware payload (AgentTesla)", "value": "6cee771eb657becf71d944de4643d648", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279643, "uuid": "9bc24ba4-1f99-4d77-895a-601711501b97", "comment": "Malware payload (AgentTesla)", "value": "992ec027912d1b7e386351d1d678dad278bd86d6eb725628c669107af26cb118", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279643, "uuid": "d919da1d-6f04-4628-947f-a7022969e026", "comment": "Malware payload (AgentTesla)", "value": "d6302fa35ed7046007a118066a98ba4531b1238c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279643, "uuid": "0ba3b08e-a5f5-44da-8504-2683aa3c8ca7", "comment": "Malware payload (AgentTesla)", "value": "7cc230b50218c24325cbafb17484d9f12e8c7929d20fab7597f6bd4f0ecdd4a12408f42c66d787647976afca96409be5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279643, "uuid": "a3a8025e-b58a-4c7b-8d0b-902d218688b7", "value": "T15715CFC4A2DE0DC2C66E65BC5CB4245129BFBE8E90E8CB2D1F19B13999B3645183CD1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279643, "uuid": "2eca1085-0f07-4dfa-a532-1ddac4f9e95d", "value": "12288:9lyUNSGt6jYbiuW/dUms7eIEYDMkTGiRoP1LmpJCzISkzWMc9k7+G94iGJVBLfI9:6Xl/dUwIEhIq21SkzW7JiGJV5Qy+/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713279643, "uuid": "cd055229-d4c7-4c67-827e-02204abad7a3", "value": 905876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713279643, "uuid": "e3f1fc13-8861-4a62-8696-0c52d4025b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279643, "uuid": "415ce47d-bc5d-46a1-911a-00c2165335dd", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79108323-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281952, "uuid": "10aa7350-bf11-4ab0-9873-ba92dc3bf1f7", "comment": "Malware payload", "value": "3dbb6bb4f7182594147600058be4d948", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281952, "uuid": "afda9d0d-1af1-438e-8339-6e583933f71e", "comment": "Malware payload", "value": "99924d37523de5cdf173f694f59253c45650681f629595a4078990b4ec5721d2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281952, "uuid": "10258ff0-eb92-4363-9c23-0ed5bb29f165", "comment": "Malware payload", "value": "33f2f10912762f9660d115cb8addbe15cf7ff3e7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281952, "uuid": "4235e427-a098-4344-9430-be70d49066e5", "comment": "Malware payload", "value": "6dc3dfe0c1793e9802b31ab4e817b8ddb68d3b69f29bc8910da5e0c4edf705d40c3663246b530c72dfd9ab0ab458833d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281952, "uuid": "8a04c8a1-09d0-4cfe-9e2d-3bfa475b3c51", "value": "T11B13BF37CB218083DE025BF7AA910D1FF63E6E19F1557B2F6C83A6D219100F86A5DA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281952, "uuid": "350e7068-a5b8-45e6-844c-0da559e05542", "value": "768:La/l8k4gsxkMp3bmY9UOjwatuNokSZDsYgYRo1fSXTeXOPGW:Leln4pRxbmHOMYuNokkDsYgYRo1KXio9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281952, "uuid": "4743c2bf-e7a1-41de-ae8d-417d0b1f78de", "value": 42231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281952, "uuid": "20cde617-28d3-4aca-8d92-a954d409a60c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281952, "uuid": "2242e37f-d700-4bfb-b7c7-3d166f90e3de", "value": "2024\u5e74\u4e8c\u5b63\u5ea6\u5458\u5de5\u8865\u52a9\u6d41\u7a0b.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e250c6ab-fc05-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713281269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281269, "uuid": "0b332545-1ce1-4880-b196-c83c5268bc31", "comment": "Malware payload (Loki)", "value": "748f2d7afc9aab8fbd553c5b07c0ec5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281269, "uuid": "0ee74c61-7407-4159-a3ea-79dc4d8e9774", "comment": "Malware payload (Loki)", "value": "99f0f330f7fafcc28267cc425f1d62ebf2a1604cd1843adec3a63e6631044d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281269, "uuid": "d9ef1df9-3444-4b41-a6fa-bcf82ccc6004", "comment": "Malware payload (Loki)", "value": "f92418c15a463d6201b32821ee9ef653db4a8600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281269, "uuid": "025eaee8-b6ef-4afd-bcb8-5e54f285adb6", "comment": "Malware payload (Loki)", "value": "4cfc6d0ae2c0f2662fa9a174a5e11315c24804792e2f301cf7cc2a633b30aea7e5ae9b669859170f4d06fad21b843f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281269, "uuid": "bb6656f0-2490-4c5e-9ff7-e418e76b9a20", "value": "T1F3C4020062ABAF09DBF847B069B15C154B77759BA832D35B1FC190C62DB4F844B41FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281269, "uuid": "ddd12e44-a3dc-4eca-9144-76ddc1d8c04d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281269, "uuid": "4cbec5b0-fe79-4f3b-9d43-b513689ce51c", "value": "12288:nnUqvDQpIa40jkkT/lGrrH4GF3rUz9dKgXFZuz3kR:nFD8Iam7rHDezKgXqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281269, "uuid": "8297efcd-eb17-40b4-9447-3edd4589ca20", "value": 571400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281269, "uuid": "7b73f004-53e1-4309-9208-39952f1279ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281269, "uuid": "bd20a4da-e540-461b-a688-b4b9b06f7191", "value": "FedEx_AWB#53023114643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e013284-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256995, "uuid": "dab5822d-7543-4a00-a0a1-eacdb9d50d5b", "comment": "Malware payload (Gafgyt)", "value": "6acfe12bf9b9c516e05de139211e5afa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256995, "uuid": "b15c3f0e-1bce-412e-9c05-dd5cabc97ba0", "comment": "Malware payload (Gafgyt)", "value": "99f45aacb1c30c3fd25def50fdf2de24060dbf26f1f1b327bc5072d3ce25204b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256995, "uuid": "07b6dc35-db52-4367-b5a2-d3fd8e4f80dc", "comment": "Malware payload (Gafgyt)", "value": "9ab5802cc344c271adfdc1ac13602f8dc41dc38d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256995, "uuid": "b5201e0a-a6a2-4142-8bde-71a23c9a1da0", "comment": "Malware payload (Gafgyt)", "value": "53006bba60f2d7906ccd4e3a94a14ae85b5447bcb61a68affd8b5929ce274f4dd83384c4a646d40e39a134136c29fecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256995, "uuid": "2b61f8cb-9394-4f05-81bf-df62fd1a18d1", "value": "T11024833E7A12AB7DE2A8837107F6AFB19B5511E323A19341E27CC7185E7124D2C8FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256995, "uuid": "07856923-c043-4352-8c27-fb0792d4998e", "value": "3072:3XC9j6w2ZQgoYJlQeRmhDvy2uSNbtmWu+R9ask0QcYbh5hRBg1cmrpy6n9Nn:3SDCzcYbh5hR5mrpy6n9Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256995, "uuid": "3a0a7296-56da-40f1-a8ed-6858c7caa06b", "value": 214648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256995, "uuid": "ee6d8061-28c2-4608-908d-598081030486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256995, "uuid": "0b480a02-5c30-4d8f-bc07-d686c5a642d9", "value": "6acfe12bf9b9c516e05de139211e5afa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e0706b-fc0a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713283146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283146, "uuid": "885d84db-70f1-4d1b-b348-925825b29584", "comment": "Malware payload (RemcosRAT)", "value": "008333b6cb8854ca79cc68ed5ce3f7d9", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283146, "uuid": "dbd05580-7dbc-4932-9727-379e1d237930", "comment": "Malware payload (RemcosRAT)", "value": "9a21402d9ef58001becce649565f3668e660c608681f8f524e968e6ad96485a3", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283146, "uuid": "2f2326b8-02c8-4bfe-90ea-439c5353b77a", "comment": "Malware payload (RemcosRAT)", "value": "411be0bea1af1ffd1700a09e406babeb77f2b14a", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713283146, "uuid": "c23c4c9e-c63a-4f43-b7e1-005a099cd3f5", "comment": "Malware payload (RemcosRAT)", "value": "9915fa18ca08f0b40ba53a9f970b5a1c6806339e4df60c612351cc5c2762f63be1072a983dcc78aa07be48c4727bb201", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283146, "uuid": "b146dcf0-a07e-4803-9541-5855a951b5ba", "value": "T1ACB49E01BAD1C072D57524300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283146, "uuid": "814d1e9f-71a0-48d0-b4f1-a263d3bc4c44", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283146, "uuid": "955b3d2d-6214-4fff-aad9-0ca4837b6cf8", "value": "6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNe5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDTcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713283146, "uuid": "0e52fbb7-83e9-4812-baf4-4a01aff43fb4", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713283146, "uuid": "8f51077c-703d-4b7a-ac3a-0acb0b014c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713283146, "uuid": "0bb6cf40-5486-4f63-99db-e1cdff4b58b3", "value": "171328314469a74a97b66c49d6bd07e9892bfb98947a176ff8d5df63dc6d40d04638cbce12349.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b8328c-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713265031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265031, "uuid": "9f764200-7697-4cca-bc7e-d25fa68a4cf3", "comment": "Malware payload (RiseProStealer)", "value": "2fb33c498f66aa47b719d3b9345e35ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265031, "uuid": "f5dd82a4-c883-4954-b673-c31fc892fb70", "comment": "Malware payload (RiseProStealer)", "value": "9ac899e08b378dd2b4e5169c01597c988cf2a1396b5dfab12e97cb46156b0263", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265031, "uuid": "0933cb8d-32ac-4fd6-994b-eb1bd9effca3", "comment": "Malware payload (RiseProStealer)", "value": "b7591feab49bc5b58a313fe45213f91df6c2980a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265031, "uuid": "eb82b838-e9e9-4668-9914-2876ff6d6f63", "comment": "Malware payload (RiseProStealer)", "value": "2fdf953ebea1af526072121506610f6f3cf2da16b5698f2d77d847d61dee6f5a64d0af3545da7f0a02359c4b07ff3158", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265031, "uuid": "c36fb6a4-1252-410b-bf97-76e652f2a0d8", "value": "T11B1633AFCD7CBB92D358A5334A358D14BA2C1C77682178E017FC9E6B071A2D6D7602C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265031, "uuid": "b5763e60-e6d9-4ba3-b9d8-5986fe5501a1", "value": "2f93cd80e5dfeca07d7e8b0f35545fb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265031, "uuid": "048cf7d3-719a-4862-ba47-4b522a375668", "value": "98304:/HFySxnKY0EvQZn2xJzOeS3bG34EVGR7q/0iRmyc3rea:/HFySxKgqn2TOeybq4NR7UHgrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265031, "uuid": "0865cc99-3eb1-4ee4-849d-e65526827b50", "value": 4121088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265031, "uuid": "5b778d2c-f47a-4492-882d-295059b51cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265031, "uuid": "e8a4e31f-e0fe-43a9-b94e-4e4cf796ac12", "value": "2fb33c498f66aa47b719d3b9345e35ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7865b05f-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268207, "uuid": "2719f935-9ff2-426a-8331-3c7e67542aea", "comment": "Malware payload (Mirai)", "value": "c22b3065a83528958bc236d214cbfc8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268207, "uuid": "8fd0932a-e8a6-4bfb-84f9-11365f0b7b9c", "comment": "Malware payload (Mirai)", "value": "9acf74ed41b43d6a30553357207327a16384b72dcf5b619d8fe6f57691fb4312", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268207, "uuid": "b065fcc1-9c8d-40c4-bae1-f5ffc62557ff", "comment": "Malware payload (Mirai)", "value": "541def44ab5907e876dd74857041af37d809d93e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268207, "uuid": "28d4eccf-3a69-4700-892f-029ab4396d60", "comment": "Malware payload (Mirai)", "value": "ccaf87ba86eb96f1ae345efab4aa68a2d156eb01e12bd2345845eddf3c958dcbb737e6bae7039efca389ffc384357ed3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268207, "uuid": "91f5581a-a100-42c7-9c2d-010c26cff5ce", "value": "T10AD2E17D839C8E86FE3853BBC6CB4B4333101BF58715AA84BE1545F19E260DF4593984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268207, "uuid": "1205d01c-af8f-43a0-afbb-59e5aa79b0f0", "value": "768:hPglXhOQ2TdsR8Ue57nH8yxZl06KCyiwSWsClTLKT:+X2ThUe57nPZl9RwSWsQHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268207, "uuid": "3762f9f3-5eb5-477b-80d9-480ce942102d", "value": 28620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268207, "uuid": "c4de9e29-1228-4079-b952-df3948a31a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268207, "uuid": "1cf33734-992a-44c9-85e4-763fd213c4ba", "value": "c22b3065a83528958bc236d214cbfc8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3640880b-fba6-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713240178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713240178, "uuid": "c468d763-b44a-4d39-95f3-4fb2af475b3e", "comment": "Malware payload (RiseProStealer)", "value": "6f1a87def176b40a1e185ce7ae54edaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713240178, "uuid": "b60d0485-eee4-4b28-95a4-b809929b0c47", "comment": "Malware payload (RiseProStealer)", "value": "9b61f7907c1ff84ecc81acc5fbe99674aa7f909c6a8ef1cb5c78a768ea35d260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713240178, "uuid": "9cda52c9-0877-40c4-a4f4-61f36d75aea4", "comment": "Malware payload (RiseProStealer)", "value": "e2ce71fd97aaaad284eed6ec7c4f2930a1a3aa8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713240178, "uuid": "61bbcf05-5d2a-48c0-9280-158a3ae9ae45", "comment": "Malware payload (RiseProStealer)", "value": "bf3dd210d1b92e28e2602ee1a9fd535843f7c93074f64dc31c2aa77ff3d44cf6fa3812efd5798729657b891aee78adab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713240178, "uuid": "d8d0dc17-0c6e-4034-832a-bc19d04d55ed", "value": "T181553311BA08A5FDDE04017E7A7C914454BF622499A78F5C25BB1AAFC7C2F9F3481CA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713240178, "uuid": "a0b85803-71cf-40fc-89fb-94fe3f3d3678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713240178, "uuid": "743f0106-e6f7-4443-b0bc-dce9a8caed7b", "value": "24576:FVd2ktCt0ArqWbKGmWDaEh2k17OZeguN/YrF5sNJ9gW/qnwlitH0Xbh8m:rE0EGWGGm2D7PKrF5sNJqnwQtw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713240178, "uuid": "7dcc1156-4e30-474b-b384-64404f551fb4", "value": 1376768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713240178, "uuid": "41280ba5-7d02-437c-8bf7-c5114d2dad28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713240178, "uuid": "b5769ee6-442c-40c4-9546-9f91f5cf875c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcaaa0f-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713253344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253344, "uuid": "462b68e6-4ea3-42b5-a861-ccd67bd51fb4", "comment": "Malware payload (AgentTesla)", "value": "b9412570feb391ace8330ee6661a3c2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253344, "uuid": "d36d90e2-f55e-4c69-9f61-4cab0a3575bb", "comment": "Malware payload (AgentTesla)", "value": "9bb6d4c861ecd64a1b4df7e1335eb5e4f3922aaf2e9f7ca8d9a608f49fd5787e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253344, "uuid": "950d3761-27e8-4c3b-acd3-5ab4fa7ccff9", "comment": "Malware payload (AgentTesla)", "value": "d0532f5bfcc7e5f820bdf91b5e001d629f2276d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253344, "uuid": "95856a98-c2ed-43ae-b3d6-56be91554f89", "comment": "Malware payload (AgentTesla)", "value": "4a01aed7e13a10b6693fe9d3f527a49faf8015c520f28f7d9aa7446db50589b82854563adf502c2c9995a400f8d5a1a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253344, "uuid": "dcf59908-e388-4baf-96de-b630d7d31670", "value": "T18F34F22ED34F02698F920372AB1B1E95A6BDB63EF39051B1342C433533D9C7952266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253344, "uuid": "ac1de46a-b75e-4e67-8a1d-213183888931", "value": "1536:zf0Xvx3EMERsf0Xvx3EMERsf0Xvx3EMERQlURdLL3X0hMWci:zsXvKMEesXvKMEesXvKMEWUPfX02Wci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253344, "uuid": "4d7e1459-3a0d-417b-80d6-e0fb993afa01", "value": 234605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253344, "uuid": "a54f40ae-3e4b-4384-92dd-763a42f0d9af", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253344, "uuid": "802f45c3-9510-43e7-900f-c74a9b05dd75", "value": "BANK LETTER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864342d6-fc10-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713285839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285839, "uuid": "fe3ce440-d219-4510-9538-87d86d122be4", "comment": "Malware payload", "value": "6cda290ee504f538e8529ad1a771716a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285839, "uuid": "c9e46205-bb1c-4a36-9ff9-db14aa464e37", "comment": "Malware payload", "value": "9d1e8ffcc3bd8be413268d4ade1f141638d9313c705d5c22136f5ad59d6b14bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285839, "uuid": "09dec66b-f55f-4298-8c79-84fba80d422c", "comment": "Malware payload", "value": "7597d3398279bea7ce822b78bb079f12103dbd32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285839, "uuid": "d3a04d9a-8b3d-4f29-8a18-d5767871d3bc", "comment": "Malware payload", "value": "923db8114c85c161ea0473463c13eb00a8fc859fa10dd3e6c0fb8f7f60510567318dde2ba732ff67c3c546c4bb738d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285839, "uuid": "bf8b0cd2-75fb-446f-8f46-6645436a670d", "value": "T128D6336E014274B5F8826E60E33EF4E2A646B8231D9934725C4BC6E8593BCD7E3D5B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285839, "uuid": "ef0a83aa-f999-45c0-b7d1-e1c43fff182d", "value": "72eff6af045097935e4b93056312993d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285839, "uuid": "8d135759-9d50-4f6b-8a59-0600ab1647af", "value": "393216:fbF4jv90H3TooxDRcZtEajr3rJ3up4tXUD6PF0kzQo:B4+HjoutotXHluuFUDWbco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285839, "uuid": "4917aed8-29bf-4d5e-90b2-b1f73a412cf1", "value": 13623304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285839, "uuid": "4c7cccf0-5181-4845-8e57-640a3ff3effb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285839, "uuid": "880daf9e-855a-4746-94ba-4d88788f7e28", "value": "SecuriteInfo.com.Trojan.Siggen21.30206.14092.30541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f2b655-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713251699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251699, "uuid": "a2ab358d-3884-4640-8ff7-37f91b966fb8", "comment": "Malware payload (AgentTesla)", "value": "3d25cca725c5240380f43258834acce4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251699, "uuid": "ac5461a4-fc6a-41a2-9d79-07460dae71df", "comment": "Malware payload (AgentTesla)", "value": "9d35545a75033e48cdc77639b08925d20161fd24783a30fc1e77a2f73cb4cb95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251699, "uuid": "f1df3971-2a1a-46a7-a655-6c5f40659813", "comment": "Malware payload (AgentTesla)", "value": "fe90cd4def244f44181c8d1f1e72fd6cf71a1357", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251699, "uuid": "c8c2bad1-87f5-4caa-b435-47b3d3b2aabe", "comment": "Malware payload (AgentTesla)", "value": "875e8ec98021d8eeee828521e947edb27177fea74d84fe452e943df388a1ab014765ca6c86e6d342148e297bad48d86a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251699, "uuid": "5bf57281-8bfd-427d-862f-74667605ac06", "value": "T141F42370C9864779E84A376CCA8F35319164B3F7A973080E1CD7A7859A9CA03BCD61E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251699, "uuid": "bc1df47d-344b-42fc-8303-daef11d3ec70", "value": "12288:cOB94RHHvgvWJY72G4bvukW4x5jZZ4yIPl6F4Or3xn5s0o/lDWcPujRl9wqK:/94dPI7YbvukW4xHZ4Ub5s0GDhPg7/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251699, "uuid": "978a6c71-74b0-472e-8280-82e54f1611af", "value": 727870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251699, "uuid": "891cf76c-22dd-46e3-8725-447a9c2afbba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251699, "uuid": "56e0251d-8726-4068-aba4-6d701a12abea", "value": "Due Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8f0397-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233988, "uuid": "995c5f50-7331-4738-8ad9-f064973f4b66", "comment": "Malware payload (Mirai)", "value": "bfe0bebbc96f40013b07ad2a69233269", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233988, "uuid": "984a188f-8417-4f3b-91c9-2051f956b814", "comment": "Malware payload (Mirai)", "value": "9d94c2ccd5070ccc94f803f7dd42061298c9e1a8d16f71e4e3c23542ea37dd33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233988, "uuid": "f1fa9da1-4d41-4153-9201-83fcb86e8648", "comment": "Malware payload (Mirai)", "value": "7018b60f716b57028cb1ffb90ffe325bd171376c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233988, "uuid": "d655f98c-7031-4975-a4b4-1adb589d7a0a", "comment": "Malware payload (Mirai)", "value": "4c004015ea089ada566c9e306986baa8c47c6d3c9f9cf6284f9d5b4a915b96098f79bc47d2e5068763bc20a8232260f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233988, "uuid": "70be07b3-049f-4e80-aa63-00757b5af101", "value": "T1CC633AD6F501CD7EF84AEA374C524E05B131F2640FA30E779653BA7BE935198192EC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233988, "uuid": "2ce8c8ac-7aff-45a8-b455-6c71e5f1dddd", "value": "1536:u5U2RiowaMlLJ6jXC68ZI3RgnBq8NmaQQeuacWjcW0JcWcB3aqnodNZwSJs7r:AUN3nld6e72RgDQQeuacWjcW0JcWcBKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233988, "uuid": "2e5867f4-d224-4099-bb3a-1f3cce84f491", "value": 70480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233988, "uuid": "a5eece39-af83-427e-8026-bee09208abe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233988, "uuid": "dcbf409b-4f00-478c-a3a1-939bc973ff76", "value": "bfe0bebbc96f40013b07ad2a69233269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12dc9fd-fc0e-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1713285052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285052, "uuid": "74b9f1b0-8436-4672-9ec8-d2bd30a85d10", "comment": "Malware payload (DarkCloud)", "value": "42352173769d2a4f3b7e4e10bb135092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285052, "uuid": "07d18101-8b7a-49fa-952b-46a64320ce87", "comment": "Malware payload (DarkCloud)", "value": "9ef94607fc86a367934d7bd636d9a92c6943e41a79f1defb622d8716f013bde8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285052, "uuid": "3d8f14a6-8659-46e2-a058-21dec30543f7", "comment": "Malware payload (DarkCloud)", "value": "87afa2afe4b2a5dda9d7684d79c5f2958d387ac8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285052, "uuid": "5d14ff06-4016-446f-b6bd-94ba59fdb211", "comment": "Malware payload (DarkCloud)", "value": "7cbc5f43a6147ea5f6e0adad8c4269ffb026e51a36af7bb8facf0729ed06509cc71f5920b46d2677ed642535d5856f90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285052, "uuid": "3cd67e46-90ba-458f-b6e9-96007935f0f5", "value": "T1BC45BE0273D1C036FFABA2739B6AF60156BC7D254123852F13981DB9BD701B2267E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285052, "uuid": "0f52cd73-fdde-4731-a397-b54bb352c237", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285052, "uuid": "675c31c3-9b20-434e-b9ee-f5bcca4194b4", "value": "24576:yAHnh+eWsN3skA4RV1Hom2KXMmHa5vDa6jeukIWmxrQcBn5:1h+ZkldoPK8Ya5BeantQcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285052, "uuid": "3186d73a-6eec-47b7-b24c-157dc73e1109", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285052, "uuid": "e25c8d88-1429-4101-88c2-eda607c9930a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285052, "uuid": "86645e4d-8b65-4d61-a647-f0d909e5a3d1", "value": "42352173769d2a4f3b7e4e10bb135092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc6ced8-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713281560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281560, "uuid": "a7c66b20-389a-4fc3-b68d-6210f06e12b0", "comment": "Malware payload (PureLogStealer)", "value": "27f8736302cc341a6fee7eef31efa585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281560, "uuid": "50662367-8afa-4b83-aa9a-66359a441e0f", "comment": "Malware payload (PureLogStealer)", "value": "9f0f2103b2f1063f715636e0886980ca670c3a5b79e789823c50361a6dbeaccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281560, "uuid": "908aae88-ee41-4622-aa48-c00bd0e1727a", "comment": "Malware payload (PureLogStealer)", "value": "b08b102ca958aebf825e6d654f0b47811db1f99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281560, "uuid": "806ca706-bf71-457d-9c24-a0458de6eaf8", "comment": "Malware payload (PureLogStealer)", "value": "287c2cad507328618599c7209a646b807b31b2c75cb4255518da1b0085c6039489860f251252d6f3fd2c918b23f8eafd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281560, "uuid": "4f2e4b3e-898c-438a-9e53-0029e51a6269", "value": "T182369E0BFA90EF10C0561A33C6FA341893B497925617D61FBACE379D0B9737A098B197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281560, "uuid": "032507dc-3f9a-4a93-a3a8-a10d191e0178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281560, "uuid": "d81dddb8-5e50-47e1-a28b-ac48381816e2", "value": "49152:iluVyXRQ+7N19++t1QAIl4ljUNyjusCgRIkoT8bhVSDZjM+BdIDZCalm:EuVyXZV+c19Il2ayVzIp4brSD6MAvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281560, "uuid": "a20d57bc-36d0-4ffe-861f-90113b2c1036", "value": 5131608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281560, "uuid": "525681bf-90da-4abe-8cf9-a8bbc1bbdcf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281560, "uuid": "d9f0f006-b165-4fcd-813a-e6b12fcafd4a", "value": "27f8736302cc341a6fee7eef31efa585.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e956af63-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265390, "uuid": "b028701c-8e3b-430e-800e-5479ae2c44d8", "comment": "Malware payload (Mirai)", "value": "31ae20793c44b9294908a1601bee7bab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265390, "uuid": "27809902-0eb7-4e13-a2ae-c4f0fb4d66e6", "comment": "Malware payload (Mirai)", "value": "9f80d08b7c7599c576739ea7cb584eca101e78e52c668d8bb2793905cecba70d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265390, "uuid": "16f86341-20e1-4e5d-84e5-810ebb8454e8", "comment": "Malware payload (Mirai)", "value": "3e3aa6b5ccaffa19708764251b3271e0cea4530c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265390, "uuid": "a1126b31-782d-416c-9a15-3afe9e555708", "comment": "Malware payload (Mirai)", "value": "9c364b7d7a4a35a4cc4f9e3b0ebb80d45d8b963026906f0fd4e7662cd4979a88d34ef255599856b502e017847ca27d83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265390, "uuid": "f5f41892-414b-4ead-9bf4-1630174032fb", "value": "T15CD34B06B71C0947D2632EF43B3B2BD193EF9ED121E4F640255EBA8A91B1E321582DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265390, "uuid": "f1b67c17-3e80-4a94-817a-6ee9f5303282", "value": "1536:8nsfXM+NyGiqv1VHIx3bVfHpUTTM8dW0AEtZO9/oIHRRAdAWfCQA+fyO5frhtC:vvVB5IxLVfHOT5pb2OttC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265390, "uuid": "d45d6f93-61ab-4a0e-af64-b644ef97d7ae", "value": 140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265390, "uuid": "50d092c4-1f58-4fd0-8c15-6db1d767626b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265390, "uuid": "87729ca6-4073-4e5a-a7de-198c3e22334f", "value": "31ae20793c44b9294908a1601bee7bab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75af9747-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281516, "uuid": "b56949cb-069d-4f98-b5c0-1263973f4674", "comment": "Malware payload (GuLoader)", "value": "423c160c74523fe9016732fb97030ed9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281516, "uuid": "340e26ff-1293-4a97-b411-17064374d7ff", "comment": "Malware payload (GuLoader)", "value": "9fbfe9c0771e45836c7d1a5628d30c06d556726bdfdd80af82f0957f2813f042", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281516, "uuid": "886703dd-857e-4712-91a0-519e7d448600", "comment": "Malware payload (GuLoader)", "value": "aacd66cb79569420d87ddab515b11465967b80c1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281516, "uuid": "b40b5a07-8734-4db7-af25-9fcef379927e", "comment": "Malware payload (GuLoader)", "value": "98eb15d6555371bd54da682eaafeabfc42469fa9dcb8cc381f9885698a9bb7a432638c4c7b0c6040aa1e24d69d008a22", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281516, "uuid": "ad291eaf-34cf-4f6d-800a-3d3260d9157e", "value": "T135946D60EE68066A0E4B279AFC911A92C5FCC219462710B6FEDD074E61075ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281516, "uuid": "bcf6d5e6-0c2c-4379-99eb-0b218e558575", "value": "6144:ltrc0iH9QXg0ID+wUTFVWtBVkm+t3xGAu98FD3ZGEBXMVV:lFidQ0iYzrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281516, "uuid": "bce18a35-8f71-45f7-8816-422daf537d1d", "value": 413195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281516, "uuid": "add5ff45-9716-42c8-b9ff-443609416482", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281516, "uuid": "ae4c0ca4-568f-4a6a-9c2c-3af7f5766f57", "value": "Shipping_Invoces_docx_0000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1407320-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281616, "uuid": "fae8e7d7-fee9-4313-b617-98087981525c", "comment": "Malware payload (GuLoader)", "value": "cd6b004069cfc080d5e5212ee5d5fd73", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281616, "uuid": "824fa37f-5a8f-474e-98e1-e54c9ad63e94", "comment": "Malware payload (GuLoader)", "value": "9fd90768a62d4197a8883cc9b7632f778eb7798fea10f0968d57e87bd730d948", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281616, "uuid": "84b70d55-24e4-4030-a5eb-b1231218fb5d", "comment": "Malware payload (GuLoader)", "value": "bd1a4aabf114480c0bfeb8e24cfbc83c3820aae0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281616, "uuid": "704933e6-360c-4436-bf52-3eae8a2f6700", "comment": "Malware payload (GuLoader)", "value": "e1f061a304e802821ad5859a60f91963dc16b798a4c3f194dbe5a963e9a64b622069d4159686d149c3635d74f280fe7e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281616, "uuid": "2b82b24d-8aef-494e-afe7-d9c33bc60b10", "value": "T171946D60EE68066A0D4B279EFC911A92C5BCC219462710B6FEDD074E61079ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281616, "uuid": "e1688810-38e1-4c2e-a360-2e133b3aeb51", "value": "6144:ltrc0iH9QXg0I2+bUFFhWtBVkmJt2+t+Sp8FD3ZGZBXMVC:lFidQ0ayzjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281616, "uuid": "8344b46d-5f15-4e30-8803-2c3c72898022", "value": 413176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281616, "uuid": "e310576e-7085-4fd5-9ab2-71a26cea086d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281616, "uuid": "464cbf7d-a24b-4458-b0b8-89a0fb4ba66b", "value": "Swift_documents&Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8376bc82-fbd6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713260924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260924, "uuid": "ef894c68-55ab-4e83-b4da-b8adc422441f", "comment": "Malware payload", "value": "34eeddffa741cfd8ceb722d6cc82a29c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260924, "uuid": "b67068e0-2868-481c-8ebc-835a1a3e3bb0", "comment": "Malware payload", "value": "9fe45729409f10ffe972620f8a89203ffae48d4cdcb3e0c7b011109195d78a7f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260924, "uuid": "d1e89719-33eb-4388-8bb5-5e0e16120309", "comment": "Malware payload", "value": "4ee86afce4cc985a79c43a33d11d12bcdfa7213e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260924, "uuid": "d6a0231e-27dc-4f95-8563-d7f86237e966", "comment": "Malware payload", "value": "2390be4e8987744bfa5bc6e5cf482178af98da82a9a15e7333430f41420a2931b9351a4f99b858b76aba911b75718610", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260924, "uuid": "a030f38c-28ba-48cb-9de2-01cbc4440199", "value": "T135F51281FF61D82EC9B784370DAB433052269D5EC296A70789DC36686D772D80FDAEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260924, "uuid": "3d5e472d-08f7-4ba1-a29b-818a283b79fb", "value": "98304:VHQsG/mTTw9+0jtLiLdhzpPuODgdMe4pvy9euc3F:NPAUqJGjuDdMeWv9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713260924, "uuid": "9b174ea9-e90c-4c2d-8b9c-860fb732bf66", "value": 3414331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713260924, "uuid": "85bd592c-611a-42e4-a2b5-5c0965bd9ca5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260924, "uuid": "6822db44-597b-4df9-b161-db2ed4f7bf1f", "value": "MinFinder.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f0eced-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236770, "uuid": "c339f0b8-7346-4c3f-b13d-fb38c4b7269c", "comment": "Malware payload (Mirai)", "value": "2e5d01d55ed59d3e5324a7998bb68532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236770, "uuid": "be5258a6-769a-4348-ad40-8fe01f4aaa87", "comment": "Malware payload (Mirai)", "value": "a04de165b626f3ed42e94225605539fb8a517f01c9e673c78fe038cb447a4b09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236770, "uuid": "79bc3016-3f5a-4d23-8104-1dfbf4d570c7", "comment": "Malware payload (Mirai)", "value": "000109abeee42d9dff77410d5883fee9b0d93ad6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236770, "uuid": "1f5bb21c-7403-4405-955d-743f9e58d294", "comment": "Malware payload (Mirai)", "value": "162f278f2539c5049d94d155608d4433e8e82e9bd592cc04393536a4ef662b23e372b4ab78c1a57371ab9cf2f3ea6b3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236770, "uuid": "cc0385a1-1d59-4931-a17e-a5889322041c", "value": "T14973D815FF651FB7D89BCC3309A81B0628CC665A22B93B367E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236770, "uuid": "2ed85517-7bfb-4811-9709-a9c739d9f3ae", "value": "768:lqwATxpQ5e+y4rRv5Y6ZDSP6gSOee2etJeGa7N/kWjrXilvo2KXZY10Uu7:lCTxq556ADSP6X/74JVSN/nJ26a10h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236770, "uuid": "4bf7e2ef-a748-4b7e-9da8-d0464f5c80e9", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236770, "uuid": "7b06459a-427e-4077-b22e-bf2ebf0b6f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236770, "uuid": "a82d61d3-666e-4430-b44e-5a4273103b7c", "value": "2e5d01d55ed59d3e5324a7998bb68532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881bbab0-fbb7-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713247617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247617, "uuid": "d39f28b6-d5eb-4aa4-9aba-b9362c7b49f7", "comment": "Malware payload (Loki)", "value": "bd6a638efbfaa4afa32f970096a3fd2b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247617, "uuid": "c254f2e1-eb93-4470-accb-14ec93ac12f4", "comment": "Malware payload (Loki)", "value": "a2b68bf5b7ba26b0503c5a1f1ad3d32b48d4ce097e670b73e33e854823e78e39", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247617, "uuid": "1c0db046-0a3a-4d0e-8918-4ae397f0bcc0", "comment": "Malware payload (Loki)", "value": "1c74e8bbe634ae966de82735addfda8faf104f7e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247617, "uuid": "dab997c8-0276-4c00-969a-4fad2db4edcc", "comment": "Malware payload (Loki)", "value": "ce8da75a59cb73553d00ecdaf1658820e77ada653650cccf551b966916b7034141b3774d3dd4f62b305617345ca69e81", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247617, "uuid": "660b71ba-e332-46bb-b2b8-d7b4f77ec9f4", "value": "T1B6B423DCF5B47CEE65BAB4C517645AA3204E4F3A69502FEB47FC4643044FAA29C0B631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247617, "uuid": "e94f93c1-159a-44c2-b9f4-1dcd115e5c22", "value": "12288:DBAUQY3DZlk7y7Gev0sl3a+mr044zblRW3kw+KUiY9YD+sy:DuUQY9lJ1lq+v/WUXM+sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713247617, "uuid": "b7f64ba0-9c3c-48b6-9e30-6281dcf88b2e", "value": 511194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713247617, "uuid": "de7ea78c-954a-47d5-9309-9bd106ca2579", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247617, "uuid": "9649d616-731d-4307-95e0-eec378c4ed69", "value": "DHL_Awb# 12944422091.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d62c81d-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713256135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256135, "uuid": "82325353-8320-42c6-910d-a4a6ac914742", "comment": "Malware payload", "value": "aaf45cfde5a73aa91794663276e1fbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256135, "uuid": "298daa7b-c47c-4119-bf27-f7d2e4d6c8e1", "comment": "Malware payload", "value": "a36481674321e1b8b0b3769fb2ab52dc21b06635d20a999729ce834a63d03273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256135, "uuid": "f934388a-df1e-46f7-b63d-ca986f12bf1a", "comment": "Malware payload", "value": "be8b464329a64f61ceb46f472891fbb60e925e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256135, "uuid": "6a1e7b84-6da1-420c-8631-1105fb6d9b24", "comment": "Malware payload", "value": "2049462ab43d64f25e74e794fe1877927df652960e11885007d6649abd88a172625dbf9fb3ceeacf7a0abae0c5b2cbb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256135, "uuid": "b1b02e14-108a-4b71-9911-e1776a3ff6ba", "value": "T137760203FF4184B2E5920275196AAB7E4D3B7A205734C9C397D02E699D312D27A3F39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256135, "uuid": "8171a377-5993-485a-87b2-d24e39a340d5", "value": "571c56be5e018260b2267f3b21bababe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256135, "uuid": "d827e035-f4b5-469c-b499-c632904cea84", "value": "98304:M1nW5UuUxP8FH3VthPiG4c/wKhSCafTzsrc4rFZV8g1uu724/2NC2rre:v5sPYkG4IwcS6c4rmgzt/qCur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256135, "uuid": "7a5b59ee-7fa3-4a00-a87d-4443f41f0f7e", "value": 7708536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256135, "uuid": "66fa80f2-68fa-4284-b6bf-e75d82305c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256135, "uuid": "f3230d8a-fc49-44ca-b839-7a8a13da00ce", "value": "SecuriteInfo.com.Variant.Tedy.453371.50.24451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312231d8-fbf4-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713273670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273670, "uuid": "a2cfaec1-f7fe-4a20-9617-78607a192d30", "comment": "Malware payload (RiseProStealer)", "value": "0876fb0b04c158d26a8288c074782df7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273670, "uuid": "e6ef0b4a-73ff-46e6-85bc-b8a89853d095", "comment": "Malware payload (RiseProStealer)", "value": "a3e5332fec977673dbc4e7bf3bfe40a1b1228082b3340264350e17269f33b560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273670, "uuid": "bb90e0a5-acab-4527-90a0-69d8f77d3b5f", "comment": "Malware payload (RiseProStealer)", "value": "c9e90bcc737e82b9bbb38a0817a7366fdc810eb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273670, "uuid": "484559ee-0194-4c82-9c38-e77581fea7be", "comment": "Malware payload (RiseProStealer)", "value": "80081dc5115ec1eecfcfdac0c0d150b4038537aace58e20e48cb735a687915e4f9532f9e09a5cf44d4f457aa948f4133", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273670, "uuid": "74202cf9-07e7-4e45-ad01-3668bec2d457", "value": "T18FA5338806B97734CD92A33250DBC41553B43F1355726B4EB2CF2EA3BE7E62D5B19A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273670, "uuid": "e08c93c7-5198-43f2-96ab-f202861943b0", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273670, "uuid": "9df5ca85-bcce-44a5-9f8b-f136cfa11c32", "value": "49152:eSUl6vD5DxN6HHLJ9tog+71CND+k2k1Uq39UCXWuFnlFT2:eSSwD5Dxk1+71C2IxNXbFnlFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713273670, "uuid": "83f043d3-540d-4d77-a0c0-568e9961aa13", "value": 2232320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713273670, "uuid": "939244d8-a241-4fc8-8576-b50093ea4fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273670, "uuid": "b4cb88de-bd65-4b61-aef9-6ab4a4386a47", "value": "0876fb0b04c158d26a8288c074782df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac2faf0-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (PhemedroneStealer)", "timestamp": 1713302570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302570, "uuid": "495d1c9b-69c3-4523-870e-cf458ead4fbe", "comment": "Malware payload (PhemedroneStealer)", "value": "8d51e3c700ad933f066e40114dc6715f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302570, "uuid": "2835f30b-d3d3-45f3-b06c-fc1489da8e25", "comment": "Malware payload (PhemedroneStealer)", "value": "a4872844199c61e4e2090777825b26d876cb8876db6272f4b420e0c56e238fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302570, "uuid": "62529332-36f2-4fc6-aba7-72d27a4f1389", "comment": "Malware payload (PhemedroneStealer)", "value": "b37059419cdbd3f34fb297480e14e4484e4c60a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302570, "uuid": "41ec18f8-e64c-4ab9-b936-f4f6030185c0", "comment": "Malware payload (PhemedroneStealer)", "value": "183db6d8e382a4e43e3d6a1fb6531c023fa47b8317280e51a93abefaa974870bcc6178d64612ed552f9e5912802b6ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302570, "uuid": "8ef87451-2d34-485a-b297-e2b24c831478", "value": "T16A835CA877EC0F55E6FE9A7968B0429487F6F9365613EB5E0CD010D90EA7B824D00773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302570, "uuid": "655ff746-c0e4-44c1-a044-8a94902cf440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302570, "uuid": "ab687be0-e259-43e2-8373-b88ea45fc330", "value": "1536:5mF7zCFd20+PGT7hy92QWKSO5T3rZgSwEKSKO9jzpmt:5mF7Md2NPehO2hS5TbZJwEKSKO9jVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302570, "uuid": "307990c2-f47d-4f7d-a588-b47728129e89", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302570, "uuid": "51457ace-c8a7-427a-b09a-98924734e07f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302570, "uuid": "8fc67cb2-25c7-4e06-bc33-a2773df0baf1", "value": "a4872844199c61e4e2090777825b26d876cb8876db6272f4b420e0c56e238fb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be12229-fbff-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713278386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278386, "uuid": "a948deb1-1022-4323-9cd4-0a8590133db7", "comment": "Malware payload (Mirai)", "value": "49ea36654b439dc7994e4d65ab1868a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278386, "uuid": "15127a9f-4d76-453d-8591-7c69573a315e", "comment": "Malware payload (Mirai)", "value": "a53af18d4e0fbcf33f30217343aa0a6846b340fdf36cfdf669783c22399c0397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278386, "uuid": "e2baa28f-fcdb-45d9-9ef2-d6011b3dda94", "comment": "Malware payload (Mirai)", "value": "ada91e66df6e884dde876add1eb96918165723ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713278386, "uuid": "08463d1e-6dc5-497d-a9b4-0296bbd85ac5", "comment": "Malware payload (Mirai)", "value": "8601ec264532557bdf8fb711139b0cf363df67a327549f4e5b8bde3c1de0b549f6284e2bade2b5db85867f711c90c434", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278386, "uuid": "0a1848d0-b33f-441b-be26-33aa62570ec7", "value": "T1D9E2F1A0AD82C4F1C67078BDE46C0E0323A89BBC707E7B55622D57D4E5F149A3AFE181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278386, "uuid": "6dc59a53-dfac-4b40-aef3-4ef344962f45", "value": "768:P9tY4IDW/auiwproJVNTt+z87l/9QWFyxFQ6ko/A9/D0asq3UIVZG:P9UWXiKroJVzxx/97FH6j/Afji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713278386, "uuid": "8b6be022-1be9-4433-a756-8ccb1d4b09e8", "value": 33532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713278386, "uuid": "d7b76e13-59fa-4945-8a03-32316aaead8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713278386, "uuid": "5731bb51-c5be-4be3-85ca-27d2114a13e5", "value": "SecuriteInfo.com.Linux.Siggen.9999.7988.1041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79cf3b1-fbc7-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713254569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254569, "uuid": "b0070a59-d635-4380-856b-b8de60e083b7", "comment": "Malware payload (GuLoader)", "value": "fd0cdb4e488cdd3d242c26767cea5164", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254569, "uuid": "f93637e9-af97-47dc-bbf2-d8e18a2aa872", "comment": "Malware payload (GuLoader)", "value": "a53fca459108e05b600b41a879f72b6ae45050086d8eb2ab4b2e670991b9b287", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254569, "uuid": "217642d6-4aaf-4cb4-8e09-e19b9f066182", "comment": "Malware payload (GuLoader)", "value": "d365101a2a9c714b5bdb6b8e5a3c761414431c6f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254569, "uuid": "1d9efbbd-f6f3-4c1f-9366-0922b924dc3f", "comment": "Malware payload (GuLoader)", "value": "578a1fe2dac02d4073636be3c1978b9380adcd44d027a320185813e923ac57a3a0e1a86d9ded093d81d446bb2b29c796", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254569, "uuid": "99538422-9017-4867-a233-226417a3cdc4", "value": "T16A2423F64071DDACFB869F6068DB4DEE4388E5064BABF216B08CBD41871F161B1790E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254569, "uuid": "bfc9d15b-d988-4196-850a-d478649f38b6", "value": "3072:MhZHmr72fbvSCVzMRJvBFNCna/Ofe3ML5T3LC2Da4MITHoEDJ0F6jueVP5/roFoC:MhfDgnFNCna/UeS9hHoYJRuQZEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713254569, "uuid": "eed21319-922d-4f95-87ea-7cac8c4a5157", "value": 211895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713254569, "uuid": "9eeabf16-f776-46a3-aba1-7096b3ed3e85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254569, "uuid": "64564c6f-c5da-4a67-8624-6938f30b79b6", "value": "awb_shipping_label_invoice_15_04_2024_000000000000024.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65cb814-fbed-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1713270888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270888, "uuid": "021de8fa-9979-4d9e-85dc-bac69d9b981d", "comment": "Malware payload (DBatLoader)", "value": "6857980d3dbef74db1ce7f7520880e8f", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270888, "uuid": "56f6e8e6-bb27-4082-a705-21e7d7cd8ceb", "comment": "Malware payload (DBatLoader)", "value": "a5bfaca7bba4ed9e25bdb77b4ec61c796136b9de39580bb7736c3ac3ffa7b48c", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270888, "uuid": "004daa14-0c56-44f6-a0e5-eeafa330a79e", "comment": "Malware payload (DBatLoader)", "value": "73fc54f77a2d27bbe2344f5fa6e869718c390cd5", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713270888, "uuid": "8338b438-dbb0-480b-8445-443492e3e30f", "comment": "Malware payload (DBatLoader)", "value": "2c684337fa0fb99256ccbcec8b17eeed28959aad317a813c02223ec97a5301612487a00aa00604c562248ac04b21faca", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270888, "uuid": "711e88e0-3556-49cc-9349-bd2c964c3b4b", "value": "T1F7E553931DAD05862725337B8B4BEADD063FCC365BD12ECCC8C10AAC5C1B75B2954BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270888, "uuid": "541f4a19-e76c-4676-8f68-1f583d11e973", "value": "49152:cKJoIaQL+/ajFUrA8WdvqevMWz3WRKj40kyyi2WlWSIbc:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713270888, "uuid": "755eef6d-72aa-4a20-9717-a1c5ca120377", "value": 3142991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713270888, "uuid": "11f34bfd-59fc-424d-bbd0-2883c775a804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713270888, "uuid": "740edfca-f579-421e-be41-4d58d4d0f62b", "value": "20240416-703661.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529d1791-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236790, "uuid": "812db3dd-9b82-4045-ba38-506d3a040145", "comment": "Malware payload (Mirai)", "value": "0caaec659d38e3499c10df4266f6e34f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236790, "uuid": "7a88aaf7-af61-4c74-9c87-ddbc0f69a381", "comment": "Malware payload (Mirai)", "value": "a621c04e88bdc94202080d63c1b7c28ac5a86ddbec22f52c15e1af668fba24a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236790, "uuid": "dba4b8c9-5849-4972-a30c-aa117b06f168", "comment": "Malware payload (Mirai)", "value": "50cc92d29b1daa9d62669bfca2c83cfdf47592fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236790, "uuid": "f8e0577c-5863-48c7-9294-cbfa86f0359d", "comment": "Malware payload (Mirai)", "value": "6192543ff6a0998ae7f275a474c32855c9d9d66cc661bd39d4b78deb0c2c2ee481c737044736496edd023e53f80bc473", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236790, "uuid": "9e297a0d-ad2a-49cb-af92-6415f017424d", "value": "T1E7334BC4F543DBF9D84900717036EF369B33F1EA226DD897D3995A33AC92602A507A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236790, "uuid": "ff585a28-2905-45f5-a05d-a8beb7fa6055", "value": "1536:vbxZ+QmM0P+IWFWidh8dsbFequkc0iIBYF0x5L:dZ+QmBto9jPBuEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236790, "uuid": "47a04404-cfaf-4013-8e4e-3a024b14389a", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236790, "uuid": "6d582d94-1dc4-43de-b48c-a81717f9e5b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236790, "uuid": "fdd92c3c-c17b-4532-8f14-6fe1c2d10a30", "value": "0caaec659d38e3499c10df4266f6e34f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75af3d1d-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302562, "uuid": "9856f55c-1832-48fb-a7a8-15a671221870", "comment": "Malware payload (MarsStealer)", "value": "6f8e78dd0f22b61244bb69827e0dbdc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302562, "uuid": "6d526b1b-2620-428a-9f19-a546bdc589fd", "comment": "Malware payload (MarsStealer)", "value": "a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302562, "uuid": "81d6a940-a468-4052-b4b6-b728ea69873d", "comment": "Malware payload (MarsStealer)", "value": "1884d9fd265659b6bd66d980ca8b776b40365b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302562, "uuid": "54be6aa1-bebe-4c93-9e03-c195b181aa03", "comment": "Malware payload (MarsStealer)", "value": "2503cc405617309e63cca34da553bfa91a3910fc5f6874bd5d8c67927b6153139a39dac8bfbad64d5de6268e2b7b9bc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302562, "uuid": "e07d5064-9b94-4701-b0d1-41f4a9c483c8", "value": "T16EF3E0FA8C8445BCC37D1ABCD54F7F7E918F7E1D4AC66A675A09B0C00866549AF8380B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302562, "uuid": "3ce044f3-38cc-49ba-b5c6-0c06a0595db9", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302562, "uuid": "2961eccf-5c5c-4795-b08b-6ed0541c8ed7", "value": "3072:UjmZSAJzKENhipmjq0vByzzvcjWFJ2ywMh6yJSp8Bb8EG:WnOzKE/s0vivUvVk8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302562, "uuid": "21baac11-f927-44ae-b7f0-29bb689964f1", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302562, "uuid": "2920d0e9-3d71-44d4-9402-a1dd83c45308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302562, "uuid": "698a7dfb-77cd-4af2-8a7d-abd8f894705d", "value": "a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b756fc00-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233952, "uuid": "1b1a6d73-f1b2-45ca-8360-055dcd3a1653", "comment": "Malware payload (Mirai)", "value": "36e1e546170202bd52cf8fef9ea506b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233952, "uuid": "a78d38c5-e8d7-4a7d-bf33-5fe2ed695e31", "comment": "Malware payload (Mirai)", "value": "a799d12c09488a86060060cc1e91a3e1f2bac0cbdf21ee4f88bc268fdf7d874c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233952, "uuid": "7d5c34fa-0d7f-4742-8c12-34d53976d68e", "comment": "Malware payload (Mirai)", "value": "bcd51af8cfd4aa9d4dfa0134aeab3cdce1097c5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233952, "uuid": "ad6bc122-ecc8-4468-9618-19497b70c077", "comment": "Malware payload (Mirai)", "value": "6eb4c55d69ad02950661bb8fe39987128ef7e419b7ff5f5900acec8907626ded3502cce7859d9e826c259402c62518dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233952, "uuid": "706a0113-ea1f-44a3-9bde-39af5c1de903", "value": "T13A83292277390B27C4E2647D51F7872AB2EA6B891974C20FBE715E8D7B944E031533B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233952, "uuid": "fb4bf6c4-f530-4a49-bc2c-955789a98b2c", "value": "1536:Syt8CosXTd7VDzl74mwQr992gHmR42uiiWg:SCDxrwQZcomeiij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233952, "uuid": "3beda3c7-c7a0-473d-bfa0-83889a76ccf2", "value": 85644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233952, "uuid": "c8d2ee98-925c-4cd4-a2f6-9e3734bfa098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233952, "uuid": "258b4657-d7e7-4416-b54d-3f6e084be9e1", "value": "36e1e546170202bd52cf8fef9ea506b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a250f8-fbd3-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713259743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259743, "uuid": "35df91a2-3db1-4628-9d12-2677b7cd08a6", "comment": "Malware payload (Stealc)", "value": "4b67132f548e1e818c48de7a60b10f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259743, "uuid": "ae1ae90c-615b-46ff-8496-eed50d7c1af0", "comment": "Malware payload (Stealc)", "value": "a7a142597d3460b97069a66ff9b0715f1886f15e33d9a0606e9a74acaa6b0bb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259743, "uuid": "6f0802e7-f60b-40f7-b5e3-815031270905", "comment": "Malware payload (Stealc)", "value": "5152029f73a2475e4929cffab895647112714625", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713259743, "uuid": "a8d99ff1-2bc1-4f28-b9b8-d35b2309e7db", "comment": "Malware payload (Stealc)", "value": "aa90bb173342edb5a4998991e3905aef29f18a622dc551655d6752eb046ceeadbd2cd9ab2c2572362f1e3db0e1da4d4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259743, "uuid": "f91c3f6e-1920-4e2e-8bf2-6bd7563297d2", "value": "T1D0A4E10266E3E476D23609718D39EBB41E6EB9E3DEECA2D73654663F1A302D0D513312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259743, "uuid": "e1b615c0-609c-48b4-9ffc-4466e2de3a7a", "value": "b0e7b1f470281f5f864a1cf1dacc65ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259743, "uuid": "d7b41a15-ff7c-47b2-82be-b39810fb1fed", "value": "6144:F7tHLVrEHo/Qi62tEHJym1hp2o8krwYHUXiK1YJrcbxuTvK:F7tHpAdispyGhQiMiAvxKvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713259743, "uuid": "554184cf-4be2-47cd-8856-5568777140b4", "value": 450561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713259743, "uuid": "5568ed5c-ae24-45a6-8cc2-62f0a5f857e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713259743, "uuid": "bef3c6d1-63e9-45b7-bcd4-8facced4a389", "value": "4b67132f548e1e818c48de7a60b10f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a517f3-fc0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713285033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285033, "uuid": "a640b379-442b-48c5-ba46-c236e7ada491", "comment": "Malware payload (Formbook)", "value": "9777327e5dc768314f8083deb0e3a000", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285033, "uuid": "08ca5e24-2027-43bc-b83e-b85f7635372b", "comment": "Malware payload (Formbook)", "value": "a7f6e78f6b0dde7599e5388e4e994f79d5a0950db56092c0e2bd0ca9d07f708b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285033, "uuid": "fd86e69d-e43c-4f0e-99e7-8217ccda4792", "comment": "Malware payload (Formbook)", "value": "a7e4c663070125d5d00766d8610bf13c34e85cd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285033, "uuid": "84d7e98c-5191-4fe8-aa2d-c9fadadae51c", "comment": "Malware payload (Formbook)", "value": "249fb6448e7bdd16afe85adf8f23d6ada92334c99a00fe027bacd49203f95d92a7d26f45f9669fcb1649bb4280ec5099", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285033, "uuid": "48b87e10-0837-4142-b6cf-09e3609280bb", "value": "T1E8F40200B2F5BF19D2B98BB4DA225D241B7275F62A31D34B5EC2B0C25A75BC04B41B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285033, "uuid": "9db9e68c-ce31-49c2-8eb7-94ca3eeeff4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285033, "uuid": "16cdb9ad-e7d1-40d4-90b5-4a88f2a62956", "value": "12288:AM4j+3LmuoboUIqJysdeR8KgO8dx1YttC2gcXoQKYnkJnEr3Hg90dQvwJXyz/+xy:AM4i3p5UIqJyo9Co2gcXodCuoQ8QvwNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285033, "uuid": "b8ba4aca-d1e3-4eec-89e3-0f7f833816bb", "value": 726024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285033, "uuid": "cb4233c3-79bd-4809-aa8f-5ddd2e0b0e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285033, "uuid": "9b43f7b9-7a23-49ba-b383-5e254cc0579d", "value": "9777327e5dc768314f8083deb0e3a000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fb83b1-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713251724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251724, "uuid": "cf10f2e9-7442-458c-9b97-8327ed154b30", "comment": "Malware payload", "value": "a411e71d5e45bd1e510ef136da2108d9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251724, "uuid": "588e9710-882a-47af-a7fa-bd14f78e806b", "comment": "Malware payload", "value": "a99979813cf3eabb7ce73e9bf4943d03b6c4cf39f978acf2b1dbfc5f34bc70a7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251724, "uuid": "ece16f24-e024-472b-827e-ed05300038b3", "comment": "Malware payload", "value": "2ba101f4024071e5b2b343bf4a7374e4b8a671cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251724, "uuid": "528ff5af-e0ae-4eed-8325-c51ad182c2a5", "comment": "Malware payload", "value": "db9f686ce6558cefc32f64097d8e6f60a590180cb0ce3a64a4e67d2108f7ba009c40381ce981ba5d2c26880a8d0a3e3f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251724, "uuid": "a2920f72-228b-4159-a224-f1a162fbf558", "value": "T176831C42621F6E2BD11E1134652B53AD277DBCEE2E49761A32D53EBC3E70270EA2570C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251724, "uuid": "0957a135-f87d-4e21-9a67-229e2074cd26", "value": "1536:KRCb7a7hLGNWSa0ocrQ0+a9S1UCWoCWNDO3:oCKd640bQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251724, "uuid": "5cbe6220-fd91-43b3-8c15-af5e6d17b456", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251724, "uuid": "5b1f662e-3b69-4eea-a94b-20507821db1e", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251724, "uuid": "6e6f8c9a-d905-4af1-a885-241190c64c97", "value": "Priya_network_Consulting_Engineer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db29067-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268189, "uuid": "67ecbc7e-3466-45ef-9c5b-bdd8d718a252", "comment": "Malware payload (Mirai)", "value": "7bd2ecb41d1d73dd808982407d4ba26c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268189, "uuid": "44839854-7d12-4961-bbaa-99de79903d75", "comment": "Malware payload (Mirai)", "value": "aa72a74ab59bf29fe9f8d79ee7d0a095b11edcabd64acc2963fede8420382ca6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268189, "uuid": "6be9b217-46b8-4737-b27e-75ba03ceb4fe", "comment": "Malware payload (Mirai)", "value": "22b2563a1bdf4ac632af169d9cb036cde031888f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268189, "uuid": "595fc41a-b150-4c25-a480-87dded8821ec", "comment": "Malware payload (Mirai)", "value": "751ce7cb97c94fa72d83ebf064f9fa4423bca09b72b35bb26acc5d90c39ace95938865f1d236ebdb5255e43ab38c859c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268189, "uuid": "f86e69d4-a0ae-40b9-a508-c017b9bc2652", "value": "T1F1734A01B3184E07E5E61AF4393F1FE197BEE9C022E4F585691ED7465272E33584AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268189, "uuid": "2014bcae-9193-4701-87fe-4567a49a0386", "value": "1536:LecvZ1h6c3UBAAq+9BKRyu5ePslkGHSesujvOT:LeKkBVq+9Be8bASeHjWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268189, "uuid": "6e2ffd89-db92-4087-a1b0-70947268b599", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268189, "uuid": "002ab29c-9c6b-4ac5-996b-917b169465c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268189, "uuid": "8eb71b59-c069-413d-b648-d7e49115aa54", "value": "7bd2ecb41d1d73dd808982407d4ba26c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcca9e3-fbe6-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713267867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267867, "uuid": "e629eb53-008d-4a65-8cd7-8a111e1c0b76", "comment": "Malware payload (RiseProStealer)", "value": "588d5e1f2fe3492a0d606bc085d15cbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267867, "uuid": "f3292662-7303-42c0-83b4-f799b7c2c4f5", "comment": "Malware payload (RiseProStealer)", "value": "aa8affadfb9c645d5054ca936cb6d9198581257d56406eeedb4c473ab457778c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267867, "uuid": "c9ec4be0-4309-4bec-9220-2e6b2fee08e6", "comment": "Malware payload (RiseProStealer)", "value": "eda5fd6c883d3c18fdee5f80b48dddec6953b1a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267867, "uuid": "f4acfa70-576a-4a5a-93b1-e431d5b2db34", "comment": "Malware payload (RiseProStealer)", "value": "f8c31df8a67c87a6faccc19a1e2331943a72501db74cb041a10962080d1615a1488b1f9798ad976ba2f97cd00d2212b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267867, "uuid": "9d387b83-c2da-4fb5-8cf4-dfb6c6e2bd3d", "value": "T137B533B47EA19764DADDA7310BE7946226903A5190759DEEB2CF3C337C6323D8B16E00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267867, "uuid": "32af0534-ed86-42ba-8285-7a9959af6792", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267867, "uuid": "3a4eaff4-f3e7-4b89-9727-06da84394192", "value": "49152:MSUl6vD5DxN6HHLJ9tTJpZRoWIts9g2EtB/Yo6cpMEyWkMxnu5:MSSwD5DxkNPDoWOHiZjcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713267867, "uuid": "7d3e6cc9-78e7-4c4d-b3b5-522c31a6a6d6", "value": 2281984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713267867, "uuid": "08b1da6f-34c1-46f4-a278-0b51e9d029ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267867, "uuid": "df744690-abcf-4c6f-ba7a-1b90352edd4d", "value": "588d5e1f2fe3492a0d606bc085d15cbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825d92ed-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713253191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253191, "uuid": "9fc15eeb-eaa6-4c47-9816-4a86bb1ac2c8", "comment": "Malware payload (Formbook)", "value": "05fcc33a22988584feef4a9543e8bced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253191, "uuid": "734c4214-c33f-4bbb-bfff-3d62ec2d14e1", "comment": "Malware payload (Formbook)", "value": "aac29483a0ae2197bc862ba331928079e4c2c57b78b6fa2e0190215ce794b0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253191, "uuid": "39b58d8f-7dfa-4e05-bb59-408278fc6775", "comment": "Malware payload (Formbook)", "value": "784e20d02c4fa77fe7f00a722ed21a83880df5ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253191, "uuid": "bdce3e28-052a-4165-8e94-b11997fcdfb9", "comment": "Malware payload (Formbook)", "value": "022f1516e4d0ae94d7429e3933c9eb8b0608b161045867b1a87bc4c7c6ff788544cc07542de25436508088d0203d4e46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253191, "uuid": "d1759036-c448-42c3-9075-29171e8c1dcd", "value": "T1B5C423137E009725D6A30BB064E6AFCBAFDEA65130987E0733997D1E3D4EB51C42DA44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253191, "uuid": "d12fe288-133b-404a-ac30-65f345b82f38", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253191, "uuid": "f14a9305-8436-48df-8f28-648feb0f2915", "value": "12288:u9gnHfA6NBsYrBrGZL7KodUX187POSD4azhM0ESmLjPLoSBHFB:znHfAENBqhOoKlknzajSeoSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253191, "uuid": "7a0073fb-dedc-4dac-af47-bf149856e408", "value": 579176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253191, "uuid": "b0b29876-eca0-4827-aa78-de3040a63f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253191, "uuid": "bc915873-a186-4127-a1b8-cb8102e62fb5", "value": "S\u0130PAR\u0130S_0453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a244da7-fbad-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713243164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243164, "uuid": "ba1a8a00-ae4e-4ad5-8693-ef85ed7da964", "comment": "Malware payload (RiseProStealer)", "value": "050b16ee0e94989771b22bbb92c83c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243164, "uuid": "aa2a0327-4cc0-499f-b926-cdbbe740fdee", "comment": "Malware payload (RiseProStealer)", "value": "abe47b0a9daf89fb619a25911ba9c1e2bd045aba0eb7648311814cceece54f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243164, "uuid": "21a33191-198f-4358-a28c-981aa794a062", "comment": "Malware payload (RiseProStealer)", "value": "ba6d4952caf865c3289f6ba92de68224efabc0c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713243164, "uuid": "4106c218-8753-4e59-a8b0-42c4ef31eb99", "comment": "Malware payload (RiseProStealer)", "value": "93ce7eec839f4ab7d7d04813bfbab9af333444c9bbaeb1a86de5b912977171931fb6a8bdf5dfa8d7a313f19ef89b8e0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243164, "uuid": "6ab2fd91-0501-4c95-9798-2961d8db8134", "value": "T14915F10236D1A8B1F97347325E698EE022BDFD614E559B7F33D86E4B14710A0E22673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243164, "uuid": "96e0e850-141c-4ed8-84ae-600e39770cdb", "value": "ff2e681d6d2b1c39bd5a3de9762f9168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243164, "uuid": "db2779a9-59f3-493d-bde0-ef0347f4d52d", "value": "24576:uunNhA9D64paJCPjfTdX+L9n1VDX/CNyI3n:ZnNhAwZJaORTDvCNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713243164, "uuid": "a4263d12-17f7-40ec-ba7e-9fde26b2e0a3", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713243164, "uuid": "22d9c2fd-06bf-4bd9-983a-54387b94ed0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713243164, "uuid": "0050ac01-ad33-461d-8597-5965bc086400", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de3d97b-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256968, "uuid": "be521aae-778b-4eaf-af79-7acbc2d06763", "comment": "Malware payload (Gafgyt)", "value": "ffba963a6575ca7e84da3cd6e20b630e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256968, "uuid": "5c84166e-b4ed-4856-abd1-da2d8fe32a63", "comment": "Malware payload (Gafgyt)", "value": "ac3ab21c2ac811418d7420ef146ead744718d4436cf8bf97cba87cb191b4b2b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256968, "uuid": "54bc9985-443d-4d61-b603-8bc67894fae8", "comment": "Malware payload (Gafgyt)", "value": "73e4a56f7ab2d75e2fea729115603f04516f1ce3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256968, "uuid": "57de531c-43a9-4473-8f1e-b7fd866a25fa", "comment": "Malware payload (Gafgyt)", "value": "bf81c8c601200bea456e2f0e71f6e4929f426223642c9f037caa1f6e9fa1f0e51e0fbcc71ceeac47a47325558f6e7f47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256968, "uuid": "bb9cb5da-72be-47f9-a027-03b9a18fe702", "value": "T1E7244C24E5404B57C2E323B9BA8E428E3B3247E573D773154A389BB03FC2B9A1D71925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256968, "uuid": "c0a815d3-48c8-4698-968b-ae027f553bd7", "value": "6144:5ZzyacCwXJ4DbpW0va5hbL6CBKH/WKcgym0wfB5RyAn:5ZzyacCwXJ4gF5hb7w/ugym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256968, "uuid": "15f6ac2a-fdcf-421a-8d03-7736a6a6a417", "value": 209634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256968, "uuid": "7c1ae86b-227c-4577-8895-6d26578906c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256968, "uuid": "c08ccff0-ada4-481f-9066-c5d254e680b6", "value": "ffba963a6575ca7e84da3cd6e20b630e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c7701e-fbfb-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713276599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276599, "uuid": "ca955394-e72e-475c-814f-6e1b3a10f565", "comment": "Malware payload (PureLogStealer)", "value": "5790d1417f8f00bd7ec6fb7011c79d9c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276599, "uuid": "90040425-a924-4a87-ace7-774fa85dd8a2", "comment": "Malware payload (PureLogStealer)", "value": "ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276599, "uuid": "c8955d80-f81e-4c19-b5ca-922d89278aed", "comment": "Malware payload (PureLogStealer)", "value": "36076ed9457c45d94e664ea291eb01e5c70d084b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276599, "uuid": "aa2f5fbb-1bf0-40eb-b488-f25a51f2e8fe", "comment": "Malware payload (PureLogStealer)", "value": "2dd297cd1b87fbe9d073fd32a841c5214c52a577dbe6f5d8cabba8c5252cd06cd7093c85f721c18f0d3af66bec8033f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713276599, "uuid": "8ef0f471-a2cd-4dc8-bf74-0cc768739607", "value": "T1F3F39E0A63E420A6E4B6577498F302939A32BCB15B7886FF12C5D57E4E336C4A532F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713276599, "uuid": "50187e2b-3904-4fc7-9252-8173fbf6a5ea", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713276599, "uuid": "52d5d241-f681-42e0-a92e-e3fdad40b76e", "value": "3072:XahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEk1eT:XahOfp0yN90QEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713276599, "uuid": "5b22ab49-ceef-46d2-a8ab-eed332759bb2", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713276599, "uuid": "6ca0e7d7-828f-445d-989c-b4abc9826a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713276599, "uuid": "5b4d67f7-c13e-4411-a5ed-e3cf569fcba1", "value": "5790d1417f8f00bd7ec6fb7011c79d9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e1531a-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248253, "uuid": "b74a043f-829d-4d11-83b8-72620797ccd1", "comment": "Malware payload (Mirai)", "value": "76759721936e8456b8c0437e41b3d943", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248253, "uuid": "2ab9dac1-210c-474b-9562-f26efc96cd74", "comment": "Malware payload (Mirai)", "value": "ad36c8a161394d052eec0a58fa2d2e164de8ac4f4e18d09f8c7be5a7be2c3ae4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248253, "uuid": "f1b01219-5d21-4ba6-973b-d65beb6bba3b", "comment": "Malware payload (Mirai)", "value": "dba4de9f46bc9b19bc288113f0ed743fa0ab6fc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248253, "uuid": "6173cae7-e5da-49b2-a922-cd3fda3337cf", "comment": "Malware payload (Mirai)", "value": "5f2ab9d79ce63e9e313e40a94b150c8fc5e595c2c951ea9e31d379e8ce3ee7dba49cc80812e19abad3a158b772e51643", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248253, "uuid": "01a5958a-6e80-43e3-b30d-0628ff1b9e79", "value": "T142C37CB2D8192FA8D024D8B4F4B88FB81BA3A58581571FF965B7C3B44487D8DF504BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248253, "uuid": "e9712650-6540-4e70-a742-3e448d413833", "value": "3072:CR4zUjpm+17REjRLZI+88jbc79ZGlrce6D:CUUV5ARLW79aIeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248253, "uuid": "62f3db72-6b02-49d1-8f18-36113fe27d4c", "value": 126180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248253, "uuid": "48086058-ee97-4c75-855d-d6bd5d6ffd90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248253, "uuid": "98b3f372-2fad-4a00-9ea4-b82c560477b0", "value": "76759721936e8456b8c0437e41b3d943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8490421-fbe4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713267052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267052, "uuid": "0d77f13e-5be9-4266-9dc3-5ca0e4ceacf0", "comment": "Malware payload (RemcosRAT)", "value": "796760cabed4c643ed34db0d822178bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267052, "uuid": "643cbbf0-1e37-4d6d-8770-d552d9c50a07", "comment": "Malware payload (RemcosRAT)", "value": "adb32d26a19fa865d1cbca27c886d8a497140db449813eee08e26c8a30b0f71d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267052, "uuid": "0ed3ae62-a6b8-4dc7-b282-20c61224d247", "comment": "Malware payload (RemcosRAT)", "value": "56c25e1bb87fc846df47a5c2e600505005ba45c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267052, "uuid": "77eb3a44-9df2-4287-b7d4-1f55cfe523f5", "comment": "Malware payload (RemcosRAT)", "value": "909f529aec58261ce550ad636163d42c7e77f4b830c307f3160371122d2aa36410dedfb5aeb762b53686be40e1ae9894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267052, "uuid": "57a7e43c-9197-415b-8225-e6f7b1262178", "value": "T1C1356C23F5A4CC22F00A1D78DC1B97F1D836AF12396758943EE97B4A4A3DB532A74193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267052, "uuid": "626fef94-442d-4eec-8103-faa50c878a55", "value": "ecd0012299b0e655dab241f2e23e3bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267052, "uuid": "7b6bd36d-73de-4ab1-9f22-68dd3acda23b", "value": "24576:0JIq+wADGZYx4t/yVrQ9JO85sfip46OV/b7Dnjv:eNAXCSfs8V/b7bjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713267052, "uuid": "06113273-eece-478d-8951-7494ce723b59", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713267052, "uuid": "930f2b91-47dd-4c4f-8c87-1c026ae99eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267052, "uuid": "5f8f5555-5481-47b6-904f-991da0ae3dd8", "value": "SecuriteInfo.com.FileRepMalware.21353.16266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34294d60-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256925, "uuid": "5989d04d-53c7-4cd6-8e11-38074f1f21ab", "comment": "Malware payload (Gafgyt)", "value": "8716a897dbdecdbf9401812e9323ff95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256925, "uuid": "d2a17a49-7138-48cb-9952-ecbccbaaff41", "comment": "Malware payload (Gafgyt)", "value": "aeb35c0279143719de052492fa1dd750b67e43353b20bbc61af498addaec943a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256925, "uuid": "96a0abdb-ad06-47ed-b4f9-2f37cd55ee5f", "comment": "Malware payload (Gafgyt)", "value": "1f5e3feb52b8072c522ff6c25bce835420e61fdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256925, "uuid": "5c830c1d-e241-45bc-9588-017e0c6b6adf", "comment": "Malware payload (Gafgyt)", "value": "17169c345581788dc974cccfcc9601c6cb5711b4afa22ccc9b10142b2d5723d68f88b6666648f4a0f24f79273022fd72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256925, "uuid": "e4910dae-c28c-4141-8680-947c8a950d85", "value": "T1E4F34CB7A21C0783C4C745F01E6B3FF24F6895E222F7A1855A1AEF905B73AB61051F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256925, "uuid": "8620849e-e8f6-4629-9887-6cb58e823798", "value": "1536:NEpsna8p7lUHWt/wi4MHk7iQmLSxKBl4yBMNgwZ5hCHhTugEmJ/sSiFMh3n:NO0aGUH+Hk7W9LFNW5hCFufmRsSiSh3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256925, "uuid": "52d24b60-b9a3-46ef-9873-0aa857cf1d43", "value": 161069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256925, "uuid": "4644f5f3-0074-415c-a15c-8faea2d34dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256925, "uuid": "575eac87-0129-43d8-a206-f5c1392d9a24", "value": "8716a897dbdecdbf9401812e9323ff95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febebec0-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265426, "uuid": "66c35b77-fff0-4696-8bb1-17cc9d56213a", "comment": "Malware payload (Mirai)", "value": "e73d553a1e3f05b5c335c1b82562578b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265426, "uuid": "06cf724a-8a54-4a0e-9252-38414aff37be", "comment": "Malware payload (Mirai)", "value": "af614c828b77d5b2c7b3e28e9ab7ce6cb9e2ceb5499d14ecdd74bd0e484c0c88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265426, "uuid": "515b8bd3-6c1d-443f-922e-1eecce6a2d81", "comment": "Malware payload (Mirai)", "value": "4ac7dc02d5982a1099df3de652dd46ca420bd084", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265426, "uuid": "78ea7bc9-825f-431d-9895-8b1b806a0353", "comment": "Malware payload (Mirai)", "value": "baf98d186703b89ab8e100df3191018a84a57640bf957ee484a8b28737d4235228ae6e9ed168a8223761d0991030f35c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265426, "uuid": "0823e561-565f-4450-a1cc-c59854c31a12", "value": "T156D3189BFC91DE6946C0277BFE2E418A331327B4D1DF71139D041F28B68A94F0E6A652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265426, "uuid": "b10ffa96-f586-4de7-a196-682f6953ff41", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhnj:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265426, "uuid": "c74853cd-ca42-45bb-80b0-2dfd0cf75c16", "value": 131792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265426, "uuid": "90fce4e0-f5b1-4018-8f81-7316020bc924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265426, "uuid": "b163a48a-751b-4da4-b226-c017694ed32b", "value": "e73d553a1e3f05b5c335c1b82562578b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb9d120-fbc3-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713252918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252918, "uuid": "370ec714-3647-49bd-8348-7cb63da40eed", "comment": "Malware payload (LummaStealer)", "value": "e131a8df8cd1ac82fefb9dd1e5442956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252918, "uuid": "7d4d0c61-2152-4f0a-af9f-632699768564", "comment": "Malware payload (LummaStealer)", "value": "b08d869afbfdab4dd749575f0ee8a7bb74e8b7dde9f3705fdb99896c9e01a5a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252918, "uuid": "f2dadf9b-3679-4d97-8dba-0a53b350b3e2", "comment": "Malware payload (LummaStealer)", "value": "753693e0b6c5ee04938d5f360747ca70c4fb321a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252918, "uuid": "ed3a64e8-65ad-46a0-b254-73e733d1baf2", "comment": "Malware payload (LummaStealer)", "value": "7cc11c8da6b1b475cc2e3092d155412376770c0f74481c98398fe3767fd5ae6b158d63262cf293ee632f5aeb5eff0f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252918, "uuid": "7b1eae2f-1421-4607-ba5d-771cb1b25e57", "value": "T1BF4623A24331514ED1D5CC3A4A3BBEF436F6172BAB02BC7C958A2AC538125B5F267C53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252918, "uuid": "73a7f505-08ae-4a9c-8118-c1c2359b0cba", "value": "89c8abd38fd3ffc06ee06d01f9b3cbbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252918, "uuid": "20acabe3-33d4-4500-be71-b2de85f4043d", "value": "98304:g/qqmAqg6L3xdq8Re2HQVJy9kjAdxNrDIqKrZfzcppq3w0dcm96XU846v:OqqmAqgblVJyuEzNfI5QIA0dcS6f46v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713252918, "uuid": "4c4a33b7-bdbf-42fb-9c2e-841cebdfaa1e", "value": 5736960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713252918, "uuid": "34bba702-2b5f-4979-8522-695ace949b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252918, "uuid": "7b2d0474-35dd-4217-928d-0933b205a85e", "value": "e131a8df8cd1ac82fefb9dd1e5442956.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830da8b6-fc10-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713285834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285834, "uuid": "37eb1782-ea69-46a8-92e9-319a239551e8", "comment": "Malware payload (PureLogStealer)", "value": "7cf0ba422c37585d399e4dffb0b7757c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285834, "uuid": "99229392-9e20-4753-9c9d-9a04cc166052", "comment": "Malware payload (PureLogStealer)", "value": "b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285834, "uuid": "98c726ea-85b6-4363-9a37-eecf75fece68", "comment": "Malware payload (PureLogStealer)", "value": "d7b1b39ccdb9287edbae0aa9496ab1d678a4780b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285834, "uuid": "f7423ddd-adf8-4704-b897-aa6e168e6658", "comment": "Malware payload (PureLogStealer)", "value": "0bc77c93b55539f7c71a15e8122de78596a5d51eef107cd6f61f80ab8428b48a3360b666dd98242762730b0aa4dbf9c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285834, "uuid": "bc1b5c20-f91d-4327-99db-9a28d7759d08", "value": "T15C66335713E8C630CD56813568BA079D0AB0D127AAF2639FBE0DB8F8F453B99792C171", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285834, "uuid": "756162b3-7c16-4cfe-8348-949853037395", "value": "196608:2UU5u4Ef30GhXdLPLPCiZMwVnvrgDK+Sshs:Z6FEvHdHC2M8vlEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285834, "uuid": "d45fb7b2-5902-4052-a6b0-ca35d5b85f6a", "value": 6928384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285834, "uuid": "0909b950-5892-4e4f-bcae-e4f3511a784e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285834, "uuid": "9e185cb0-90c2-4399-8876-bc0d230145cc", "value": "SecuriteInfo.com.Win64.PWSX-gen.6289.18727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a7372d-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713251853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251853, "uuid": "fbb6b9ad-06d0-48fa-9de8-25962d24c2d7", "comment": "Malware payload (Formbook)", "value": "53ff37a6a2c349401d844564e6c08681", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251853, "uuid": "4575d7bb-d73c-4ba1-9d82-26ed797c7cf8", "comment": "Malware payload (Formbook)", "value": "b28544713d74e229e251d11b415a48e118c75015a520f16c21005e4d78a22d5f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251853, "uuid": "5686a58e-06a0-46b8-b973-72936d3ee4bd", "comment": "Malware payload (Formbook)", "value": "6b95fb3941f3beafaf660829f8045b1a0153c2f4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251853, "uuid": "1d5203f9-0843-4af2-b97d-9fc6aa340dee", "comment": "Malware payload (Formbook)", "value": "0d2fa9ffd822681b95b59bb1306cce381016a2ea87eef9153480b515ab4120b7accfbea5f743deef097a1c7ba19e4e71", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251853, "uuid": "2201d735-c093-41f6-8459-db7a18bca73e", "value": "T1F1051210F991949FC91129B204E2FB79F6AEED432D218D137B1D3B9FAB3EA446905703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251853, "uuid": "6da31f68-ecba-4da3-a79d-c146c2d75fa7", "value": "12288:1OyBItc6c4ASOSjM0rp7Z3lYFNiooPsND1kz7FgCa2+mSP2iYZ367TCIhhDu:vW2zuOSjrrpxG9oETe7iCa2LUnCyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251853, "uuid": "f0d0b184-b8b6-44b2-abea-4ddcc31fdbb4", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251853, "uuid": "b2548616-e1d0-4f28-b48c-399b1716e88c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251853, "uuid": "7120ef5e-c4bf-43f8-b32e-e9647baf95ce", "value": "2024041342836038.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f17fda-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713248667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248667, "uuid": "96aaafc7-9380-488d-90aa-b8e14a61f45b", "comment": "Malware payload", "value": "f095e5839de14a2b1b5061d722e6d8f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248667, "uuid": "8f05bb05-7294-49f5-80fe-01e0892a358b", "comment": "Malware payload", "value": "b312f661b4f7a7811ae1db1e242bd7c669c788ff8d0a15f475ba0acd1d706d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248667, "uuid": "dd8faeb8-da7f-4901-8421-8c74c1d4c8d3", "comment": "Malware payload", "value": "8e0c97f189f249ee06a3ddb8bf33cdcfcd0e8a1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248667, "uuid": "2634b5c1-7828-4384-9ee5-a705704e3b14", "comment": "Malware payload", "value": "947262247b2e03a7805adf2365aac69e94e17c7e38b005a75891f2eaca9eef1c2a5047adf26a4f24f21cbf986c0fe32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248667, "uuid": "9be37e55-6223-4329-adfb-8ea8c082ad8d", "value": "T1F006E162B3414537E12317348C0BCBD96825BE212E686DCB37E92D4DAF7B74278193A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248667, "uuid": "5e4d54f9-58fc-4c9d-92e4-4e3f7e262e4c", "value": "98304:/IA9/dRbiTwnlEfFNDuARNj5zKZFVOiI5:AACumFNDuINj5zkFVOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248667, "uuid": "de4f0321-7d12-44fb-8690-3c13560a65b8", "value": 3666944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248667, "uuid": "65c202fb-ba4b-46d4-8ef7-674f9e738578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248667, "uuid": "dd71f805-f892-4276-927a-ffd47c49ef74", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.24599.14884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1425dbdd-fbd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713258589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258589, "uuid": "963e577a-ea50-4d9e-8879-7f9666635b02", "comment": "Malware payload (AgentTesla)", "value": "5774b04e1b012e4a5961d110eec40d2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258589, "uuid": "d83fbddd-2422-4a04-9375-d30e3ab60eac", "comment": "Malware payload (AgentTesla)", "value": "b5126fd0fbb2ecd8fb2b32b606a4e8ab867bc0758e146d14c88440c1ac9c8f60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258589, "uuid": "e4533458-6126-4faa-81e4-1526003180c0", "comment": "Malware payload (AgentTesla)", "value": "611ba10264a70b33fa2cc06e8d65ebc233677aff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713258589, "uuid": "1b7d2c7e-b344-4087-aa1c-1b9b0276cce9", "comment": "Malware payload (AgentTesla)", "value": "8fc518bf327a4f4ee29e7a9ffb5032fa4a7360217a81c487797543a925224db70c68c6348ce9995c1d8db9fa0e898637", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258589, "uuid": "a8ff4e70-d1be-4a77-875d-0a8f4ceb7d67", "value": "T10CF4E06466ABBF2AD4BD87F5552298200FF5B05F6825E38F0FC760DA1821FC14A91F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258589, "uuid": "07507e94-9755-4a38-89fe-e50ec004c61e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258589, "uuid": "7980ec9c-95e2-454d-83a8-6125f1a7d46a", "value": "24576:U4p2Y+5UN6cjeG3OcDhGWuGVRectG31jw:U4pX6ce9G/ectw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713258589, "uuid": "40795874-0f6c-47cb-9386-4a802ba947a9", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713258589, "uuid": "ef70810f-f34b-4c5c-9026-2f5e0b74d9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713258589, "uuid": "52ba3977-e149-4eec-9286-5684b7b6a228", "value": "93001657328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a6843a-fc03-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713280365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280365, "uuid": "77b8c03e-0b0e-4c5d-b225-8795ceb7a54b", "comment": "Malware payload (AgentTesla)", "value": "dfc62195c6293a84c6e9ab815ce50a6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280365, "uuid": "a65fbf04-312d-4429-a2dc-c6c9b40c5c94", "comment": "Malware payload (AgentTesla)", "value": "b81530cca77b78402585d96bcfc8e417aa86dd53ac1966601ce8c32bbf517cc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280365, "uuid": "8ea613c6-d960-4008-b634-c24215063d48", "comment": "Malware payload (AgentTesla)", "value": "2b3f573e80f99f300a1fbe6390084a01822fa0aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280365, "uuid": "13b023c7-b290-4931-a605-51dac7b7dcfa", "comment": "Malware payload (AgentTesla)", "value": "43fe66332aac3e2ca4e86a3664006b7ff9d1f4a44fab5300b32fe49ca474d4a1a6eb242e2eb6ada5de3d3570f549bbc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280365, "uuid": "31459d2d-d752-4bac-aa84-51d8c72a6016", "value": "T1D0F4F06925BBDF6AD1BC47FA4124183407F6B65FA2B4E31B4FCAA0C91811FD40996B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280365, "uuid": "01d1cc01-2cd8-4a05-be7d-38b87b38c64b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280365, "uuid": "2b1c35ed-94b7-4747-9e65-2d9367c25220", "value": "6144:oXIEI2T4Q5hWcMzUBfZbe970/cIP6VlXFD2Et8WAdxJOYd+gAp42aiangA8j7loR:CIjURrcIw228VAHhdUbzyT6sxu3IAKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713280365, "uuid": "778aceda-bae4-4b3d-838c-83aa7593628c", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713280365, "uuid": "8f4e4864-870d-40d6-81cd-47598ab42525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280365, "uuid": "d252fcf6-95ad-42a7-8e88-1d58628c4eb6", "value": "ReInquiry Lenght Error.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927e9488-fbc3-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713252789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252789, "uuid": "e4a9bbdd-f6d2-4ecf-8bd6-ae0dea13e836", "comment": "Malware payload (RemcosRAT)", "value": "168ea6eca48cf9f2612488934e1e2da7", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252789, "uuid": "be44633d-b417-48cb-9641-2749a8bd3265", "comment": "Malware payload (RemcosRAT)", "value": "b8376836fa29f66836689fa0edc6e456c17b4294d5090432ef888c2a74f624dc", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252789, "uuid": "1ca3393d-15fa-43ce-9453-658b8410be98", "comment": "Malware payload (RemcosRAT)", "value": "a23ad3e47bf3b7a4e8ac7852b9359b9c8907590a", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713252789, "uuid": "b2a33ca0-9fb2-4b5c-8ff3-49b8470237af", "comment": "Malware payload (RemcosRAT)", "value": "1e328498fc5f0f14e3b04c1339b80faeb94d4b791e1d1e2e7c13151cf5e9620fd4bef46c380bd128402aa4a0dde1575d", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252789, "uuid": "e710b962-f92f-4620-8840-11be72e2a28d", "value": "T1D3B49E01BAD1C072D57514300D3AF776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252789, "uuid": "2202e599-c847-48ab-ad72-bcfd4326de35", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252789, "uuid": "4ff63e1f-f084-41e4-9edf-7d6bfd4ba96f", "value": "6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN/5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDWcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713252789, "uuid": "380bc56d-380a-4820-aef5-ce8366b3581d", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713252789, "uuid": "be5765fe-f9ed-444d-b119-6dfdb7aeba86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713252789, "uuid": "6154b9bc-eaa9-42a7-8d9b-9b3940a3016f", "value": "1713252787121128fc689f92bed3d76de8a0170e7d69ae243386b8c68bf411853ddcb2e022107.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d48627-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268229, "uuid": "7357c6fe-c56d-4d20-8b27-ca560ff2ca87", "comment": "Malware payload (Mirai)", "value": "8f6057d0c7aad5019ceebd394faccdc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268229, "uuid": "aa727862-5060-455b-8c96-d235ef173736", "comment": "Malware payload (Mirai)", "value": "b908cfa9989fff008ce8f8dbc10582f91dc8ed29aad0940a3af90de2443c98de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268229, "uuid": "f84de7a8-a372-493a-87a2-6bb0665d5ea2", "comment": "Malware payload (Mirai)", "value": "1e3d9a6f08fbc8bc4d76a67cd15f9b9def20b6ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268229, "uuid": "5d19a09f-dce0-4c5d-8d3c-c4aa369c343e", "comment": "Malware payload (Mirai)", "value": "e3f9d5b5caf7173772552754d7c09d88f72b5df53328686fdd86d2eded92c40d0156f377c4bd244d7063141204fbcfc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268229, "uuid": "309d8c15-cb75-41a9-894c-ba9885c5610f", "value": "T156834B99F401DE7DF48BDAB640270E0AB93162805A930F377767FDA33C320999A57D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268229, "uuid": "42a877d8-39f8-4f83-9894-ad25507264df", "value": "1536:vhtETs/Tnrt2o0FuekOlpls53aWa1Bq8NSLiO4LWgsH9YOKnPAtRSEZpZ:vXvtSFu6CYh1Buea7YBrEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268229, "uuid": "98426ad2-3baa-4586-92ef-fd1b15ebe8cb", "value": 85476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268229, "uuid": "402b7384-d657-4181-85a1-58499d083678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268229, "uuid": "e99a698a-c72f-4ef5-aae0-e3b44b3f4de2", "value": "8f6057d0c7aad5019ceebd394faccdc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a694d222-fc32-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713300496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300496, "uuid": "b2c33325-3900-4cb4-bf53-4619f21f9e31", "comment": "Malware payload (GuLoader)", "value": "8b3f35424a632028554705d25f3310ac", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300496, "uuid": "6cd77d9d-9444-4f76-9e5d-828c2f1417e4", "comment": "Malware payload (GuLoader)", "value": "b92c323236f79a97b8362ef4c4e6e722115248305d260b3138e5a5d76bab14d0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300496, "uuid": "cb1c8579-eb01-496b-8258-d07f3bbc8b64", "comment": "Malware payload (GuLoader)", "value": "25abc0deab0b43f401706e51a416e1b1d4318988", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300496, "uuid": "4fb9fa3a-3a13-4bde-85f9-7469fcb076a2", "comment": "Malware payload (GuLoader)", "value": "8c677f791113132ffd6e94b5af08768667ba8e4f277da4410bd32afac64fb215087d0e905e356fdf809adc1c4498f5f6", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300496, "uuid": "4312190c-d616-4acc-9828-5ce0264458ee", "value": "T1174407F09F0A3619CF4B3EFAAC6445924AF59195012228B5AAD817EDB383D2CD3FDD14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300496, "uuid": "05fdb00e-1f9f-4302-a6ec-ae31d18e35ed", "value": "6144:QYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfkqZ1:p2dOB2mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713300496, "uuid": "8363be1a-7949-4868-9260-c213535a073e", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713300496, "uuid": "64366cd3-2b69-447d-95a6-b9407263b0d2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300496, "uuid": "93387832-7b99-48a3-9483-e2cff9817e01", "value": "nQuotations %26 S.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51212521-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713281885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281885, "uuid": "c2657381-e805-4e15-ba55-f94780c71314", "comment": "Malware payload (AgentTesla)", "value": "e8f211d297be45627ca91c05e763368a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281885, "uuid": "df936799-2a05-443f-9b08-180d16483524", "comment": "Malware payload (AgentTesla)", "value": "ba03ce2bfa7e568a1f401420156219b97fce9bbfb3fb391783c804ac75df665e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281885, "uuid": "3c0515b2-87cc-4154-a714-dd61a66d85e1", "comment": "Malware payload (AgentTesla)", "value": "21683a8b9a1c284f7fe1cdb7d352bd7120d5ae31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281885, "uuid": "921e0384-6cf1-4a34-987b-ee40f614a7bf", "comment": "Malware payload (AgentTesla)", "value": "12fa7312cef9da8f0a4d583bb38e520dd33dc822902fc2dac921486df3ddd6f8e6be57857ecca20522756bf6790d5a38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281885, "uuid": "064bf512-6ecc-4aa9-b6cf-9f4403a29b70", "value": "T16BD422C652792732E1F943F6445032189FB2B42B7498EB8E5DDB74DF2EA6F021712923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281885, "uuid": "d902ae09-611a-480c-a7fd-e7cfbfe3d6d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281885, "uuid": "fa93fea1-9b3a-47e0-ac9e-c13fb5ca905b", "value": "12288:Qnte+gwIX03AGxVTDzRtQQqaXKsGI8lL2Ff+p7eT1WeY+XL29jFoMVmXRyc8Ari4:oeYnxVTDtOQXHz8lL2FyO1Wob2nVVmRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281885, "uuid": "9c7f789b-4ff7-43f1-9139-b2ed9f51bd02", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281885, "uuid": "5687fcfb-58b3-479e-90c5-011edc5928f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281885, "uuid": "325aed20-fc0c-441a-8898-bcd992556614", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fdd998-fbb7-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713247635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247635, "uuid": "c4a66009-64cc-4908-84d5-175fdf14a764", "comment": "Malware payload (Formbook)", "value": "f79259255f7440240b8ab8b9e8869752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247635, "uuid": "5d47c48a-535e-4840-8aef-d7fc021c53bd", "comment": "Malware payload (Formbook)", "value": "ba23641f1dd061c48d00c9b4e8cb84c850119599e68e28aff55ae4ce900f54b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247635, "uuid": "0248f8a1-01e7-41a8-a8b5-1ff83e1a2062", "comment": "Malware payload (Formbook)", "value": "ca48915eb8459eabfd8a1589451e86d32491efc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247635, "uuid": "dc989283-f263-412f-af3d-425cfb9b3b48", "comment": "Malware payload (Formbook)", "value": "9632b1e17f0db76c4ee20bc5d31224a8f64d3669de930a543b14231913b801b097e2c85b3c270f548a93a21b3b1ce972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247635, "uuid": "3f7e8bc2-17b1-426b-beab-b8672f3fb5d2", "value": "T1D4E4D01417E14162F2FF5BBA513543A653B76AE39139E39E089842FC5F72B829B013B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247635, "uuid": "b0293ee4-cbbf-4f8a-91a7-8d45e4941562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247635, "uuid": "942aa9f0-1ffb-4383-8c2d-8061c35b86cf", "value": "12288:ZseGjxLD3Pa9aRJxscgOGsLNaDuPjIG4Z6jZf0:ZseGjxLD/2A/NN1PjR4qZf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713247635, "uuid": "57cbcb1b-e3ab-47db-8cd3-6c7903ac1c08", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713247635, "uuid": "9f498620-f3ca-49b5-85c0-5c133949b5b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247635, "uuid": "54634500-5d9a-4b96-bd5d-67470d47fd7a", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d323ec-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1713281596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281596, "uuid": "b41b58a1-3607-4ac5-bde6-f5531556755d", "comment": "Malware payload (DarkCloud)", "value": "4d66177f839c56f22efb3f7dfed7e583", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281596, "uuid": "2388d8b4-99e2-47f2-9732-3ed2dd62c69a", "comment": "Malware payload (DarkCloud)", "value": "bb3779fd9e2577b65ec5c4e304e017c340365e57e3cad7035c146f69e1f3ec7c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281596, "uuid": "49fd4f52-de5e-4d66-8102-b91e370abc10", "comment": "Malware payload (DarkCloud)", "value": "d4d4a2d1680f25dd0642ec09e860932096108ff3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281596, "uuid": "4ee0ff1b-387e-4a99-9e8e-3c7eac75e4ac", "comment": "Malware payload (DarkCloud)", "value": "5cd0578b243b46d4e42fd963281dbbaf75aaa7a0f0b7ee0904a8d1f43efaee2bae846a140160dc0c4b35d73843e60c8d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281596, "uuid": "9e319e0a-5ff2-4922-987c-7a0eb2a0094a", "value": "T1DD11508D1A79B3E050C2F35E6B8084285DF0463FD494607C20109412B2BC74C983E2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281596, "uuid": "47386d2a-6560-453e-a3e7-98fb5d9fe0ea", "value": "24:XiFDdPzoUQTZqdzHwUJp7hLXKndwgyD4VzSZEziJOF:yfzRQVq5DJptDmQ2vF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281596, "uuid": "365e032e-d324-4a7c-aacc-1fbdcf9dba37", "value": 957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281596, "uuid": "cc8e1856-2136-4774-bd64-9c2f30302969", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281596, "uuid": "badbc1c3-61e7-4845-9d04-6f7a371bdd54", "value": "Bank Slip.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7a47c8-fb96-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713233612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233612, "uuid": "45a7952b-c5c9-46ea-851b-8d425a2beb29", "comment": "Malware payload (Mirai)", "value": "37a31c08c07fad8e9f442247308b5a90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233612, "uuid": "091d67fd-8ca1-4a4c-9ea5-963d36ccf837", "comment": "Malware payload (Mirai)", "value": "bb435975889d13990fd1e242c6c6bbae058cb793b56fe491239db0a3ed929067", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233612, "uuid": "f21a0853-2b52-42e1-b74a-6deb47b0b638", "comment": "Malware payload (Mirai)", "value": "907866f550beb7f0689757bebeccb78305fc8aec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233612, "uuid": "dbf44816-8393-4c80-9319-f6f345abb6cf", "comment": "Malware payload (Mirai)", "value": "c5dd981e5e02e675fdc4bd4de68be242b6789bab9df2b7b5e54a66d61c319e5d7f661bc8b2777395ed9bca926d35f110", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233612, "uuid": "9c337624-e699-46b6-b140-c2f4604497dc", "value": "T1E8C3409B7E108B2DF75C973446FB6D24834A23A72AE2D54AD19FD5001E3132D6C0FAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233612, "uuid": "b458c29d-6390-450a-b5ed-3c3c75fe5145", "value": "3072:0IXkoKkZe2bwKgrUpfMNJup6Yf5+MlkFb1laWL:0IOkZeawKgrU9KFb1laWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233612, "uuid": "d6cf852d-0a21-4ba3-aab9-8d1f519731dd", "value": 120276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233612, "uuid": "1b0c2b02-5a20-4b0b-ac87-da2f680bd503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233612, "uuid": "7d307e1d-0483-4eca-8473-1102b5df9ded", "value": "37a31c08c07fad8e9f442247308b5a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0ce7b1-fc1c-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713290847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290847, "uuid": "9532001b-716c-4af8-9457-88205a75dac2", "comment": "Malware payload (AsyncRAT)", "value": "e3a50cd4b0d687de0371979907eecec8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290847, "uuid": "e97e9684-e597-488b-b213-5e47ffdb1cc7", "comment": "Malware payload (AsyncRAT)", "value": "bbfd0355383f8e0df1442c646737854bfccb138b9c89e86c64c3d49d31e5fbf8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290847, "uuid": "a6a1f386-d95e-4718-915a-2d82a08ee594", "comment": "Malware payload (AsyncRAT)", "value": "a985891877f61b6b68b9584b3ebedad6941eb7ec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713290847, "uuid": "286c26a4-6dd0-43dd-8869-69b48823955f", "comment": "Malware payload (AsyncRAT)", "value": "63a0e9e865b50405678e9a61a815e830349330c3bfa3f8344cc934b2b48391680329888965c3b150085132acc0b37583", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290847, "uuid": "f328519e-1ae2-42ad-9451-3ee56e7b4261", "value": "T1E9236D0037A8C536E6BD4BB4ADF292058375D6672D03CA5D7CC814AA2B13FC996136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290847, "uuid": "663820b5-4716-4328-9614-06fd70cc3028", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290847, "uuid": "d2368dfc-e32d-496b-bd0d-f34bd3c2e7d1", "value": "768:l9GmxD6ILNCaS+Di+LFxh635OiY8Ybage19kOId0vEgK/JjZVc6KN:l9GAHW+RxkQzbNMkOQ0nkJjZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713290847, "uuid": "ef106a47-6791-49c0-8e28-d1232e70e8ad", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713290847, "uuid": "7062b19f-17da-4fec-af48-5ea8fba62f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713290847, "uuid": "7a375382-da90-44d4-91bc-df723cd32e13", "value": "bUAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a3abd8-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713256364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256364, "uuid": "b1e792dd-22ff-4708-9af2-33420b98fff8", "comment": "Malware payload (RedLineStealer)", "value": "d95c7a765b9a880b8be0829bd772bb9f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256364, "uuid": "fbeb0f73-628c-438b-b0f8-1b155cbfabba", "comment": "Malware payload (RedLineStealer)", "value": "bca45eb505ea8cd413f1f01ff7c8c98394618d480041a3680bcb9b2e617d1e90", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256364, "uuid": "cf55cc2c-daf6-431b-b52c-785c1d15e023", "comment": "Malware payload (RedLineStealer)", "value": "7283b37bf0be034dc99f623a42629358a944ca3c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256364, "uuid": "2e432d4e-d409-48ac-abda-0ba9535ddc33", "comment": "Malware payload (RedLineStealer)", "value": "f0055c0c3851dae2a9152b1c45519542a4c776c04dc258d070c8f1f8b793c0cbe16a966ade18b5c8986220487bacc2d6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256364, "uuid": "1224f94f-b2a5-483d-95f8-c65184b68a4e", "value": "T19DF423C007A9A8A01EAD60DB0372E3707664D63C9B598FF14C55F221B3D92CD9469BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256364, "uuid": "be027194-95c1-43d3-a4da-3494131b0a22", "value": "12288:+w+EnYYLMzLZ47RnYQ6yZ7IhKEcPOp02EEFegTN1kAu4GVyLFH1oGBp9u284vLjx:JBnVO05Ms2LJFegu9V2VoGBp9upCj7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256364, "uuid": "4d5d62ca-6f0b-4ad6-a36c-9c1d8722c0c6", "value": 725016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256364, "uuid": "702c5ab0-300a-4a86-b3aa-3393c6db9bfb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256364, "uuid": "497a29c9-9cb5-4560-be28-9cae95520b30", "value": "ORDER RFQ QUG24-200379907.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9938ff-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713281932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281932, "uuid": "de993f47-8182-4063-abf3-139324c9813c", "comment": "Malware payload (RedLineStealer)", "value": "abbe1d8ab3f9f8de5d738e46a7a3960b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281932, "uuid": "5f4775c3-4199-4cbf-bbc4-b707249a3325", "comment": "Malware payload (RedLineStealer)", "value": "bd6d188dc74a6e4f3cae1de9994a2b6ad72a381b2fc05401e69f56775968b34b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281932, "uuid": "6d00250a-83ed-4169-95ea-4e874afa7a03", "comment": "Malware payload (RedLineStealer)", "value": "ae9c21199a89393ed84f72005564b527ea510083", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281932, "uuid": "417f56d1-b775-45d3-936f-51b5e25c34ec", "comment": "Malware payload (RedLineStealer)", "value": "386295110ffbd63ade1d0c8eba3aed8d0224a7e474019c766cc0ad861c66254c7da4bfd1e0482b5b9fbfbe9cd695ade0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281932, "uuid": "2b184cce-6f95-4418-ac44-2d82341e51e2", "value": "T15445C00273C1D062FFAB92334B5AF6115BBC69260123E61F13981DBABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281932, "uuid": "d3d5bf30-ecdd-4e73-8533-7fc109c25292", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281932, "uuid": "179c5f13-248d-43a0-b215-6406e2e33048", "value": "24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8aO3Z1rGSnlX4M5tNcb:pTvC/MTQYxsWR7aO3nrFX4M5ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281932, "uuid": "34eb7c6f-c269-4910-a236-b4e25d623fdc", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281932, "uuid": "ec59e2b6-5a1d-4757-893e-d6a72a4a530a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281932, "uuid": "d52407a3-2dbb-4519-9c57-97f5d59b093f", "value": "dhl TR IS00O105560 INXPECT- 4123074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3661f87-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281620, "uuid": "7b5b7f7f-d7b0-40be-8849-646ec0177295", "comment": "Malware payload", "value": "ae55f99323808b2185d1b56d56f6305b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281620, "uuid": "3c996ab6-7f59-49c4-863e-ee2e31aafd5a", "comment": "Malware payload", "value": "be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281620, "uuid": "61b7ff8e-065a-4c1a-a6f2-87a75b0ad6cc", "comment": "Malware payload", "value": "d043a31f2a1c72cccc49f932f4c41abec7bf003d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281620, "uuid": "4e30c981-3268-430e-95dd-ee79cfeb2822", "comment": "Malware payload", "value": "12b6906745d87412ba6b8ac8898c5bdd169d7c7d852d91744e581a3f1474d46d6971dcca2c62b63ff318b0bb57e7e207", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281620, "uuid": "e3d4b80d-cac2-45a1-bc49-465ab775eda1", "value": "T15774F5E3CAC526289A461ABBED130B338DB4415D73271E3897BDC65DA04395C82BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281620, "uuid": "b96e3785-62f8-4566-87d3-4ce1bc217478", "value": "6144:xwKLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPe:u7InOiRxIl5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281620, "uuid": "a6b5a3bb-0e6d-45ee-8d63-0d62ef299211", "value": 369885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281620, "uuid": "e3fd40be-7462-4db8-8988-f90e917a82d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281620, "uuid": "c7a3b157-3896-43d2-96f1-8996c7ae34bd", "value": "Faktura_7171503997\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d44faf-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256962, "uuid": "e9f45813-eda0-491a-8d2d-6db2d46fee99", "comment": "Malware payload (Gafgyt)", "value": "cea6bcec5ea297d398da70c6a783791b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256962, "uuid": "ad95e56c-393f-47a9-9d23-9c3820a6a0a6", "comment": "Malware payload (Gafgyt)", "value": "bfef87860b79e1b5ab901982c08126d5bfea7f0c311827a8cf47d12cadf77fd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256962, "uuid": "727a7733-f6eb-44b8-be96-efb729a62afa", "comment": "Malware payload (Gafgyt)", "value": "e31b38855175a4d26837ac915299d2605c0e1470", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256962, "uuid": "65f31553-12a2-4436-b968-be85ec961792", "comment": "Malware payload (Gafgyt)", "value": "d826c5006f11bd77de33136c1cc69c8e1a175341c7e68bc6a73a14f2ac3213cf42348ebed21977178c607c44a8c6658f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256962, "uuid": "21abff9d-75f8-4efc-b408-8e9d29e21c15", "value": "T14E249479B7611EB7D81ECE7301DA4912188CC28653D97FABB2B8C618EB9794F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256962, "uuid": "56939770-4de1-4d15-a326-6f795d59038e", "value": "3072:T4mSFGv/kuidcX1qRdc+5hfH3TwpCMtmrpy6n9Nn:pn/ZmbRC+5hfXJMtmrpy6n9Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256962, "uuid": "f1c49cff-9fc9-4f99-85ea-60d61388a11d", "value": 214648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256962, "uuid": "c752417b-a284-4a5e-8e16-916f9e45e41f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256962, "uuid": "5b0b66dd-3b4e-497b-b1f1-d8338b27ab1d", "value": "cea6bcec5ea297d398da70c6a783791b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62bfabd-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713248661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248661, "uuid": "67c13c5f-8403-4ddc-a93e-2cf7bbde5c8f", "comment": "Malware payload", "value": "d00867630fc2b84019326c13c6839ccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248661, "uuid": "4ba4bd0b-6fff-4e43-8d78-0c426e6ad407", "comment": "Malware payload", "value": "c00c5a991aefe03773a698592847c997933cef6b0f91b8764cace4bbca75b23b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248661, "uuid": "613b65ef-c58e-4965-9703-91d1f771036c", "comment": "Malware payload", "value": "86dd199f218d97c9582f9f60f5943d62be9ca61e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248661, "uuid": "12007bb3-2997-47e0-9dcc-7f53ed3df53a", "comment": "Malware payload", "value": "16d91fa959010659d9365b8af1a65ffb86a9474715b7cc2a8b102f18e17785f569f6063c158b884f4334d86d43f1875a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248661, "uuid": "c4e99896-c690-474b-bfa8-cda5c4ac3ad9", "value": "T1FF149E26B6C2C926E8E941F5B1EEC36A3918BF744F50684336800F1E6B315F2C975B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248661, "uuid": "d54f173b-c02e-4ecc-95dd-b8dd53f72c1e", "value": "3072:4UQ5F9k7goIYW+IfrxM6MpToGZ6G+FxMxf7mLeL:Tn7gHhLtM9ToPMxEeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248661, "uuid": "15c3c706-c62f-4d41-9622-95d2747d1f8c", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248661, "uuid": "b303d142-b7e8-41b2-84c0-b3f690dba9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248661, "uuid": "a44c6c62-b506-452c-bd7b-6fbac6fc1fb2", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.11933.9769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43989d89-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713256092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256092, "uuid": "15607f07-5f24-4283-9705-5a0557cc2345", "comment": "Malware payload (RemcosRAT)", "value": "71f0113376a753bd003196b3a06a1cdf", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256092, "uuid": "1e393f23-5fec-41d6-ac85-95afcb49d8fc", "comment": "Malware payload (RemcosRAT)", "value": "c16e3601ae94a322a49a626b699eb0d71521a38922e35fd3f688f86196886da6", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256092, "uuid": "8a0199e8-6363-43a3-8d60-038ee5ae70ec", "comment": "Malware payload (RemcosRAT)", "value": "ce23ef82ec5e5e6b3198313e7cbdbbea0330c8fc", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256092, "uuid": "ae9ac761-d29d-4f33-8414-f7e9ad803d2f", "comment": "Malware payload (RemcosRAT)", "value": "6da00b9ddde71e2d631a2f786df595489f28ce2f01ef66cb8cf8977a819196576d80f5d79bb4bc54ec93279744403533", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256092, "uuid": "5d541b83-16d3-4ddf-8efb-460aa4aadd8a", "value": "T1AD64D011BA818617E495477449F74FEA6726FC416F524B0F325CF32E3EB03A45E2BA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256092, "uuid": "ddcf2ba6-37e3-46e6-9067-9256e958465d", "value": "6144:4uunJA7Y35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVuIMI8Y3suVRka1EA+PIN:4vJAG3bVuIMI8Y3xyA+PITW2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256092, "uuid": "ebf0b2af-be42-4f3a-bda8-75d63ba19452", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256092, "uuid": "2a2318dd-71a4-4646-b389-539bb1f30b32", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256092, "uuid": "5c1e7661-064b-4f67-9632-a40463a77caa", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf8070b-fbca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255945, "uuid": "0cb31c66-09eb-413c-aee7-b580f3fd3c3e", "comment": "Malware payload (AgentTesla)", "value": "6f3d4c2eb1f84ef7ac7a0aac4aa686a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255945, "uuid": "1eb0bfac-e2ac-4b55-b5e8-d874db46262a", "comment": "Malware payload (AgentTesla)", "value": "c221f5e47f91b5de6ddb5365b6759e113d48c40de422e14068bb7e68bcac508a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255945, "uuid": "458d214c-b866-4bda-aae1-30047a524f47", "comment": "Malware payload (AgentTesla)", "value": "5defd4e28ea03ad9612f80ef2789905cd959f8ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255945, "uuid": "d1882374-4fef-428a-85d1-29f037d807ea", "comment": "Malware payload (AgentTesla)", "value": "277a186d952132ef8564d8fabadf8a9709d892f46d009f086387fb1b37f1db6c8c601cc2d97947991b7a8eadfaf69e29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255945, "uuid": "11be9935-821b-46fd-9105-b4910cbeb6d5", "value": "T1D5D423AD7DDC93ABC190149F6098DBA1644B388E73B596DECFB692A3D706C6D0E043D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255945, "uuid": "6e103d01-628e-48b6-b330-1ffc60b39266", "value": "12288:FSdfdw1gcQpafknTAvRPpEMd59/cR88+Lj/cbbOI7IHD2GkDTysVINVn0rss:FSdFrpQkct5hg88k/4n/nyPL0rss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255945, "uuid": "5b5a4f37-e845-4f3d-8c52-3bf6005e9ed8", "value": 654642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255945, "uuid": "40695073-269c-4921-b44a-653231d7c3ae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255945, "uuid": "b1c3a5e0-e99a-4b47-893f-98fe6bb6e04f", "value": "NEW ORDER RFQ QUG24-20037.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b5941a-fbcd-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713256948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256948, "uuid": "3940b311-9b94-4659-85af-9a30be88f002", "comment": "Malware payload (Gafgyt)", "value": "13547f44d1f98bb8227765a9f64279a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256948, "uuid": "853a262f-9fdf-4ec3-9acc-a26fd2a03825", "comment": "Malware payload (Gafgyt)", "value": "c231c9f7bd0d27094a445d8545d70f57a8f4d23d96a0e0a167f98f32bced5cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256948, "uuid": "b18dbd14-bbc4-4fa4-a543-c6fb25d17651", "comment": "Malware payload (Gafgyt)", "value": "c5de8b01c79eccc9d00f79ece53e0da999cee066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256948, "uuid": "1511b8c8-a907-4156-9996-bc0738478139", "comment": "Malware payload (Gafgyt)", "value": "525a70862e24011c62fbbfa78590d4afc3cceacf388891697c462ace7aa0cc01865ecf3a91583cb425ed305d68ec547d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256948, "uuid": "26c2416a-b903-4739-952a-97c7d6dda231", "value": "T1D7244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB43FC2B9A1D71925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256948, "uuid": "b55f3db0-62a0-4ef0-80b4-92d886cb119c", "value": "6144:FZzyacCwXJ4DbpW0va5hbL6+uM/9Ocgym0wfB5RyAn:FZzyacCwXJ4gF5hbvf/dgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256948, "uuid": "7c05613e-bcdd-49af-9814-852e4e7a8c61", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256948, "uuid": "f85399c1-7d2e-483c-a132-66a530c6d735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256948, "uuid": "1175ee0e-4032-4849-900c-821a1abe8066", "value": "13547f44d1f98bb8227765a9f64279a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35cf20b-fc0e-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713285056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285056, "uuid": "a1de144e-cba3-4fbd-ada2-d42dad4606ee", "comment": "Malware payload (RiseProStealer)", "value": "ac5772b1ea2ad3b73dc07b085a9454eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285056, "uuid": "4e2503a1-54bd-4dc1-95b0-87100227b242", "comment": "Malware payload (RiseProStealer)", "value": "c2a919b18a7fd86d39d5430a1c0226a34612e580f567b964bd6fccb21457f56d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285056, "uuid": "216d9df3-54a9-4ead-9496-904c382125dd", "comment": "Malware payload (RiseProStealer)", "value": "5cf000c2ab3956fc27ed2cf23305aa17105fb7e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285056, "uuid": "2a230f84-eeb2-4eee-a03a-3ad2cdb7574d", "comment": "Malware payload (RiseProStealer)", "value": "77890c7f80bd20c3ddd336474e1bcb2b8dd3543ef1b08dfb53679b965e3c194d9c5cff43ac03f608b5c520bcff194795", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285056, "uuid": "934c19b6-4001-4f41-b138-d1a1d9a26c4e", "value": "T157B533825F700731CDFA93318DD6A0A14964766049327D89268FBDA77DB7B3A3B1D823", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285056, "uuid": "c13933d4-4fbb-4479-91eb-de0cd05e18fa", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285056, "uuid": "276ede13-5186-4519-838f-5225781b0997", "value": "49152:6SUl6vD5DxN6HHLJ9tJ4i3fFM6BKOMdfcQIoYbkJNPat1wjAt2yj5A7hn:6SSwD5Dxk4ii6BKOMdfcQIyJNPat1wc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285056, "uuid": "405ebb23-01e3-4dd5-b51b-dff8566fc1a0", "value": 2295808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285056, "uuid": "1aa505e1-3273-4f04-abb6-adb2af5c8737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285056, "uuid": "a58a3d6d-cb7c-430f-8769-3ec3ddb4f76f", "value": "ac5772b1ea2ad3b73dc07b085a9454eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dc9a50-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713251804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251804, "uuid": "d34bb7bd-216e-4626-a388-8c1793ea0a0d", "comment": "Malware payload (AgentTesla)", "value": "a5f4c52625b5ab9c78faa0bb70929813", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251804, "uuid": "ce7d8748-1cb6-47eb-bfbf-f2fa24559acd", "comment": "Malware payload (AgentTesla)", "value": "c2de6c81a5bc4a97ac8e34adb89a14885bfc91bc284550221d865f335f575214", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251804, "uuid": "6af4fa6a-77ee-48fe-a48e-261dbd2c1578", "comment": "Malware payload (AgentTesla)", "value": "933bffe323d4e2b9b447107ec57c98eb64b3efc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251804, "uuid": "5d6f130f-d45b-4de7-bda0-62c3a52ea3c3", "comment": "Malware payload (AgentTesla)", "value": "299ae439adf033964cf2d76250605cd876cc87400ec36653c1d1c8e313588672f6d982248f110c8146fa39b0e147cbde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251804, "uuid": "d684d8e4-15e0-4962-93e4-ac219eb3c256", "value": "T1B0C49C84DA8456A1DC1CAB746A37CD3942237DADB874A92C28DE3D273FFB2D35026417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251804, "uuid": "819d7590-562b-4400-a1e1-07920c8eb4f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251804, "uuid": "72c33a64-a419-460d-ab77-2d5bd82a9b03", "value": "12288:IKCAJsOwuIskh7ROzBsm95j/uCNS8hMD2bTP7r9r/+pppppppppppppppppppppr:EuIsu7b45bhhMD2bT1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251804, "uuid": "fea72562-f0d4-4be7-88fc-4e51c1edf45b", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251804, "uuid": "18960bf8-67e3-425d-90e8-26eedc742943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251804, "uuid": "fd191746-2bd1-45ef-a272-dd7dbefa5bf8", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b7b734-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713234027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234027, "uuid": "a2a4224a-a84d-462d-8693-291ff0487949", "comment": "Malware payload (Gafgyt)", "value": "8b1f2fc2d5194c66e8551482471f9b61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234027, "uuid": "d32d0c2c-d114-447d-bf8f-79a663be9985", "comment": "Malware payload (Gafgyt)", "value": "c3711704d3de46a8ece5c6520f061c026ed4c8050c704fc039f7f3ab6d8653e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234027, "uuid": "6c913e79-120f-4590-8045-9cdedeb6dde4", "comment": "Malware payload (Gafgyt)", "value": "9aa92bed3e539fe09f41e7a92909839aeb7dcb4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234027, "uuid": "1656ddd5-a43f-4af3-8ef8-d12d054f68df", "comment": "Malware payload (Gafgyt)", "value": "d716a291bd28947ba1aa541cd4748efdb6eea4aade3edcabe5dbc5391c1010dd3bb24fb16e9dfe88cdaae7ea9f4c221b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234027, "uuid": "02e78ef1-f97e-4aec-8d3c-12ce6a021717", "value": "T14EB32A17B9528B02C1C215B6FB4E564976136BFCE3DF72128D249FA03B874EB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234027, "uuid": "1cf0ac35-d683-4fe2-9103-6d484531959d", "value": "3072:Bm/PVzkcNC0aNV7YiXRAZgsj54N5hFWpbhr:Bm/PVYc00aNVMiX0jiN5hFWhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234027, "uuid": "a40d03cb-24bf-45e4-9c11-63e127246b8f", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234027, "uuid": "3ff2fdaa-c7ba-4d58-9321-9bf96ce2eaac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234027, "uuid": "ea0448d7-1337-4d12-b915-df42aba04632", "value": "8b1f2fc2d5194c66e8551482471f9b61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bf6a35-fc10-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713285830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285830, "uuid": "c79a6324-3a6c-488a-9c9a-d21ee32dba91", "comment": "Malware payload", "value": "022c88d27353966746e0f14c6292478e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285830, "uuid": "21748e60-ab8d-4ad7-96cf-7b56fefd67f3", "comment": "Malware payload", "value": "c5aacbfb27e13d5feb61236f39933c895ac5a2bd7758bdf96f4beb71ce36c2d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285830, "uuid": "30eef61c-3dd7-4749-9ac4-ac7307349949", "comment": "Malware payload", "value": "474554ab631589ebff4fad305c46c814012b96de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713285830, "uuid": "f3ef63ba-9653-412b-9635-9107fd6d4c0f", "comment": "Malware payload", "value": "89b1ac6c2cea91d016dbf1b8da0824fd02df17bd6ec0c154c4b55430fb9db96f95218aaa65dce67b52c44e3b581cd85b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285830, "uuid": "467b20b3-156f-4413-9ac2-d77575ec5588", "value": "T1ACD633AB108336E0A582BD30972EF8E4510A39635F9A74B04D5BCDD5893ADE2F3D2747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285830, "uuid": "8ca04f1c-ae19-4659-a21c-04dd18047165", "value": "72eff6af045097935e4b93056312993d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285830, "uuid": "ed498c83-097f-45f1-97b6-f70f03f0f8fe", "value": "393216:aVVYwxWklU0J4p9VXnl7XnEyNrNesu6QORMec0OxvRlrLtsaHq8g8W:MYw0U6pHXnlrnEydTOORMFHlrLtrHqdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713285830, "uuid": "02789994-be51-4117-bb4f-12d3caa1b1fe", "value": 13338608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713285830, "uuid": "365e3b8d-7bd2-4722-8af2-b4d32db6b150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713285830, "uuid": "615f7432-7f37-4a20-82c9-d7d171a0c2fe", "value": "SecuriteInfo.com.Trojan.Siggen22.44176.111.24820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e7c811-fbc1-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713251858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251858, "uuid": "6b2bc3ed-fb9a-4d54-8c0e-d80114b48e47", "comment": "Malware payload (Formbook)", "value": "2c430d35e36d912bda726e384615c0e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251858, "uuid": "a92bde6d-68b9-4e10-85a6-e79a0956687f", "comment": "Malware payload (Formbook)", "value": "c5e3dc39412f2f8efb97c3c6bcdc235727caf646ee2ac7c23e77c11ce0783e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251858, "uuid": "be4780a8-f0a3-4109-88af-9f0d565bc9bb", "comment": "Malware payload (Formbook)", "value": "84793fbd7b355eae708f3fbb654b6f67c468effb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713251858, "uuid": "986af5e9-e910-4b85-bb2e-88574fc9bb09", "comment": "Malware payload (Formbook)", "value": "c25998d6a50e4248cab8bcf7eec316cb21cb0e82cb98bf07758abb1a11d70d9a69131825e3c1295df01493270f6940f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251858, "uuid": "700c5cad-a46b-4f73-bb45-b629b7fafb19", "value": "T1B8052260F99194AFCD112DB204E3FB79F6BDED432D128D236B153B9FA93CA446909603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251858, "uuid": "9d92a8f4-23e2-460d-aef6-5f4a0ba69f22", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251858, "uuid": "629d231d-438c-419d-b537-8ce2c28cacb7", "value": "12288:TOyBItc6c4ASOSjM0rp7Z3lYFNiooPsND1kz7FgCa2+mSP2iYZ367TCIhhDu:5W2zuOSjrrpxG9oETe7iCa2LUnCyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713251858, "uuid": "586fc433-6c3a-4ac1-8d1a-b8b0f9fe6e60", "value": 803880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713251858, "uuid": "59acdf6e-8313-43df-8d18-2304b2b497d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713251858, "uuid": "b8cf2aeb-a5fa-45c7-a171-696d27ac5aca", "value": "2024041342836038.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c06a30-fc05-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281221, "uuid": "0e8a01ca-af35-4956-a646-614ddb194670", "comment": "Malware payload", "value": "e00b253eda798487f5fef2ef25164fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281221, "uuid": "4468dc27-3a80-4157-a242-2f1a40735599", "comment": "Malware payload", "value": "c60c7061f20c6cf9645da0ebf22b143913038a93d9358c2693430e1925d6114b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281221, "uuid": "6204fa38-4877-47c2-b138-184052df9c81", "comment": "Malware payload", "value": "cf2c21c845f16ed144487e9f86d8b5ba8376008b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281221, "uuid": "8d806500-2d03-4626-af19-355f5b8aa480", "comment": "Malware payload", "value": "06154aecf91f2b4a62b27bd7ffb924a6c33c7c9ef2b60b4886c098df5cbf21ef7ab7d217cdfb1e4b857409588933ff44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281221, "uuid": "7171abba-adfc-4022-8831-0987c0ea41c4", "value": "T1E7C3D6CD2EEBCA52E03833F90BA8D3599699C4431D8CDC1D0E9E5D4BD0663451AEE9F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281221, "uuid": "389aa47a-a5d9-4ee8-9cc6-a57d6114dc8f", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281221, "uuid": "aa2c3d6d-c9a5-4f93-9a27-cf2ad88ee6fe", "value": "1536:duokBZMKvOsg8ISIv47rz0D+/R/Av3coL6+9D8rbBuS7BeAXJ6xkRQsN5xgSF:RkBGWOsTIJgIDU5A/coLx9DoBRe/xK1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281221, "uuid": "482ae623-8699-4a2e-a042-2eccf5746f53", "value": 129885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281221, "uuid": "799ec974-caa8-4a0e-8794-0509f18e529e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281221, "uuid": "82559aca-6a92-4ae5-85cd-9fa7ffecd20a", "value": "e00b253eda798487f5fef2ef25164fd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dd239b-fbe4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713267050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267050, "uuid": "d76fb9be-23f8-4fa2-93cc-c9a7d927e9c2", "comment": "Malware payload", "value": "13167bb4a4963de24a29e492cfd45526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267050, "uuid": "835e5ecb-6fd0-431c-a975-5fe63f95bdc9", "comment": "Malware payload", "value": "c737ae9061f78064e29880743e165419c652e786d418fd5899cdffb3edcb97f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267050, "uuid": "d85255c9-3470-4743-99ac-800c68694672", "comment": "Malware payload", "value": "3e14131385182a1bf655a470e0971cf671f8b343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267050, "uuid": "5a58e8ee-7313-4e37-a297-ec6990e42ad6", "comment": "Malware payload", "value": "9a246ff751ed177941590a5904718af5afa57f91b551e997e0016dabe84b35254419143d439449ec1e49f963c658f44b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267050, "uuid": "c2bc3dd2-b331-4a5c-9638-79f903c35443", "value": "T16674130B5AD08C63EDB557355A63EBB6F7F293D61BC0A62783E05ACE5D93313820520B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267050, "uuid": "ba3496e4-c120-40b0-86da-af63fa92e268", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267050, "uuid": "f16f82a8-f446-40ed-85ef-14e819215b1c", "value": "6144:ye34ybt4OV75+ZPPfnE2Qyn2FEtt2NB6+sbKRr2phy9jBDW0jHPTDX+kqWr:F7VF+ZPPfnEUnsEWfXsbKop0xBDW0gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713267050, "uuid": "10c6eef7-1da2-4657-95f0-b66cdbdc45e8", "value": 350792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713267050, "uuid": "c02dfcfc-a5ad-429c-bbdb-b6198a20c493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267050, "uuid": "d2e96b11-78fe-4e5b-8687-0463844dd10d", "value": "SecuriteInfo.com.Program.Unwanted.376.2731.21530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cf5679-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265441, "uuid": "983d2518-265c-4ff2-b487-b980c6a29184", "comment": "Malware payload (Mirai)", "value": "622325806a3fa657af90cf17649a5187", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265441, "uuid": "a6118478-313a-4e44-8b32-d8ef1c95cc57", "comment": "Malware payload (Mirai)", "value": "c7c14e9473fd331f1aee6c9c25ce9fc02a622b1d1f52716df75806d11a87bc81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265441, "uuid": "2bf45736-d9a6-40dd-81fe-9ee63a6be0a9", "comment": "Malware payload (Mirai)", "value": "25c7689412ec8685cb2613745e88fcc0f4bf6701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265441, "uuid": "9f34c252-6550-4a14-8500-46abae290d9a", "comment": "Malware payload (Mirai)", "value": "bd49a78caa6da2aff7c32119badb5407b7d5ce5e706e9d81876c9f06af0c2ce912f1d017d515a2cb8fcf1b8997aad9f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265441, "uuid": "8d0e0382-65b4-401d-92af-c50b3f1388c2", "value": "T12CF329C7F901DAFAF84AE3334C530909B230B7E145521A376257767FED3A099286BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265441, "uuid": "706f3846-564c-42ae-99e3-364d844ad689", "value": "3072:93sxySsBlQtP9LtYqrvQeuacWjcW0JcWcBZ2qdU70wtT/RmVdUKLorlG8A63bii:arsButVLtFvQeuacWjcW0JcWcBoqS71V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265441, "uuid": "bcc1701d-3696-4a12-ba85-ca0ddb9a5b66", "value": 163272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265441, "uuid": "835c9af5-a387-413d-ab1c-0c5255d73437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265441, "uuid": "fc6adf86-d310-41db-b65e-fd89d08c8226", "value": "622325806a3fa657af90cf17649a5187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ae547f-fbb0-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713244774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244774, "uuid": "88dbe3af-09f1-4581-926a-797f534f2c3a", "comment": "Malware payload (RedLineStealer)", "value": "1f2e593c05e826849ec62aa712c90371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244774, "uuid": "c1327275-2ff1-49a9-8702-cc581850fc4f", "comment": "Malware payload (RedLineStealer)", "value": "c812c02d77e6a8db2e13c6d6b4082e393d635fbfc0e9d9461c45588d05c74883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244774, "uuid": "29db5958-06d6-4118-bc57-ddba6cf468ae", "comment": "Malware payload (RedLineStealer)", "value": "3f7879b0fec7fd9e4c5fdb590ae265555851d197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713244774, "uuid": "8679720b-bfdc-4b6f-a275-91496f47b067", "comment": "Malware payload (RedLineStealer)", "value": "9c39815de44fe23a70e48a43883d4a063ca83a4eabb30b7bf3d9cc75cda557629564280c033fa4ef32bd92bd96f617de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244774, "uuid": "0c633471-ae4e-44a8-971b-bb1e08a29b27", "value": "T170B51A035ACB0E75DDD67BB461CB633AA738ED30CA2A9B7FF608C43559532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244774, "uuid": "5b101486-4985-42c1-9867-f76696d62d92", "value": "db35ea5c80fc8389ab141cd45083bdd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244774, "uuid": "61d19104-62b2-468c-ae22-5407c7ddc0f8", "value": "24576:hooLgYsYk1uMawXMNIUQYMYLhQOkrF2MgMt76XAIqF1TLVLlel3RuQ55313Z:hoo8QyJ26d6XlqF1TPel3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713244774, "uuid": "990956d6-a1fc-4244-a69b-f0bf5a2cae9b", "value": 2474567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713244774, "uuid": "823faf0b-1a91-47fd-92d4-35ec2b99bd16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713244774, "uuid": "e5ecea4e-d98f-43f2-8150-4e27964b29e5", "value": "SecuriteInfo.com.Trojan.Siggen19.5563.3222.18505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5f5364-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268245, "uuid": "be7cb6d5-025c-498a-abd1-f286e2be2df5", "comment": "Malware payload (Mirai)", "value": "de08c0bddc645dc206651ba3bc4d0741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268245, "uuid": "e86ecddd-eaf1-4a93-95f2-a00af47df85d", "comment": "Malware payload (Mirai)", "value": "c98a60efa952d5564a916184a575a2a524cb2c6aa3096abe842b5bb10cdb35a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268245, "uuid": "0fb2712f-e853-460a-b642-cf5be68caf7e", "comment": "Malware payload (Mirai)", "value": "a832eff4d6f65a12a383876c6a7e356f8af9fc36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268245, "uuid": "c0a3d70c-659c-4b40-b927-4bdb1ef01a53", "comment": "Malware payload (Mirai)", "value": "4c461f557f781bda9c536f62c2e5f0dc20624d1f469abbd980e7ba662552cb1da4d96f13f5fab30555a502b16fb14445", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268245, "uuid": "aca348a0-331a-473e-82a9-d03b60e4a66d", "value": "T199F34C46EA408B13C1D71776FAAF414A33229794E3DB73068D286BF43F87A5E0E57609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268245, "uuid": "cf8b0d2d-33ee-4256-9a30-4b7429e38567", "value": "3072:YsfvqoYF/RrhMZ/fKPaC+LKWK6nTUCo4MbPbFJJM/9YM:Ysf/YF/AtyPaC+LKWdnEPbPbFrM/9YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268245, "uuid": "ba9692b7-2cac-44e2-acf1-2391654d5062", "value": 167214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268245, "uuid": "6831a9f0-c639-4f9e-aa65-57f27da84932", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268245, "uuid": "386b9f04-751f-4c57-baae-adc0c93f87b6", "value": "de08c0bddc645dc206651ba3bc4d0741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad48da7-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265338, "uuid": "d7d572f9-f11d-4465-aa99-802339c81dd1", "comment": "Malware payload (Mirai)", "value": "52652d073606558d1f5bde7b049430a2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265338, "uuid": "09ecd724-0f2b-437f-9d3d-695e7a4b9b69", "comment": "Malware payload (Mirai)", "value": "ca1ddad5129834402157f34daf53cd893d795a7fe8fd7e06a6f97f071f86cbd8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265338, "uuid": "e762fc4c-72ac-45ab-8eca-175ad55ab44d", "comment": "Malware payload (Mirai)", "value": "9706737e90ca07f278e72459e8bcf83b419a44e0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265338, "uuid": "9d5029ca-a0ed-4035-b632-1f03b041fcf1", "comment": "Malware payload (Mirai)", "value": "f420c9e14388ffdb3c029c077b42e08d0eb22585ba662e71cb6d638e96d1fbce6f5c3de996fa34281a1f0bf9af8aa4ed", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265338, "uuid": "82a3aa58-8562-4c11-ac76-9971a3263834", "value": "T1AE035B17244980FEC9AEC2F4975AB519E677743F2356B208B7ECB9232F9ED112F59100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265338, "uuid": "a2c0a4b2-d0c1-4f90-b9ed-4ea1a66738fb", "value": "768:hiIfd48YPzjoOTM37v4oImDSDi51Lb53LTkwIV:28qjdTY4oImT51LhAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265338, "uuid": "e01271ec-cf5f-46c8-b150-f5ea8904de47", "value": 38896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265338, "uuid": "29c424a8-a927-47e1-b75d-dc55c97b2dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265338, "uuid": "aeefa6bf-ff29-4e8d-93e9-7900f09868e6", "value": "52652d073606558d1f5bde7b049430a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcaff8a1-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265368, "uuid": "fbdd55d1-5f27-4ced-a628-79c0f5a01c85", "comment": "Malware payload (Mirai)", "value": "02fdf7c51bba863848d3b9c6580f4fc4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265368, "uuid": "677cb85f-1cd3-415a-9b91-fa844328e1b5", "comment": "Malware payload (Mirai)", "value": "cae7700a5a2c7b6c78ac93a82b8c754b7d8b4ec1b39a0154e35aee2b53891b7e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265368, "uuid": "3aaf731f-1706-4ba9-8b09-854bf994d574", "comment": "Malware payload (Mirai)", "value": "9a62bb257d2a40f1d10c2ba6e0def630ee8d2bb7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265368, "uuid": "bfb21256-26a0-4b6b-b104-ab420d435620", "comment": "Malware payload (Mirai)", "value": "9ed8c6f8e2e3d160a6fd6ccdea8e47275799e54c9c1f448c70967cb7eb848ec1052b6883ddc55b69aa8a8148ee17df4d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265368, "uuid": "019f3205-9090-4342-a49a-782e05a9fae9", "value": "T190143A0775C580FDC8DAC1744BDEB93AE933B4AC1225B17B27D4AA225E5AE311F1EE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265368, "uuid": "34b1e3e9-1cb6-4cf1-bf9d-cd5758093256", "value": "3072:S5CltdsX1viyo+twvk828SK2JE+VtiQ/Mp0wBC:S5CJsX1viyo+uewVHBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265368, "uuid": "3a8f57e5-1596-4abd-bb35-6f73fd0907f2", "value": 190544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265368, "uuid": "1e56b87e-253b-45dc-9846-557f6be79919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265368, "uuid": "eb3742dc-2a27-4c26-be20-3d1d06dc3635", "value": "02fdf7c51bba863848d3b9c6580f4fc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406da8bb-fc24-11ee-a120-42010a9c002e", "comment": "Malware payload (Arechclient2)", "timestamp": 1713294312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713294312, "uuid": "5865617f-02be-49a4-984e-f66f22c01775", "comment": "Malware payload (Arechclient2)", "value": "425dd633a5ed02e10cc255cb017632de", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713294312, "uuid": "d6dd8c90-8689-449f-bc6a-c7b209cd7132", "comment": "Malware payload (Arechclient2)", "value": "cb964ce3ee02dadefccd9b2392181ecef1bf4c2cae650c75caae0c7c133b5a03", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713294312, "uuid": "64808748-e956-42c8-94ec-0b9c9f7fe244", "comment": "Malware payload (Arechclient2)", "value": "c82aa0fd7f1de29a28e8c6a618d34cd408869add", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713294312, "uuid": "a56dcb43-950a-4784-af95-90f4c8d728ea", "comment": "Malware payload (Arechclient2)", "value": "ce0aedd77dad1a6747b0fbff30e089ab691c81935f3c703d6e10013782d1436a4b0f000fca529d31d748cbbcb83c8925", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713294312, "uuid": "18d5e9d6-eaa9-4e39-a1fb-279fe6729f01", "value": "T121055AFFB64BED25FEE837FC48FF5C4842A552A79591420B088C88D01FA536E8749AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713294312, "uuid": "efc1ac37-ffc1-401d-8660-dcf82b7db21e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713294312, "uuid": "dc9b08aa-5ec1-4b49-a9af-3299e35ed7c5", "value": "12288:CvAzqb0aVcdzBEbk+ZFtHcwnS714VxE11xtMuxU3to:CIzqb0zpBmZFEh4TE0PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713294312, "uuid": "dc48aa05-4427-405a-b8a5-9ad872dfef75", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713294312, "uuid": "a2637694-bf6e-4ad1-a121-882bb00e168f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713294312, "uuid": "ad6e5c57-9132-4b41-87b0-b6890f6d1740", "value": "425dd633a5ed02e10cc255cb017632de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d904bd11-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265362, "uuid": "ee7f836b-d88c-44d0-a32d-44042eedf0a6", "comment": "Malware payload (Mirai)", "value": "2f91369500829c7bdf972fc408fe1ad8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265362, "uuid": "49f4dc06-00f7-4ed3-9106-1a5c64f36b23", "comment": "Malware payload (Mirai)", "value": "cc86cf1378aa44a0898d4ce7206ccf239296d2b7055a98111d45c51d51c3354b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265362, "uuid": "42090dce-3886-486e-b228-138e68e82422", "comment": "Malware payload (Mirai)", "value": "e8e09730cac941135cf44c4addeab0e5720779ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265362, "uuid": "f18d481d-c955-4ec8-8dbe-1453a039b1b3", "comment": "Malware payload (Mirai)", "value": "847f759dfccc60692cc5ca442b2d87fa87ab5f253dc5fc9645e6b38ae5fd50748c3f2e5dc15fe9d8fa48628edc187249", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265362, "uuid": "6e8fa627-f801-446c-b993-1b431cd44355", "value": "T1FC63B51A2A229FECF26D823147B30F2567A963D523E1CAC0D6ACC9051F7074E545FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265362, "uuid": "3717db44-8de7-4912-8b36-bfe8a56149c8", "value": "768:0HliyJ3MyuV11AOOgQcwOQNpX5NbzaLW4yhmmD2jbcYRaDs5sAIne2Zw:ps3M7RVjQfX5xaKfsSDsL06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265362, "uuid": "4ff7d271-d1ca-4951-b447-728246f65e13", "value": 68288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265362, "uuid": "fb8d47d0-e88d-42ef-996c-a5d24229ff06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265362, "uuid": "36b6f204-a294-4576-8e07-c8b006187413", "value": "2f91369500829c7bdf972fc408fe1ad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b5b3ab-fbea-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713269680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269680, "uuid": "0bc6387d-a200-441e-b873-34448b5a17c4", "comment": "Malware payload (Formbook)", "value": "271bed3b2972f11259073f7e3cde6bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269680, "uuid": "113c3959-d05b-4ae3-af81-68ab8f2b03c5", "comment": "Malware payload (Formbook)", "value": "ccadaf700c4557efd158b2578d62710414c288b13d1c7a1eec1b06957ea8837b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269680, "uuid": "b307adbd-9f34-4255-8644-27a0d92dc7bc", "comment": "Malware payload (Formbook)", "value": "f944ac33a1fb6d0b1fd8a97147487976a1b334c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269680, "uuid": "b99cd74d-febe-4e85-b09d-c599483861f6", "comment": "Malware payload (Formbook)", "value": "e02258f3e50518b42144bda7442ec06938c31626a059998ad3aae9611586ef85b17440f2d6ceac0fbf2034bf78f0458d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269680, "uuid": "8e237159-c4e0-44e6-992b-6099951d2ab6", "value": "T13FE40204B1FA6F59E3A907B16A2068145BB765FB5132E30B0FC290D72936F845F81FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269680, "uuid": "2873d6a6-5ad8-4a7d-8995-2ac5c71e82bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269680, "uuid": "b7bc7256-247b-4449-8339-61ee4e44fac4", "value": "12288:xAvIPc9MUWeQRfMIqaBwqKEhcEvGR7yd4Cz3ARSteRM:xAzWeQROS+R7ydlbAgcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713269680, "uuid": "65615f8a-6ba7-4646-bf5d-5fcb7601e8d9", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713269680, "uuid": "303c7063-e640-4a67-a7d3-610e3d70277d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269680, "uuid": "fd71b6c4-7fd6-4670-a2d2-8bb4496514be", "value": "NEW QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f681b82-fbb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713246609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246609, "uuid": "2a28f340-7034-43f8-abc1-bac8c7639162", "comment": "Malware payload (Mirai)", "value": "3b38a9a26166d187061e2e1b4c0afecc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246609, "uuid": "b3c7ad59-f9a3-4fa1-9db2-1b94cdacfdcc", "comment": "Malware payload (Mirai)", "value": "ccdbb11087e6c56adb0ab1893a684af1fd5ced27dc9ff2168d4baa20413b3e4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246609, "uuid": "a768616f-de5c-413e-bc6e-e4b820f9f52b", "comment": "Malware payload (Mirai)", "value": "5bbd05695b87bb520096902a717456c404c9df97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246609, "uuid": "fe15d01a-bfc4-4729-aea0-497a92cbc3cb", "comment": "Malware payload (Mirai)", "value": "b45d82d6cd16c65d3d821c96b5e0828dd46633c387643147bff2ed83d0d398c5d791a1de48ab3cc43e39d9587b34e8b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246609, "uuid": "2b0131df-0f78-46ba-80ba-f81919fbeed5", "value": "T1B8D31845F8814F13C6C652BBFB4D428D372A17A8D2EE71039D216FA1378B96B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246609, "uuid": "8a731530-4135-4564-b005-62bf6f97487d", "value": "3072:pFUodaAhw7QdQGxkevdLrKFvsi/74QvKj7jPn5pB:9daAaQdgevh2siD4Qg/5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713246609, "uuid": "4800da29-645f-4f06-aa55-606ee311cf94", "value": 137448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713246609, "uuid": "f91bc419-ff2a-49bc-ae3b-1f2fc54a52d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246609, "uuid": "509429c9-a4ce-478f-8051-64721616341b", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0465327-fbce-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713257590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257590, "uuid": "7c112ab8-0130-47aa-ba8e-8d9625c64257", "comment": "Malware payload (RemcosRAT)", "value": "3bef3aa08aadabe44e59fbd300436816", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257590, "uuid": "f3bee260-0398-4eb0-ad66-6e4be53dab63", "comment": "Malware payload (RemcosRAT)", "value": "cd3fc3c2f568078a39ef90d27ef4d5d05802320453bfd4f26f18660ff737b60d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257590, "uuid": "96b448f9-dbb4-4c46-87ab-d61d88d81d58", "comment": "Malware payload (RemcosRAT)", "value": "7f08a811df938e086e39b11752602035a198e1a9", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713257590, "uuid": "1d5f136f-6c65-4ba0-9c7d-16e2a49f0424", "comment": "Malware payload (RemcosRAT)", "value": "3774ac0f4ecdb5712b87e834d57af1ec1c1eb8573fa1b624a7c21c16840611e4a18e836da1bb523f8d79ca4db61fc2ee", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257590, "uuid": "0267a302-eee9-4ce8-84a7-1d875ceb50b7", "value": "T1ACA42357E8D18AEF8A4BF6F6846CAD8D704CA0967B0B0DC64398257F277DF90B412472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257590, "uuid": "f73eec99-b797-40d8-88bf-10af013cf70d", "value": "12288:IR55D2rnCa3Ik1tPkY7nnvdD5rAD2MXr3se2J:UHaYkTkY7nnTkDDXQeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713257590, "uuid": "3e383bdb-7c95-4e54-8da4-b524a93b3684", "value": 490557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713257590, "uuid": "0132563e-61c8-46cf-a426-845009f94c82", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713257590, "uuid": "cc2ad7a7-16db-4826-a16b-4cede698e463", "value": "Quotation .tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d366369-fc15-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713288025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288025, "uuid": "d4c9a215-6545-40e2-84d3-0b4b6545c9b3", "comment": "Malware payload (PureLogStealer)", "value": "a80d1dd7e3e4f6b406be00284f475910", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288025, "uuid": "76ae2fe4-ea18-4cf5-a9dd-eb721756a82f", "comment": "Malware payload (PureLogStealer)", "value": "cd683458cadb68cafe3e4c90557108f56587946d292a359976a98443706ed93f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288025, "uuid": "f7e2f7e8-71e7-4a5b-a9c4-02ee529dd958", "comment": "Malware payload (PureLogStealer)", "value": "2af6011c5395d645d60af28ebedba157bcdf6cdf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713288025, "uuid": "48317a03-d667-452f-95e9-31aa037c7955", "comment": "Malware payload (PureLogStealer)", "value": "b50eb21149166bb69e647d863606f46997f0875d9c3db0de67363469272fde0fa1c9db6e6a0e7080ac7bf907a1aea388", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288025, "uuid": "705a7263-b833-4c92-a328-0fbd7f39acde", "value": "T112D423E86FA2FAD7C485F1B13499ABB4ACE5CA0A8BCFCC0542C0E59F1D755905C4B0D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288025, "uuid": "13161ced-cdf4-4498-beed-ede91057e717", "value": "12288:bJjW98bC4YVfajxZhDl8cje8rsWzxygGc3s8Mhdt+/XPSJSiU8I7WgZCU0MuJa6:tWiJGfatyA5vrs8QgfASiUhKgZ4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713288025, "uuid": "9f7d843c-460f-4a23-8e6c-4f06885c56f5", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713288025, "uuid": "4de9e880-2f90-41ab-b190-51ad27b262c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713288025, "uuid": "ea6399dd-4f91-43aa-af3a-f191ec1f29a0", "value": "a80d1dd7e3e4f6b406be00284f475910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a8d0cf-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268199, "uuid": "eb5503b5-4f92-4322-93ad-d0d8552dfcb2", "comment": "Malware payload (Mirai)", "value": "fffb13d26dd72fa510cca4969bc02130", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268199, "uuid": "24dd854a-1d20-4c66-a731-fb80730b43af", "comment": "Malware payload (Mirai)", "value": "cdf31429628b090edab2acb0e432e0f8edc51d68c0aea9646be34f50d6e367a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268199, "uuid": "fafbf0b3-03cc-4c93-b8d2-db798c978400", "comment": "Malware payload (Mirai)", "value": "3c86d281ec9e58dbcc63adc2b2223ea8b3448dfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268199, "uuid": "0da34fdb-be21-4a5c-8deb-fe703f92e0c0", "comment": "Malware payload (Mirai)", "value": "98f6d6f6cb419c1087f2793e992b1850c5704bcb6e039234c47ee1276ad52275d9826a1a2811ed47ae02ea48ebc71bdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268199, "uuid": "ecb8ed82-041f-4370-84fc-4f20204a74e8", "value": "T17E438FB2C8B96CC0C25845B8B6298E785B13F1049A736EF58B598BB5600BDFCF5093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268199, "uuid": "0011ddad-d50f-4435-9022-2280aadf4c88", "value": "768:e/1eegUaraeS56/w86Wbwti5Yqt2eeJwfUiEgE43B4R5kh+hCxVCDoXa4ACv1aNv:e/0T9NmNWbwtia/wZE3RA+hCHTq4ACv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268199, "uuid": "9a988143-ae38-4c2a-bb5c-6985ead226c5", "value": 58180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268199, "uuid": "37614617-8028-4457-8ece-3f43b8f54fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268199, "uuid": "c25eee0d-5f4e-42df-8283-2fe82c4ba8e0", "value": "fffb13d26dd72fa510cca4969bc02130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc43e8e-fbc6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713253911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253911, "uuid": "4b7e139f-8568-445e-bc9e-4100596e96fb", "comment": "Malware payload", "value": "19e0c6d99f095d8b5fb711d61a7c6b68", "object_relation": "md5", "Tag": [ { "name": "delta", "colour": "#479786", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253911, "uuid": "04f61e76-5ca2-4fe7-a720-b63525980deb", "comment": "Malware payload", "value": "ce108e9febf8abd56c161a1070391cc4c62d0607772b1c5aaa1996563a78fee8", "object_relation": "sha256", "Tag": [ { "name": "delta", "colour": "#479786", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253911, "uuid": "65c8a9cd-8775-4e39-b234-82360408c48a", "comment": "Malware payload", "value": "a0fd22bc5d649458166d9b00c798063551955e79", "object_relation": "sha1", "Tag": [ { "name": "delta", "colour": "#479786", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253911, "uuid": "49059bc9-b539-4752-8277-1482d6bf6b6c", "comment": "Malware payload", "value": "2a8ec163f8fc19542cdce93b8ac51f43e979144f77922cd888fe5b76efcd3b057951a29e7c37e8d01f268b3066cccdb5", "object_relation": "sha3-384", "Tag": [ { "name": "delta", "colour": "#479786", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253911, "uuid": "4a8f5203-1fe9-424a-b198-fa699f9185c9", "value": "T15CB523647BA10DF9E8B7C23989965A06EAF53D520720D78F47D082AB5F633E09E3C711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253911, "uuid": "d4d100db-fb4b-48e6-a272-51023faba045", "value": "e4fad3d8447a7ce2c7526a030d0bf6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253911, "uuid": "03cc806d-95be-422e-bad7-fd8704e02ee4", "value": "49152:AEKM7aXyo7CNCapsHZUbi6jClh5SLxvFXrfefEnws1PJjnz4CYWD:jKM7afxapjbiEClPS7XrzwsVJbz4C7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253911, "uuid": "3bb462ed-1095-471c-abfc-ca8be54e3bc3", "value": 2381304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253911, "uuid": "62c27651-63e2-4b79-b3c7-78574e7f92aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253911, "uuid": "fbb87e0f-3d0f-4aa9-8d68-b7a85988c653", "value": "AS_Delta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd837d30-fbfa-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713276590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276590, "uuid": "a8f57065-48e7-4c44-8f20-b5159c43a7c9", "comment": "Malware payload (PureLogStealer)", "value": "6a0c9fe08e3f92c11471799549045786", "object_relation": "md5", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276590, "uuid": "33e7c03a-ea3b-4864-a9dc-6d11e7622e8b", "comment": "Malware payload (PureLogStealer)", "value": "ce3e5610916383ef51874b86926f2fb5a21637f08ef1cadcefa1f67c578c449f", "object_relation": "sha256", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276590, "uuid": "efe69b44-0357-4852-89b4-d93a5acfb005", "comment": "Malware payload (PureLogStealer)", "value": "4c7c9d650d666812901fcda6d439d1b7880c3f8e", "object_relation": "sha1", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713276590, "uuid": "e379ae83-d970-4728-bcb6-5517fb4b9859", "comment": "Malware payload (PureLogStealer)", "value": "6aeb6ce1a122cd0c1c3ba863db7fbc8fb846063525942dfbf1e0dbb227c814c502ee18885c52c9f8512f570bdb6c2d09", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713276590, "uuid": "37408a07-00cd-4899-a9bf-c01063954e67", "value": "T193E633BFE1AEAE484470571584F884F8A46483F946B1349C745EC730EA71DEEFC2A936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713276590, "uuid": "902a8855-9b1f-4442-88a1-37282b86cce4", "value": "393216:V/EAY8agqiFPY4Scoa6AX2z7QL6PFSnGoCwE:9PY8Bc4kxAGzMVGoCwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713276590, "uuid": "8f29ff80-227e-4243-8191-4ee456186c9d", "value": 15211479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713276590, "uuid": "faf57236-b8e1-4704-8822-9f4b9ab1ef88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713276590, "uuid": "23edeb78-a328-431d-a61e-69fde92d625b", "value": "6a0c9fe08e3f92c11471799549045786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dff095d-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268162, "uuid": "38bd58f3-2501-4221-9f4e-d0fa12c29c20", "comment": "Malware payload (Mirai)", "value": "412ed0dd20bdb25387ac21a52a4ca602", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268162, "uuid": "32a0166f-2aa9-47ff-9a92-58d2f454008e", "comment": "Malware payload (Mirai)", "value": "ce9ff37dfb2341d0bcf015c78986c17c7530bc2a3708d310450fab1987ef54e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268162, "uuid": "0a28b29e-59dd-48e9-8ea2-6d707ddbea01", "comment": "Malware payload (Mirai)", "value": "b14aa3e95a602542f1daa665514d56f625340b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268162, "uuid": "d0edb48b-409e-4f89-92aa-0acf6a7794f6", "comment": "Malware payload (Mirai)", "value": "1246fe9aecfa728fa94a86290c7b55046d52ea759276663ead94a9da608dda0639e5e255f6611e1befbf7c9d4dc6f859", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268162, "uuid": "bb90dc13-9a69-49ed-876f-2a260e9ea284", "value": "T16B535B24B8B92A13C0E4B53A12F3C719B2F6234D35A8CA6D7D360F8EFF1865065535B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268162, "uuid": "a2a4ab72-e986-4674-9115-e1b34bb7adb5", "value": "768:47V07Oaa6JoMq9ujtFSbNMzWZ2nWl8kE62j815CQecSr+9w3oO+VEPRxvNe1:wV0laqdSujtFSbkWZ/1E62AGFiCpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268162, "uuid": "65efa236-c8df-41e1-941b-b4692003350e", "value": 66388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268162, "uuid": "5a531e2a-db67-4e3e-902e-f5286dda4d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268162, "uuid": "2bd63ff4-9b4d-4336-b946-bc6b48c7967e", "value": "412ed0dd20bdb25387ac21a52a4ca602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7ceab2-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713248619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248619, "uuid": "2190f90c-ad0f-49c8-b81a-6acb964454ff", "comment": "Malware payload", "value": "37f88c0c0c516d2d42b6c97d1bc31fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248619, "uuid": "b7d88fd5-2b92-42a0-8a35-0b27d51d0d9c", "comment": "Malware payload", "value": "cecde7f77b6d3b25e5314cea9f272dbe2089e65389b3bfd4c2de5dfd1a09fab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248619, "uuid": "3d2294fa-d8a6-4e23-9aa0-82aa074ef98c", "comment": "Malware payload", "value": "8b4a4e8043ddbf88b3b2d1ea6335ab6b8a7493e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248619, "uuid": "95cc31e0-621e-4764-ba70-f538db6dd3f9", "comment": "Malware payload", "value": "157f93f54572ade523320b8ba1db1288a9d3cc8b5db98425894c902333e30941967096fc5f1a800428943cc8e8a7749e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248619, "uuid": "59730d44-b85c-4a95-8c4b-35c567d27dd7", "value": "T1BB08333FF146A12DD9E92B3102B792205537FE156D268C1B57FC344CCBB69B02D3A26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248619, "uuid": "ee2fba8a-d30d-4fd5-9413-a1f405b0c8eb", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248619, "uuid": "a69471bb-2c8d-445f-b795-77d739b4a366", "value": "1572864:X1nzHh4y8Z+jFNtdZl4Rx/Nf2b409luliwRbUC:X1nzHh4y8YzP4nx2bLNAbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248619, "uuid": "47549d68-ad4c-4aa9-9665-2fa43b907313", "value": 82108213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248619, "uuid": "4e7e0210-2a07-45d0-9390-a999b9a00cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248619, "uuid": "8aa46a24-d261-4c5a-a21f-c95788587d3f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea295f0f-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713234038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234038, "uuid": "a3618757-c745-4e72-994b-526d484280d6", "comment": "Malware payload (Mirai)", "value": "1d8b2c95e60dd48f259b02c3a758df56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234038, "uuid": "f7058ad7-d193-494d-bc70-1f09f71347ed", "comment": "Malware payload (Mirai)", "value": "ced86772deda4cc0cb913b0cbcde95778c81e02262b9d1d3f014f6cefee183e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234038, "uuid": "d6250d0b-fb05-4f9a-ac52-292d1441f1d9", "comment": "Malware payload (Mirai)", "value": "36a930587aa22359ba02e6f1f58ffb055dae0871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234038, "uuid": "ceea77d6-b7d8-4d51-b408-cc825f7dc26a", "comment": "Malware payload (Mirai)", "value": "f0933c2cda135aa525064e35044e253fabb33127c3b9908b7c84b3f37533e9eea4d06e406eac96b16ad0422e2755a2b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234038, "uuid": "67409f63-e524-42b2-86a4-2e32c8fab04a", "value": "T196338E22F0352D78D9211AB870659975C302AEF550D31CB1DFADB6A22427FCCFA9D7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234038, "uuid": "a08806e3-e189-48f8-982b-93e57c30d3c0", "value": "768:xT1rkNGw57fhrbQ+xbIvHwe2fmEtHh1FnoRaD41RVkPTS:xZYPrbBu/EtHJibVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234038, "uuid": "7ce6d43e-d6e9-4fd7-8c54-445472a46232", "value": 53876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234038, "uuid": "0eb2bf4f-c082-4495-a670-5c968ec7526d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234038, "uuid": "736df34d-8e43-4c51-9c73-22f20d044f7d", "value": "1d8b2c95e60dd48f259b02c3a758df56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064fccbc-fbb9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248258, "uuid": "f65e5650-999b-474c-a4e7-bb6efc7fb1b4", "comment": "Malware payload (Mirai)", "value": "3e79fd56e705192635db77782ee6d2c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248258, "uuid": "569378f2-39af-482f-9386-bf9ac4d55387", "comment": "Malware payload (Mirai)", "value": "d01ced5176ca9cca12f8435b855e62b81a1816e203dec6c2bd802d4f757a00ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248258, "uuid": "1de10797-92b7-47fb-9291-2c37a31e37df", "comment": "Malware payload (Mirai)", "value": "2c7bd6a8235649f5159384f8433c046711a6ab36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248258, "uuid": "80af7f1e-1038-425b-ab48-ec27dc7e10e6", "comment": "Malware payload (Mirai)", "value": "b3c62b348a1b5b178a180d9e8a86f0531a88d5d971762fe81dfd99a2824ebbc02d02735f894fcda707a02f19af8979c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248258, "uuid": "ac1916de-ad3f-42f8-9cda-c0e3b163e2b0", "value": "T19514D81AEFA10FBBD86BDD3702D8074139CC944722A57B363578D928F54B54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248258, "uuid": "bcca2b81-c5ad-4f26-9638-9fad77f9059d", "value": "3072:cyoAZDfkvljYKHCaaQHDpYInh5H8WeYUVteJ6Z2p:ZZDfc9llYIh5H8hVteJo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248258, "uuid": "75e52a79-125d-430a-bf3d-0addaeea10f5", "value": 193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248258, "uuid": "f38bd162-dfc2-4e1b-98d7-e17b319322a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248258, "uuid": "add190c3-1e8f-41e9-9e91-41211a57f815", "value": "3e79fd56e705192635db77782ee6d2c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65055bc-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265358, "uuid": "b85d2ab2-2d5b-4bfa-b883-76db6358b1c4", "comment": "Malware payload (Mirai)", "value": "ea716bc88aea38f4d4bdfbcc63ec6d5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265358, "uuid": "80bfbce0-ff39-4126-9c3e-6e92a3533172", "comment": "Malware payload (Mirai)", "value": "d0867bef641c33a55547444db3611cd2543fac3842b3c2c2a024698a142c801f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265358, "uuid": "3f0765a0-76ec-467a-99f8-0303e4c2dee3", "comment": "Malware payload (Mirai)", "value": "d7efb82efb26caad3670e64e19beb2caf2defa01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265358, "uuid": "d0d1b035-0fd3-4f10-8f23-d350355a0667", "comment": "Malware payload (Mirai)", "value": "7d64d4a57b49669b480f60850acd9137d881d0b754a6871604953540689a4acfdf6bb0c221cbcf0ce573e6b24c1ac6b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265358, "uuid": "c1b66473-e896-452b-95db-63f06d84fdd1", "value": "T1B2034D41B30D0943D2632EF43A3B27D1D3EFEE8021E4D585A50D9A8AE1B6E315396DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265358, "uuid": "6d2664a8-2ae9-4168-9ca3-7e4cad92012a", "value": "768:hIh7JpClN91FhSQN8UHPZcgKzoF+gtp/Iu:hIhD2z1fSe8YZWzHgb/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265358, "uuid": "96a86c4a-7f38-462f-a4a7-fb9c33613aed", "value": 38904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265358, "uuid": "44b5b119-fc9d-4e85-aa5a-196344d0ecb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265358, "uuid": "614063e5-f056-4557-bdd8-196a1aaac825", "value": "ea716bc88aea38f4d4bdfbcc63ec6d5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b254d0ec-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281618, "uuid": "0ed6a443-1676-45a5-899c-150ca466a004", "comment": "Malware payload", "value": "e43a2ce8b01b932cabe3dee207addb4a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281618, "uuid": "31b6cb00-b968-4888-a9c5-93bbd811b16e", "comment": "Malware payload", "value": "d13ac8a25a9e3f86b3782dac12309ef385e7164a93007e5d91f1139a5f712cf7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281618, "uuid": "9b3fecff-4f68-4137-aa86-ab70368bb813", "comment": "Malware payload", "value": "14a709b7218539b045c28794fc90f9a45a147b2b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281618, "uuid": "563a7a5f-b12a-4c6c-b9df-093872db8b79", "comment": "Malware payload", "value": "1b3d0a1bf6b45159c7e2f16f53dc8b87d6d122bd1b478dd6bda7ad3d110a19174594dcf9c08f00596d795a269b2bb460", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281618, "uuid": "ccfb2bbf-8e08-4248-bb21-6f253456ae19", "value": "T1E57418E3CAD526288A461AB7ED234B734DB4415D33131E3897BDC65DA08399C82BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281618, "uuid": "4f5f5ad0-0215-499d-b536-f31a3e4fa3bc", "value": "6144:SIULaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPF:3FInOiV+/q3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281618, "uuid": "37616525-f527-40b5-a6ff-123a5ff8ab24", "value": 370773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281618, "uuid": "09cb45cb-a50f-4058-81d7-45cb3034cc78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281618, "uuid": "9a919b99-403e-4267-ad10-5ce61a25f5b2", "value": "RFQ #2414976\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7735d7-fc02-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713279734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279734, "uuid": "1131e6d0-5105-4000-b252-5a898325d0fb", "comment": "Malware payload (AgentTesla)", "value": "c17bf2429aa2d5762a183ddfa50e6b09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279734, "uuid": "78b3c071-bfe1-4867-8ecd-581eab4ded83", "comment": "Malware payload (AgentTesla)", "value": "d2771de5bfa94a9b82ebf960006227bdeb8367f719ded9e74de6fad8f0cbdc47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279734, "uuid": "6f94a269-9ebf-49e7-a442-22cdcebc73bb", "comment": "Malware payload (AgentTesla)", "value": "4a12f5318bbf2c8b5e6bc0cde4860fb6e1e1ea36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279734, "uuid": "d5235d30-840c-494b-ab16-16a571e6dda7", "comment": "Malware payload (AgentTesla)", "value": "f6ea2a99d23c4915a24fcf81cf1314a7f21841942329757509317f5e01583d681ade17ec54843c304404f9c36665cdd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279734, "uuid": "449e1f71-cf12-4659-a5bc-f8fbd447abc5", "value": "T1C7E4231276B98362C27E4BF8E223241493F4520E917FDB5D5DDA74CA6A72F20C61CE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279734, "uuid": "059fbf27-071f-4f32-8b26-206b1d8fd3f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279734, "uuid": "77b93e64-c1b4-43ff-9f4e-a0dc14a5751f", "value": "12288:BaAvfzT370wk9pcvemOOfGZ3ZhItqshitK1cjjd6vlTg8Yglnnx6Jkc0/xh2/:0d9pOe4fG1ZhGRit02OlTgpglnnx6Jp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713279734, "uuid": "10ca5f71-11b5-4d9b-b5eb-ce1f85badb13", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713279734, "uuid": "18864413-8f62-4b68-92cd-3d14b61c6a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279734, "uuid": "466106ae-b6d4-4a0a-bd90-b1108521e4ba", "value": "COPIA DE PAGO SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824eb45d-fbf3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713273377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273377, "uuid": "f8af55af-f8c1-4596-9b26-6373717a9913", "comment": "Malware payload", "value": "8050a83ccc5fd7b13f22be19e06f311b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273377, "uuid": "b0809add-10c3-4ce0-ad56-1a27b925af37", "comment": "Malware payload", "value": "d4b56df9b902f9a74322454ca67da1354398733852c2afb1f5b44975c85d7866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273377, "uuid": "dacc35ac-355e-4fbb-964b-64bbb87d84ab", "comment": "Malware payload", "value": "64636c8038f4ba075dd1c3ebce1781db389f49b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713273377, "uuid": "19fa7e28-79e4-4864-98d0-24c87d11f17e", "comment": "Malware payload", "value": "663d50f84946916615a4f8d6e046aa052b5ddbd37d07c924c58e5edea54e12f501534135d444a7264e9bc7751c182cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273377, "uuid": "9ab6401f-9ce7-4857-bc9b-742193b397c0", "value": "T1B1E4E052761A6D9BD6BC0EF444E2400007F2AE2935AAD2C85DD634D737FA7F1B092B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273377, "uuid": "bd7dfb99-c6f0-4f9b-aa11-c0e9a1076c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273377, "uuid": "5fc3a46b-ef31-476e-9601-3c5605380c61", "value": "12288:tqOFbortz+yaEjd0nBoEDMSBgrn+nO/o5XxW0JP0zhJfQViEAmD:tqHzjCnR5gr3sehlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713273377, "uuid": "c35f35de-6630-4b72-b278-fb460251dd4f", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713273377, "uuid": "1e2c9e89-7aa9-4695-b739-f6c61214ae62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713273377, "uuid": "503f4b33-0321-4f11-b447-c73853ad5cb8", "value": "e-Payment Challan .NET.CMS4006975825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfd6721-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265421, "uuid": "b9679b4e-0da0-4cd0-913b-b991ea47a9ad", "comment": "Malware payload (Mirai)", "value": "6d06ec342bb105ae50cb4e0cf781d586", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265421, "uuid": "865cd26b-feda-4df7-8a81-cf9792b43d26", "comment": "Malware payload (Mirai)", "value": "d4dea0e8f82a3f25cf0004300f97314898d6c1a9e3b215de910fa64329f8cecf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265421, "uuid": "fea2df30-909e-4b6c-b9d4-5197c7ad1a05", "comment": "Malware payload (Mirai)", "value": "7a09be91fd59ee15eadec82400c8aa57e2a5f3e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265421, "uuid": "a39327ac-c4e5-4917-ad30-bdd4d52b90ec", "comment": "Malware payload (Mirai)", "value": "4aa17e174bdcc0c8ff4d092f233023da0123f69334752ce8504e867bbfabb3347a8dff9afbc9701adff84cd9621d17ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265421, "uuid": "986cdec4-657a-4556-8a27-3ef4c07488db", "value": "T11333185AF981AB11D5C1127AFE0E124E73134B7CE3DE73229D286B2177C796B0E3A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265421, "uuid": "65b5fb1b-c840-45b5-84ab-866a2edab570", "value": "768:AInSylcdZ4oXGNAwhaQRTfVmph5lMFL9iLjrF7CQNSqTP9wXV15hYMI:AInNlvU4HaQNQjMTiLjZ7CQzjy5hYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265421, "uuid": "099794b1-9337-4334-9bce-aeccf588ba65", "value": 54772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265421, "uuid": "671f0126-daa8-4379-8618-7f5d371432be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265421, "uuid": "985b58c2-c331-43c9-aa35-e82b1dd81784", "value": "6d06ec342bb105ae50cb4e0cf781d586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3f2aab-fbc8-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713255033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255033, "uuid": "184368b8-f9b6-4680-b07a-9ba43098111c", "comment": "Malware payload (Stealc)", "value": "9bcd53e25e928bf4312b8e99456eb704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255033, "uuid": "b86fe1ff-70d5-4956-ae4a-e3116e71c215", "comment": "Malware payload (Stealc)", "value": "d4f4d50f971d5b6814a3583f939b98c666534ab630dc01d457c055b2454fe94c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255033, "uuid": "ef8fee8d-3130-4871-9789-12417d34ceff", "comment": "Malware payload (Stealc)", "value": "1128b53f01281a570878f633679dbfc98251d40a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255033, "uuid": "b870b45c-e95c-4bb0-98ea-854b44b0f5a2", "comment": "Malware payload (Stealc)", "value": "6c85ebfa2fbb4d2b284a274b356db8d24e1e2abfef167972fca763ff86dc078f652ee65f4a269bd95944e0da1eb7c91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255033, "uuid": "00f220f0-6387-4a31-91c5-5f5edf7670d9", "value": "T1A3A4F15C7360E832D63249704E29CBE82EEEBDF3DD6D89932650A61F1D742E1D913326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255033, "uuid": "0f38d8dc-37ea-4684-8e02-3f788b80b70e", "value": "b0e7b1f470281f5f864a1cf1dacc65ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255033, "uuid": "96351a02-ccb9-46c5-a83b-6148e96bb0d9", "value": "6144:L7N7Lc13hvoeeCGhKtaBJe8U7x2TampVQzZCR8h0fbku9LuTGK:L7N7YTo53ji8U74TNpVQdCR8+BLKGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255033, "uuid": "6dda9602-6205-4a69-bd28-737d0f65f033", "value": 451073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255033, "uuid": "ebdc5874-8636-40d9-8410-4dc6b9225795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255033, "uuid": "499f9ef2-f44b-4af7-b652-a26929d2cc26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d23325b-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268215, "uuid": "df1821af-e19c-4bdf-8f20-a5a6f46e9ebc", "comment": "Malware payload (Mirai)", "value": "5a97614fe6f971d1439cc5c6c907a5ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268215, "uuid": "8885b665-fff6-4784-b2ba-d795bb5448f2", "comment": "Malware payload (Mirai)", "value": "d6b500f61c776860afd09a3290ef3d5513be5f2f6edca4e43e667789d66af8e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268215, "uuid": "75a8be5d-0f17-4ae7-afe2-0fc77140b16c", "comment": "Malware payload (Mirai)", "value": "62ea0d27c0d3fe74222676550fd8616af5d24bfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268215, "uuid": "5455eba8-97b5-4ebd-84eb-b086538ab9f6", "comment": "Malware payload (Mirai)", "value": "fa4ad3e2da19f38d084416e3c68485f7f8dd8004ebc6cd81fb5ea0eae8f5b50c152429e522a9c978a56a80559f112828", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268215, "uuid": "e6f29fc7-e5f4-46b8-93e3-0f3c424ad9a5", "value": "T1D76309B51985B3BCEAF10075F44325D528B606283FDCE6E361C7643AEFA4F087269E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268215, "uuid": "c6908bf5-89e2-4bd7-8829-c9b983d6f6f4", "value": "768:U2IbHj726e4RXz6UcumFU+tzW1IPhzmZqWBK0q7UqKLEDvNe:UtbD72603U+xW1I5zmXK0q7xKLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268215, "uuid": "74d9a64d-dddd-40d1-97fe-4ad0ed7bf5c7", "value": 66936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268215, "uuid": "24f5488f-8ef0-4dbe-8ecc-b26503dcfba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268215, "uuid": "40aa4d64-dadb-412b-b232-d181945ad4cd", "value": "5a97614fe6f971d1439cc5c6c907a5ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c3f1ae-fc07-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713281941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281941, "uuid": "131324ac-7a6c-4c8f-b7f6-7a26446239ab", "comment": "Malware payload", "value": "991704ef3544670c2ac9ff19c7f2fa1d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281941, "uuid": "f79f88b3-580e-4aee-a7d6-600a0c35d9ab", "comment": "Malware payload", "value": "d7355b9db11b3704c64d872876110471fe489ba141520ad9c61cf7e0fe8322c0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281941, "uuid": "31732ea3-b098-46b4-b6ea-ff601faba659", "comment": "Malware payload", "value": "acf25383b6940e5e3b17f13873322836fcf79685", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281941, "uuid": "26952aa4-f665-4573-9d3b-ac5c113302b9", "comment": "Malware payload", "value": "ba29d00bc0a57f41a98ada3ed8d6d6e71fffc8ff8bf150ad04d6aed8c7bed9e56acd23190bedceebe93fc7e5316cc8de", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281941, "uuid": "c756183e-155f-4023-ad79-06a7fbfc6c93", "value": "T16011ABA273F04642F1B20A376E77D2E04F317362B416A72E6492924D2DB0D45ADB9B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281941, "uuid": "73dd6195-e580-4484-a04b-83ca008fb5d7", "value": "24:8+hGKggCQSpyUL2x4I0hnMPP9LpcsrLm:8iFSdIV9Wsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281941, "uuid": "8d175eb1-be11-459f-b47d-d08b9b972916", "value": 1077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281941, "uuid": "31dcd768-cfaf-4e0e-8e7d-f53cd0a48a35", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281941, "uuid": "049233e6-5860-4c7c-bca0-3e0d2776a627", "value": "parcel_label_photo001.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844a1a5d-fbb7-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713247611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247611, "uuid": "51187ff4-a6b0-4873-85e7-cafd125e4425", "comment": "Malware payload (Loki)", "value": "e472e9d21b095e482f4c593dc8620bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247611, "uuid": "cb3d55f8-4c5e-4e51-a292-d38b160bc03c", "comment": "Malware payload (Loki)", "value": "d774bf2b69e92180e790142a000f8c2b883336e68fa52d79edc5af7278f03f9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247611, "uuid": "fd475b21-2f0a-4931-9544-37876ae6c37a", "comment": "Malware payload (Loki)", "value": "b29a8d05d42f3e290b66745a56410a929317cd6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713247611, "uuid": "ce4cbf85-e012-46d1-ab43-a8e6aa0fb1d2", "comment": "Malware payload (Loki)", "value": "014ab61d2483236ef02c91d46a1bc16aa5c4921d19e3e72b0524bd55b01158f87de76a7913f7310369df7ec76c32808a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247611, "uuid": "7cf7867c-ce85-4228-9378-7e93b3bc2d36", "value": "T125C40110E2BA2F4DE7BA47B05162682447B7B5F66532D25B1FC190CA6D30BC84B81F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247611, "uuid": "6f0da90c-2b5d-433b-b83d-9dc9cb555672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247611, "uuid": "c015d343-1246-4467-a30f-1c0402a8d0b2", "value": "6144:Ohk7wBot5gNVQkaDJw3s/NCg/9FKcDwHInAjdXxIAjT7QrV/dTr//8Fa1y+h6Sia:8VJalwcF1FKcD1nBFp/dsg4eXLqd4OkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713247611, "uuid": "892fddb3-7302-47bf-aa74-976c5603af3a", "value": 573960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713247611, "uuid": "b1dff55e-0369-448a-a6b5-6dea6d8d4fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713247611, "uuid": "ab5fb4c2-bd8c-4390-8f1b-33ef0afca1e3", "value": "DHL_Awb# 12944422091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b280deb-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281526, "uuid": "bf1ac418-8c45-4096-bfa0-b6f3f48a0277", "comment": "Malware payload (GuLoader)", "value": "bd3c3f93022350528443afb09b3f075d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281526, "uuid": "eb323239-960a-486f-94a8-71c7f77229e2", "comment": "Malware payload (GuLoader)", "value": "d8ff89b77a3f33bb759a9a2d586ce897f89b436cdd1a17218c1e861f9f9db66d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281526, "uuid": "5954fcd8-564c-4c19-a840-b83c22b65442", "comment": "Malware payload (GuLoader)", "value": "77c094d8c9c0ed3205042116392400f2f4129e12", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281526, "uuid": "2839868b-fb9c-49f5-b479-69b14ecf3f8d", "comment": "Malware payload (GuLoader)", "value": "93c13d1fc41b389684fd1dc65a39909822e8366a40481cec1a80c8ece6c0517675dec278343b4af15fdba72f0c7ed5d3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281526, "uuid": "1e6b37e8-1afe-4c49-b1cb-7fa47dbe540e", "value": "T176946D60EE68066A0E4B279EFC911A92C5BCC219462710B6FEDD074E61075ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281526, "uuid": "adbc566f-89d1-48f4-8268-0586d0644625", "value": "6144:ltrc0iH9QXg0Io+3UvFeWtBVkmZtFiDZ+xO8FD35G5BXMVYM:lFidQ04bzcxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281526, "uuid": "c51d8ce8-03bd-4f90-98bb-a7dbb2907bda", "value": 412923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281526, "uuid": "044279ec-0756-42f4-90d1-360ed0389c2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281526, "uuid": "ee9af903-0be0-4406-a4de-4165f5235fad", "value": "Shipping_Invoces_xls_00000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520d42a8-fbc9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255257, "uuid": "816fab63-719d-47e2-9a0b-a9cbaf2ed611", "comment": "Malware payload (AgentTesla)", "value": "4c1be257d7ed1e004dbf85c663ebc1fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255257, "uuid": "52372d1c-f476-44c1-a708-99406cdf8caf", "comment": "Malware payload (AgentTesla)", "value": "d9139c863119e4481485ce1e4984b3c6d8e4c1f8968a7709a9c65a564f94ddde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255257, "uuid": "c37f146d-af43-4cd1-9f75-f9c8eb039b88", "comment": "Malware payload (AgentTesla)", "value": "2a32e614985ca16f437533065aad994c81ee6e0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255257, "uuid": "08a828c7-ace9-41f0-882b-96288716352c", "comment": "Malware payload (AgentTesla)", "value": "3ee2c482868271eeef625f0c5f6f15d02250bfb209141c31d7243bea201805b2d50fe62530cc1d5e4e4178f73d7f979f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255257, "uuid": "7efa0f76-e744-4141-9e87-d641c86ccffb", "value": "T194E42352BABD4B56E3B9D7F9A015841427B2C61F693AEBCE8CC2B4C24153B58471EF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255257, "uuid": "1b1e9547-57e1-457a-9532-c9363da10b53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255257, "uuid": "57f3052a-1e9a-421c-8c97-2a07d27ee293", "value": "12288:FaAvWzT370zUBQQFnUhGO6WWDoZSqPZkwG38votYz0Hbt0kPZEoKRXqKl:tzUCQFnWCWWsMqWp3ptL/PZhKR6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255257, "uuid": "f500fa18-0b1e-41b0-bf80-1f787828e225", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255257, "uuid": "fea2b35e-6fbe-490f-9649-cd4eed2abe9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255257, "uuid": "86689aef-2092-41af-be6e-cd1fe6f0b1d4", "value": "Remittance0098876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9407a4-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713253047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253047, "uuid": "0b23c055-ae88-49c2-8f75-9ca21f611c61", "comment": "Malware payload (AgentTesla)", "value": "2c65739974d4ddc4346aa7d265a21378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253047, "uuid": "193dca47-bdc8-435b-8fb2-84cd09e90123", "comment": "Malware payload (AgentTesla)", "value": "d94b9ee70ad9ab6ba6f81c0f01565681714c56297d8d5826135c80c6cbbb2146", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253047, "uuid": "be0f7c99-a18e-4b9f-ae8f-d015c8385dff", "comment": "Malware payload (AgentTesla)", "value": "39d7dee2e1304ada056a887371d2fd0f2f31fbc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253047, "uuid": "8cd3f342-c8d4-4df3-8c98-a3496c413362", "comment": "Malware payload (AgentTesla)", "value": "36e9bfa77e2849bbe0aa6046d634b54d0fd6519a89cb2d09cdaadbd0e353f219ddcfa0d0b660bd7d45bd780e0c2c93d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253047, "uuid": "21d58eea-b5cf-4a65-8138-976661f33e2b", "value": "T13FF41214B2FA6F19EBF947F405601C244B73B8E76936D31B0EC690CA2D74B849A41FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253047, "uuid": "7b67a444-ed14-4ef9-84a9-84a855b996a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253047, "uuid": "8ca8b12b-7133-4d36-a056-f792771cc095", "value": "12288:s5h62ReY5anXzE6IEaXJNZWKsQmieRZSXakooX33G/st0LYxxH4kR:s5h6yajE6IZN4KDeRhkoRstGYxxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253047, "uuid": "4a47fe54-d9de-4182-82c7-645c0ade06fc", "value": 723976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253047, "uuid": "5e76751e-c82c-49f2-9c5f-414c731d60e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253047, "uuid": "2b0ce2a9-4426-4227-9636-93acc1fdde96", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e72528-fbd5-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713260409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260409, "uuid": "0f2c2dd3-6b99-495b-86fb-e2b707eb671f", "comment": "Malware payload (RedLineStealer)", "value": "22c44c550563220ca7ebfcfc28351b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260409, "uuid": "8fcebd83-b9d4-4329-8455-f907de80423e", "comment": "Malware payload (RedLineStealer)", "value": "d97ec62704f6714c0100506510fda9b8326814aa18612e666b98a343572d54d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260409, "uuid": "91c6bc38-119c-405e-85ef-67713c086778", "comment": "Malware payload (RedLineStealer)", "value": "5abcfe696f4a049c014d94726c975d3a974968e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713260409, "uuid": "2f52d067-88c5-46b7-b18a-eb4df2f4084f", "comment": "Malware payload (RedLineStealer)", "value": "20c0db0a67109b77dca03a56e8e1d0802688be8caec4fac17b2bff21a2d2f49cc2c2050b57e928c548351532b88ecd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260409, "uuid": "6b0bc88d-a26b-4922-b02f-748fe6798cfa", "value": "T15B051221BDC58872D473153A0AF597398E3CB9300B768EDF5BA08D6D4E60AC19739B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260409, "uuid": "a80f4c45-f717-41c4-ad00-8a4097dd7572", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260409, "uuid": "f19e4a15-1476-4989-bc0b-7eb6821a44c8", "value": "12288:Txjrr7F5qfMs8WdBd308n4sHWihcB92m4xXqNO6OVdA8ryHCz+7cbOnw2Qgd:TxLsMs8WdXk89WB92m0qiV6ixanDQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713260409, "uuid": "f1b6fa3d-ac8d-44f6-abf9-0a4c7987a199", "value": 840230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713260409, "uuid": "66038428-821c-4c6a-a65f-e406e760926c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713260409, "uuid": "3466b754-5ecd-4fd2-aa63-93e1c4a85cdc", "value": "22c44c550563220ca7ebfcfc28351b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5942522-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265786, "uuid": "de78ea75-68f4-44ce-8e86-a5255767d068", "comment": "Malware payload (Mirai)", "value": "5474a9a44d6d7ae5a5d85263caf2f24a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265786, "uuid": "ae792777-0ffe-42be-a830-5f0576e595e9", "comment": "Malware payload (Mirai)", "value": "d9d4e67653f6e9c148e6521f9756756863601faf0065bf92c151e6848fd9365b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265786, "uuid": "2f232776-5bf9-4be1-aee7-6f00acf8b8d3", "comment": "Malware payload (Mirai)", "value": "2b7b7de84923d35452b354a69b99a631fa95ea68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265786, "uuid": "726dd04b-9231-44de-be89-a062028d39d5", "comment": "Malware payload (Mirai)", "value": "1d401ccc528d67bafcb2902fe0c35011e8245b823dd0c6a39fede3d867cbc250d2b424fc111e5ed496fcf086cf0546d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265786, "uuid": "292fa69e-a40a-4ef5-9f4e-64b2b321aba3", "value": "T1B0132A32FA620C37C5D595BA71F30325F2F5834A14BC8A1A3D621E8DBF60A8436576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265786, "uuid": "1d5c701c-e791-4b9b-b152-f77e9d5066e0", "value": "384:HYwE4mnoq5UG7U/V/hur6asuzhij/qvCMIFU+prqdmtLV1pl6nXwv9fhTtZ2S/Mx:bQ5UF/V/hU5ZJIO+T5VknXwlf1tqI5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265786, "uuid": "18e243f5-6c15-47f1-a656-1191d7dec20e", "value": 44008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265786, "uuid": "15f534a6-8b49-44ab-90bb-f43b1cb53d73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265786, "uuid": "6369ae07-f96e-4300-8929-fe8599fe5058", "value": "5474a9a44d6d7ae5a5d85263caf2f24a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80edc42a-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302581, "uuid": "0794c87f-a269-4db5-b9c5-3e15f642e348", "comment": "Malware payload (MarsStealer)", "value": "f07befa95b54aa2cd90cfbbfdb9d0942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302581, "uuid": "85446eae-5366-48b1-a97d-acb0faacda2f", "comment": "Malware payload (MarsStealer)", "value": "d9f52689efae410865d403b2707f5319b99c2985aed876254141fa7a7699e7e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302581, "uuid": "04c854b5-e872-4be8-b506-c2ea5668ee62", "comment": "Malware payload (MarsStealer)", "value": "91c44a024b214e656c4279d1223a7beffeef129f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302581, "uuid": "0f0eea8e-8aee-4831-84b4-8f80d19efdfb", "comment": "Malware payload (MarsStealer)", "value": "e06b583275dfce837dd5e2e0dda94c5f4689bc80ddf9bae3d39cefbbc3a98e8693529132352067187633b127df3b57a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302581, "uuid": "8e0e1600-7a9b-4b99-a3fa-97b6d0533bcc", "value": "T169F3BFA56031952AC1F0AE7A525365B3EEFB5F7A037C850A601E028F6CC51F33F76A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302581, "uuid": "f4437a6e-b821-4afb-b924-446ba6607efe", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302581, "uuid": "e3c5a089-be10-4228-98e7-bdebe7d7bc26", "value": "3072:U9e10UN6TFbvjR8zJplCt9PZ3FS9j7JzGwmoJ0JSp8Bb8EG:D+vTFbvjGJpAt9PRF+JSwmKo8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302581, "uuid": "7ba73af6-399f-43bd-8190-2f406c3d910c", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302581, "uuid": "b7f4e810-10b1-4435-8d52-71b44d2162a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302581, "uuid": "9287b1ff-f365-45ee-a6cc-00c5e984828c", "value": "d9f52689efae410865d403b2707f5319b99c2985aed876254141fa7a7699e7e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f047ba3-fba0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713237777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237777, "uuid": "4dfd562f-45f1-4bf6-a8d9-09f37d692fa5", "comment": "Malware payload (AgentTesla)", "value": "062374dadf889baa531a6e4caada7671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237777, "uuid": "9ffaf7c9-d1a1-44e4-85bb-fe3c2c7d093c", "comment": "Malware payload (AgentTesla)", "value": "dbbec0f6437f2c3011d56af0dfa5d7d58885cf3be3d690cc17f3b8446ca589d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237777, "uuid": "4ffcd50c-12e4-46f7-99ac-d846346b0f11", "comment": "Malware payload (AgentTesla)", "value": "d8f0b7e001f3ddced675b631cd7d273331995ddd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713237777, "uuid": "4809ba1b-bad1-4a38-9d36-3c80e519ddc4", "comment": "Malware payload (AgentTesla)", "value": "246169711b2204938c612b869c9778a135ff4617d06e14f7a2a7b01eaba1615fecb5385cf43784cf0960d9a931bfd405", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237777, "uuid": "c17432ad-4acf-4afd-aa86-a9675a687dd5", "value": "T130E41285B3AC2F17E57D4BF44520641947B23A2B3574F28E5CD220EB19B1F80ABA1F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237777, "uuid": "0949c850-6f54-4aca-893b-0cc4a22d0955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237777, "uuid": "09960df0-11fd-4b96-bd38-1199bf9a3181", "value": "12288:lHntejsKTXT2wewN+wcZ2dSkUQhaFDvlqOC:vejTj2fQdSkJalqOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713237777, "uuid": "c1c1d2a9-044c-476b-85a5-865cc374e29e", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713237777, "uuid": "a536d55b-4f77-4659-bfcb-03a0ad192960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713237777, "uuid": "7699576e-26ae-4e00-9198-504f7abbc4fe", "value": "SecuriteInfo.com.Win32.PWSX-gen.22951.7290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab78460-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302597, "uuid": "3c389b8e-8682-4b60-9271-250e9f9e6885", "comment": "Malware payload (MarsStealer)", "value": "6c919bd1a5cf9a961aabade412f587cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302597, "uuid": "7f8371a3-65bd-4f93-9862-70bcbdafa2cd", "comment": "Malware payload (MarsStealer)", "value": "dcfd1325f755080466602c7dcf44588b2e57ba7e59c47ba561d750c0f28a4be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302597, "uuid": "53a494bd-e8ee-4ceb-b013-012f1e46744d", "comment": "Malware payload (MarsStealer)", "value": "5faaf4f33cb37eae2dc909d9b01c46bd9c7eb198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302597, "uuid": "a751182b-3920-498d-8bf3-db1fd5049030", "comment": "Malware payload (MarsStealer)", "value": "9ac287279d6067824dd890465dcb87f936a10b01ab353ef0c98c127b33c270c0ef1a89ad2bfc62a409a3bf5cb2ad28f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302597, "uuid": "f7867008-1f37-4c6e-a645-b3787a13fde4", "value": "T124F38CAEB14F5A6EC2E8173E7636A373C5AC6F213041443BFA880086D5965956FF334B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302597, "uuid": "ee9a0b54-5e6d-4325-8a3d-24a8f618967b", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302597, "uuid": "68c81d2a-f39b-4e42-9a8d-3ee23b756ba1", "value": "3072:UuXFEsjOWPfQFcMnYXGaPpnQWm5l0a8ht4DMZw7scHJSp8Bb8EG:ZXFftQFcMnHaPCR5a1ht4ISR8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302597, "uuid": "a1ea52cc-871d-48d0-b63d-f0b475152aea", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302597, "uuid": "e3c82861-33fc-4b71-ba47-d7aa501b2648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302597, "uuid": "a3784aae-e790-4b2b-ae0e-991dc71aef42", "value": "dcfd1325f755080466602c7dcf44588b2e57ba7e59c47ba561d750c0f28a4be1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3df49c2-fbb8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248227, "uuid": "1338d000-f2db-4d1b-b516-8cdd004e4f45", "comment": "Malware payload (Mirai)", "value": "17747ac86eae3f9d9232d96cfc2ed60b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248227, "uuid": "52ccc962-8bf9-4726-8b1d-b044f4cfebab", "comment": "Malware payload (Mirai)", "value": "dd9583ab92fcec0c7063e1f90824382e0f6e510dd60a561989557fa32e0b8e51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248227, "uuid": "0f07df8d-1b03-446c-ac8a-0094385324af", "comment": "Malware payload (Mirai)", "value": "30970ddaa814471d6c926beba864667ec23dfabc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248227, "uuid": "8544dde3-5c6d-43e7-878b-58245759dfe5", "comment": "Malware payload (Mirai)", "value": "a80308ac0cea3f15ad246a0914adaacd682a5cf2627813de6e2b9b674a28fe56fc418b9119bd4abe61f3c99541cf13e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248227, "uuid": "970d1ab1-2f5b-4101-94df-e4079032a72e", "value": "T104249E05B3194A57D0A71EB026EF07F0A3BB9CC111A0A20A966EFFD55773AF45902F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248227, "uuid": "399a4193-96d7-4629-9937-65648808c3cd", "value": "3072:Q+XpYgeST/PmqEAOpsTl1WZTT6hEz58m2vrxax8GpB6DiC:QsKBqbEAQsP2IEz58TfO6DiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248227, "uuid": "e11877c2-ef63-4051-b991-60b05e96d8b4", "value": 224549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248227, "uuid": "5aa8c8a2-0169-4c62-a8d6-9354c1cb65f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248227, "uuid": "bfead030-fc0c-480c-8e3a-1b2d300b8449", "value": "17747ac86eae3f9d9232d96cfc2ed60b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd35d671-fbb8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248243, "uuid": "bf42a05a-8041-4ae8-ac2c-36463d1368e6", "comment": "Malware payload (Mirai)", "value": "b47e68538fc56a9a679ca0787cc5798e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248243, "uuid": "e45b736f-e165-44de-b466-5356e25cee5b", "comment": "Malware payload (Mirai)", "value": "de8e4347ecafd5f5f9eee1c3596f5e5c95aa9b497c76b60c847b7b1e6391d200", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248243, "uuid": "dde98cd2-2b80-49dc-95c7-2e4c86f38a25", "comment": "Malware payload (Mirai)", "value": "53f52a33530752227b08c050251a1ea3588890fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248243, "uuid": "74a53f49-530d-4de4-b544-e2a8a17899df", "comment": "Malware payload (Mirai)", "value": "6d346f1ec10b9f82cb7189e7e727c43b517bffc16abffa5c57803162f8ced869b468cd351118240529f0b611b34925a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248243, "uuid": "c598f5aa-021f-4c8b-aaa6-3696bbfe1f60", "value": "T135E3182277B60A27C4E4A57AB1F75733B2B947C614ACC60B3EA10D8D6FA95503113BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248243, "uuid": "ae6f961c-5a48-4680-b487-41f05c09ecf6", "value": "1536:ObLvu3QogKZvZpuoaxSH0a7kcp132l45atDT8bH+wDNvLctwqwkyOGqRijzZqTj:d77nWdFQ7+Cbqwei3Zqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248243, "uuid": "4358f9eb-01ad-4acf-8489-d583c8a7a432", "value": 152488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248243, "uuid": "26cbef26-91bf-46b6-8372-cab1f2857a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248243, "uuid": "991f2c90-d42a-4bc3-9d97-21f982bfb690", "value": "b47e68538fc56a9a679ca0787cc5798e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa24c97-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713256131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256131, "uuid": "8e2ca6dd-1b56-463f-9dae-e8d2a1e39383", "comment": "Malware payload (AgentTesla)", "value": "624bfe5972a3f941fda9e65ea502d6aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256131, "uuid": "d8a500b1-c12b-4b64-8153-d09a92b0c393", "comment": "Malware payload (AgentTesla)", "value": "dedb50b5fe07672b55fc3cbc497b917ce9cde55ffafa5a855cc42addaee124f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256131, "uuid": "e9fb2764-9c8a-4a13-9647-c383ca2c905c", "comment": "Malware payload (AgentTesla)", "value": "655dac3f2872c96fd73903db7a5ddc1619319eb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256131, "uuid": "c2e64167-52cf-484c-a91c-a723a173c52c", "comment": "Malware payload (AgentTesla)", "value": "e3c1e908e9da79e3bc2117edae29c9f0f339ba412891882fbc7d9aff6321653eb23e61d6f9906639e3937cadd32a7295", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256131, "uuid": "e9d9d309-c229-43cb-814b-f2ad39606e1e", "value": "T13B258DDC67DAEA15E2ED7E70811C47F00FA9AC0654D2D6CA5FAB70C98974B8BC442633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256131, "uuid": "52595ac1-ab47-4d15-88f8-e6020c880583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256131, "uuid": "ce9ad963-436b-478b-9a84-d9286eb6c9b3", "value": "24576:EXoSZp+EyJlysAhd43xMKmpyijl5cipw:GL7nOlV0dLXpyijr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256131, "uuid": "74f32887-56b9-4194-8332-705fbb934fdf", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256131, "uuid": "7bd4bda1-e5b2-4aa1-ba7b-c5712bad5ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256131, "uuid": "eef29c0c-ca82-42c6-8904-91124c85cbdc", "value": "SecuriteInfo.com.Win32.TrojanX-gen.32302.18886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3d08c4-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236776, "uuid": "39982381-e5cf-49b6-ad0e-c84e456dd4f2", "comment": "Malware payload (Mirai)", "value": "4e31e2b9a66a0cd2fd58f1ac8e51e4d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236776, "uuid": "b67e738e-114b-4f73-b7ac-7908b91c9e05", "comment": "Malware payload (Mirai)", "value": "df686f82af5aa3bc6e301c46f82d1221b022e3cf74b3585428f16c3094dfbfb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236776, "uuid": "8c40423c-e88d-48eb-bdab-00134acf9988", "comment": "Malware payload (Mirai)", "value": "85d1919f9c104efd57e004a90e49330dea6a9d01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236776, "uuid": "9ccbdc40-455e-46b4-ab65-2e12c5044630", "comment": "Malware payload (Mirai)", "value": "b59add02ca9adc9e657b25d0e4f95bbaeb1eacfad276be22f588e06351b9213af937d3127f445829c357e4f558188f2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236776, "uuid": "a8b119d0-2f08-41c4-b4df-3518eb8e82c0", "value": "T129531956F8914F21C4D512BAF92E254D371617E8E2DEB2239D202F247BC792B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236776, "uuid": "a33fe8cf-77c8-4f99-b99c-486a46fd0ac8", "value": "1536:qLnpEg1suKkp4iDo1LQm3rMNit6N9HlEa10l9:FgOunKb6N9HlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236776, "uuid": "1dcea795-3901-41e6-ad2b-9f10760256e1", "value": 65528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236776, "uuid": "01915348-43ec-452c-bf08-4b70c4bff6fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236776, "uuid": "87db593f-5aeb-45f9-9678-2c74f977871c", "value": "4e31e2b9a66a0cd2fd58f1ac8e51e4d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecbcf6b-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281478, "uuid": "99fd31ba-3355-4593-99df-c5594604a5c6", "comment": "Malware payload (GuLoader)", "value": "0e23cf5a43e4ead0716c393318ebc8a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281478, "uuid": "8d960c07-666c-4f4a-8ef6-9f685cd1a8e7", "comment": "Malware payload (GuLoader)", "value": "e0f85d079be2aa4c24f9a6ffc7af8e9737e0a13a6991af95b887bbaf3f59f83d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281478, "uuid": "3ace210c-6ecc-4fa4-8727-a532db335074", "comment": "Malware payload (GuLoader)", "value": "b11f01415371ccc25ce9ca585fd927350809fc11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281478, "uuid": "cb8ca6c7-75ad-4e51-9cc9-49228d967ed1", "comment": "Malware payload (GuLoader)", "value": "811fe04592b3378c7e57d99b023ff3689f6b126b6c53045dfdfd5c71db81790b0e2dffc147a2a9eab62d7e410310c5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281478, "uuid": "2abe8083-6b5e-46a5-adb5-1bc956f1f169", "value": "T119C423631E20C4A2E2738F7549EB65AB97BEE65460027B03276D3E5F3DE1B81D83D244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281478, "uuid": "8c1eee5a-9909-491f-8af4-8f7262c7f428", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281478, "uuid": "64d4b55e-e547-4dd8-9250-7d91093f60e9", "value": "12288:Q9gnHP6kXRU1/qitNjxGFzsZqWESmLjPLoSBHW:NnHFIGtsUlSeoS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281478, "uuid": "ddb1a68f-ef7b-4699-aeae-39637d735d18", "value": 576696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281478, "uuid": "12f8e85f-ceaf-4e78-9f12-16be86419aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281478, "uuid": "e2300b6e-e6fe-4d51-bfff-8f83d0cf51e6", "value": "S\u0130PAR\u0130S_0433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3581452f-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713253062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253062, "uuid": "a5d2330a-4c5b-456e-9a5a-961d904d05c9", "comment": "Malware payload (Formbook)", "value": "ed034b758fc815e198193c3520cfd3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253062, "uuid": "a6983fec-0acf-4978-8a55-2ab6d7e1ea4c", "comment": "Malware payload (Formbook)", "value": "e19db8a23b082c6f48e261d911e577b3c80617caaab197b539bc315485b5fa29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253062, "uuid": "55a520ec-400a-45c2-b1aa-f16423425f0c", "comment": "Malware payload (Formbook)", "value": "6b40208375622792e49f35bb3e7ea2f8e8a498b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253062, "uuid": "9b06cf24-eb8c-4858-8247-861fb932e7f4", "comment": "Malware payload (Formbook)", "value": "c908568172d6e53a94ab03d839ce19e657f114d5535039f7c64471d81c4e699eb694dd986816a8d52d75eb8780163b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253062, "uuid": "5fbf857c-c6aa-48bd-a6d1-4983a723fdd9", "value": "T1DCF4120461FEAF1AEAB507B0A56118500BB6B5FBA233E35B0FC195CA2975F844F50F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253062, "uuid": "7708cf35-6883-4c34-9b56-4c79601dd735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253062, "uuid": "831e13a3-87e6-48f6-af30-ddebe70cb718", "value": "12288:Ydpp5wjz3z3Op8D+ZBmOI0nbCe5BmIuTnBxaFv8Kbr09nB8odAgWY:YdBiv3qfnbC6QrxaFvFr0r8axWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253062, "uuid": "946bdb14-676a-404a-9031-dea0ecedcb3b", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253062, "uuid": "98a3ff7f-60d3-4b3f-b510-2512ea69917a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253062, "uuid": "419ae63c-3a29-4801-a72c-3dde16a9c19e", "value": "VAT PO 24000042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4f6345-fbca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255835, "uuid": "b066f693-bc81-41c1-ae9c-103d1914e69b", "comment": "Malware payload (AgentTesla)", "value": "d6ef5b4c4627dc06ababa7f1276edc79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255835, "uuid": "ccd1c6a1-51ce-4108-b0b0-2fe7f1c52083", "comment": "Malware payload (AgentTesla)", "value": "e1a7994ddfd57c0e0e5640720bab427afa0d0ca11f5b09d50b4fe8c9d030c726", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255835, "uuid": "9930e31b-6be0-4f9a-be18-41a332512b9b", "comment": "Malware payload (AgentTesla)", "value": "ad9e36b336501512587f2796b602c133bb4dde3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255835, "uuid": "b6a3bfff-304f-4d8b-bfcd-00abea265cbb", "comment": "Malware payload (AgentTesla)", "value": "eb8147fc0b726d27d512eb7bbde3c0ecf97091d60eb6e7737c833719d88d95431727a0169b710ee7f19d50b7091139b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255835, "uuid": "da4f9f22-5238-41a7-adf5-ecbe821a6d6e", "value": "T14174124427CEA23BC9DC9A7DB0B09D1801F9A502BC96FB6E9D9032C75E277D0479D983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255835, "uuid": "677dfcde-aab1-445c-9b7c-f49b18e380b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255835, "uuid": "45521907-b8c5-4e8b-ac2b-cae460f4de0f", "value": "6144:nwdiUkUG5/Ob/HfQglA3+6fQ2pqlI9B7ReR7BDQ9TxK/yTf6qe1CzW8:8HkUG5/OjblY+oFql6B7RUQ9dK/yTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255835, "uuid": "e2c5faef-5e0f-4654-81cc-f5980dfd35a3", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255835, "uuid": "97ec1072-a6ff-4e02-8a3d-0f10f76cb2a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255835, "uuid": "5be50bef-c860-4977-b466-47e162352f22", "value": "Proforma Invoice - Well Ergon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da65ea80-fbdf-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713264935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264935, "uuid": "0239a834-ac42-4976-9fb3-6f1e3d1814d3", "comment": "Malware payload (Neshta)", "value": "a5f8c4a6e0d0a9729773be1c730aa7c7", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264935, "uuid": "da54fdcb-da75-4043-91c9-bdc8311f11da", "comment": "Malware payload (Neshta)", "value": "e1bfcefa81d738c9cccd256d39be3ec4f4663e7d045e47bee08871482be3e3db", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264935, "uuid": "5ca4b5c2-8112-42d4-a99d-5693540eba42", "comment": "Malware payload (Neshta)", "value": "6022333fafb5838194df8865279585cb4c406f2f", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713264935, "uuid": "ed4ce46f-c94b-411d-991b-40ea79a9a47b", "comment": "Malware payload (Neshta)", "value": "5afa4e99c4110bbcf3f1d8a8ed1510dd9dbb75d74c62450d54284b395740e658082f4c21e25b140e93094c90f18048fb", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713264935, "uuid": "2575d2d2-b482-4000-a5ef-812ba120984f", "value": "T1A3E4237F302BA9F5E2BD043F4F27A192867D2833583A4C3E46E22B57929F118C753295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713264935, "uuid": "f880790f-fca7-498c-87cd-8587ddb79630", "value": "12288:pNlPyweTrAdJhppIEp9/eAJZrsZEL6S7HCeZDVyxZBK1j6NSWtWVvsIyVN8zm5:pNlPyqhHJtsZE7iAVy/BvNSW0EIyrum5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713264935, "uuid": "c172bc59-c354-4183-9abc-0631cd487f39", "value": 696738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713264935, "uuid": "45610beb-4060-40de-8564-59ec5f8f2e5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713264935, "uuid": "19559231-373a-4b56-89d4-cabf3bee6d9f", "value": "Order RFQ-HL51L05.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7f5efe-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236805, "uuid": "f3921b84-08f0-45da-bd09-c363ad75994a", "comment": "Malware payload (Mirai)", "value": "e309cadba3cb85eae293f66609a9139b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236805, "uuid": "a4c12314-5f6a-455e-aa90-477dcf827c97", "comment": "Malware payload (Mirai)", "value": "e1e9609a375dd4aa221ec546d171216df2cd33af8a2e5c431e2da24f2c6d76f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236805, "uuid": "ff3da41f-93f2-48b1-ba3a-3b0d2d0b0f8e", "comment": "Malware payload (Mirai)", "value": "2c533cea96acc5ec75bc66921bad92177e4578bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236805, "uuid": "dbbafd1f-d38b-4b45-9e85-e9685197be66", "comment": "Malware payload (Mirai)", "value": "abac33188849ab377ec00ea0a2a777ce8f97b2447e1f66d62da20b18806021db3b358486d551a06efb8b67fa18719b2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236805, "uuid": "18410ec6-f2b4-4302-8a54-086fbdebec0a", "value": "T149434A85B8829A22C5D112BBFA6E458C372927E8E2DF32079D211F6177C681F0E77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236805, "uuid": "3b51b967-6a13-487d-aed1-6b0322bbdcdb", "value": "768:gw8w1Q2CYaW9Ju0UK7c/T/TKptuv4pYP3LDTIBspAQ9JG8b/aB+34HaAcIz2lHZ/:8w8YaCJu0/C/284pw1zOb3T8a10y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236805, "uuid": "6f61b041-d4a1-4f0d-892a-27912e760904", "value": 56800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236805, "uuid": "d5c24631-9e1c-4e76-9590-1555b697e5bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236805, "uuid": "61d552dd-3202-4190-ad23-de7b75ef0fe2", "value": "e309cadba3cb85eae293f66609a9139b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118ba83e-fc33-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713300676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300676, "uuid": "3b140b99-e762-4f71-a4cf-c07c85987ebe", "comment": "Malware payload (AgentTesla)", "value": "3d38e11de85b617a3aed36b0b382b610", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300676, "uuid": "b68baa9d-18bf-40c1-a3c0-baa395e99b9d", "comment": "Malware payload (AgentTesla)", "value": "e347a46c3060085556d9ec4577d577ab08ee49910495ed084e8059883c75e7da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300676, "uuid": "0075e619-55c6-4753-b522-fb237c14112a", "comment": "Malware payload (AgentTesla)", "value": "fa076aaa7ca926ca11962126bfc89cbae74d113d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713300676, "uuid": "99ec6d36-96ce-4a2d-9147-261ffd71d6c1", "comment": "Malware payload (AgentTesla)", "value": "6dc7e0079fb4509fa97bf573217399f87cc0c296490a3edc17525fa8a440cad6304a323726c4ff2d39e472a923b38a51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300676, "uuid": "07da1fc3-336a-4b58-a19b-edb7dddc3b72", "value": "T1D8E4225827FC2908EAFC8B3A98E64516C336A7026F43E75D99D1106B4EB7FD14B10CE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300676, "uuid": "34c6b207-c590-4f3c-a1c8-bd282b4b2b77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300676, "uuid": "6a737f8b-e772-49a2-97d3-f74670c8fa83", "value": "12288:/1NKQZT4tsthxZ7voK+nJE+CcZl+am41/PBTFrVWi6suImIx:/1hZT8sthxZ7vozJEXcZN1RRbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713300676, "uuid": "1c5fe51c-5399-44d1-80b1-276a3d15f461", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713300676, "uuid": "29d0f3b1-0aa1-46ab-9491-5eab9467a87d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713300676, "uuid": "027bc3e1-057c-445a-b074-edfc3d0ef602", "value": "z158xIuvhauCQiddTe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc534fae-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265770, "uuid": "b12318e7-55fb-45ea-896b-6e09055fbc32", "comment": "Malware payload (Mirai)", "value": "8f789d65b4ea074ee2dcba5546053a51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265770, "uuid": "0d42a671-84e3-4fd2-9818-8d85645dfeda", "comment": "Malware payload (Mirai)", "value": "e3652e63c05755161aea2508a46f94cb4f4ce79a7b73c74eaaf11149b1d38003", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265770, "uuid": "7f9928c8-cf2c-40b4-9a10-eac0531b19a0", "comment": "Malware payload (Mirai)", "value": "dace3b375adfd1403523a4516ab9fb63c587397b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265770, "uuid": "3967b8d0-2f4f-4e5f-b138-99197e1e8f57", "comment": "Malware payload (Mirai)", "value": "a119ce44e0be6affdec1eb77a8b815acb5498297c98e7a75fdef6411dc20d83da8963002c31e36c0f86fc2494ebff2a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265770, "uuid": "3d430c77-e3cb-4537-89cb-1b8f5861b297", "value": "T12C63D84AFF750FBBD86FCE3706A8065131CC994612A9377A7138CD28F68A54B4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265770, "uuid": "945d8b99-4db1-48f5-be41-e137cd35e99d", "value": "768:v4C7khngnjdvJEOlOe92nt5UejPJse7e7iiuRUIxy8QtzLXihtcaRvfve2jIvZ:Egn4m2nsEBsX9uRUI08QtzraRfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265770, "uuid": "f89cd19f-7e52-462d-8b1c-a6638a8f6750", "value": 68288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265770, "uuid": "7f654c92-8486-4847-b309-61d5b1385162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265770, "uuid": "c9048632-03bd-490d-9e56-2e54ee356a73", "value": "8f789d65b4ea074ee2dcba5546053a51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fec5e5-fbe7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713268182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268182, "uuid": "1bbce29e-8343-4fbe-8f43-d32755f7ad8d", "comment": "Malware payload (Mirai)", "value": "88b7d1f09ff96281a5dfb1b4f6d0b349", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268182, "uuid": "eb721e83-38e2-4326-bd6d-59d8475d2838", "comment": "Malware payload (Mirai)", "value": "e4ecccc2f8aa86bf43528fabe7eec791117477a08b2b36256336ced90c841bcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268182, "uuid": "c65dfa41-168d-4a66-a274-6a42d3e0f58b", "comment": "Malware payload (Mirai)", "value": "ef7271e48ae8103c898d1ea69e231252508b4897", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268182, "uuid": "57788937-bb06-464a-9f0c-1716dfb86f15", "comment": "Malware payload (Mirai)", "value": "91ba4d9ccd46f4b7d42df192c43cbc81c6ddd9786b651877d27d53107c2170e853e06ce1aaf1bb3ab00db46d8ab11db0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268182, "uuid": "16dbf8c9-e685-4b90-88d9-2723a2c98c4c", "value": "T124D2E165C19370B6CB711C71BDFE0289A22216BDF5CB6D2F0B525B1CCDAA0D212771A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268182, "uuid": "e1f6b142-d5b6-45e1-bada-4fcefcdbafb7", "value": "384:FPRYLrN7sUG+5Llv92f2C4j+REBPCiV+WzkzC6oand6lxRMf5GylpE7lmdGU5EJ6:FPGrN/G+5L3j+2Cioz3/d6Zyl+7l3Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268182, "uuid": "4fbe2333-bafe-477d-9478-4167ee3f808d", "value": 29052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268182, "uuid": "a3585819-ba99-4ece-bc04-5cb0706d2f5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268182, "uuid": "93dd42a9-4384-41bd-80f5-543b9bdadb2f", "value": "88b7d1f09ff96281a5dfb1b4f6d0b349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5dbabf-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265344, "uuid": "c7771f58-5e50-4eb1-b236-65c3ca24ea45", "comment": "Malware payload (Mirai)", "value": "1b7c361c1addce7c4cc54688c66a8934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265344, "uuid": "b1bb7508-b17c-4f82-a8e0-8590e50db8fc", "comment": "Malware payload (Mirai)", "value": "e57a3372a0a48acaa4bab62d105e364a5005f098cb175446c171922be03af44e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265344, "uuid": "3d1485ba-71e6-4630-92a8-9b34fbb8a9c5", "comment": "Malware payload (Mirai)", "value": "28152028a117cd42e5d01d6d3d75709ac28c2269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265344, "uuid": "9f04c58d-1250-4ab9-9093-800b1709cb33", "comment": "Malware payload (Mirai)", "value": "5c94ee7d8652ff9ddc8482a6ddebb07c1c96ba1974ac558a23827931a8d332017666e2476bfbd0ab71e5e66229084e41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265344, "uuid": "439178fd-fc85-4e0e-986d-216cb051f7a1", "value": "T190130874380AF7E8DC982234E4072EF22A9249983EEDD6D3F0565131F9F578CB855E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265344, "uuid": "f8dc6df3-80b5-45f9-a9b5-78f72905d41d", "value": "768:R+XoNLDH44EzrkoAf2tKzHBajlt4tLt9tMMJm1NnwRIDoEgRaQj+X5y1TRCvud8a:R+oxDYeBajltKcwmvwb0g+X5y1TRbw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265344, "uuid": "e4952ca6-7e27-48f4-a880-8680c68885a7", "value": 42608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265344, "uuid": "7f7528cc-d833-46b4-b2a7-9710d3aa5bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265344, "uuid": "ee89cc23-5599-4da4-9c40-13f45688800d", "value": "1b7c361c1addce7c4cc54688c66a8934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd783161-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233963, "uuid": "adb7f324-2a7d-4f42-a7cf-2d1c66e216aa", "comment": "Malware payload (Gafgyt)", "value": "5bfafd14d563a559d79fdb6788d599ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233963, "uuid": "bbe76613-7608-4300-b14d-ada0b5c53903", "comment": "Malware payload (Gafgyt)", "value": "e5e65e13089cd82f8ed1b27a1095121c8b89b16a9a31c63bac7c243e8424eceb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233963, "uuid": "bbd84d75-c37b-40aa-8ad6-99ce46ec0114", "comment": "Malware payload (Gafgyt)", "value": "08083247e7309dd6429aaff1b03e246bed6e0dca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233963, "uuid": "c786b619-18c4-4c2c-9244-3ab676221932", "comment": "Malware payload (Gafgyt)", "value": "97b86149163cd583cda5e1b08ee469d94f85917f593d5fa63658e5710520120f5b4fb253116dd6f7ab2323ac6da580ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233963, "uuid": "7d4210ed-02c2-417b-8e29-810ccfb68484", "value": "T19A934A4785708EB3C043AF7926FB9974071368625B0B2B64622D9BF8074F9CDBC8E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233963, "uuid": "60b47a38-7409-4bdb-9d75-7f807d6e9b57", "value": "1536:zEyD3SSR58Obqjp74eG29ero2xi4gEm6ksfS0YoxH:zFOSznqjO0e001mNsfVYoxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233963, "uuid": "f75fc872-f4e3-4519-bf8c-60ec9e26678c", "value": 97269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233963, "uuid": "3164e570-9c23-464f-a4d6-8b7adda31ee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233963, "uuid": "56bae2f1-aa41-459e-ac84-023c0b757c0d", "value": "5bfafd14d563a559d79fdb6788d599ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e78d99-fbe0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265411, "uuid": "31d64b51-0974-41dc-98bf-5b7f9162a3cd", "comment": "Malware payload (Mirai)", "value": "d1531c87cd66233bead152c2770658ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265411, "uuid": "3e1162b8-971d-493b-af19-fedcafa372b7", "comment": "Malware payload (Mirai)", "value": "e829884bd95505afe4b35a8464694644f3bc8d469e84147ffcd8903593d91681", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265411, "uuid": "4919f026-5113-47a2-8f02-264b0da1323f", "comment": "Malware payload (Mirai)", "value": "b82dfe5c3e240f2d2dadb5e7a871247f96e8f18a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265411, "uuid": "3d612a59-fae8-458d-8bf2-f7921f30ab3a", "comment": "Malware payload (Mirai)", "value": "b1325029a0e0887bc76a00da091c01a85066da5ea89840cf30bd82bed5fea0e4dbf2baa1ef6925a698440d19df0f4dd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265411, "uuid": "487d2192-de0b-4f64-8962-797d16a944ac", "value": "T10333965A2E328FFDF66C823047B74A21A76D63D623E1D685E2ACC5041F7038E545F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265411, "uuid": "993a0b71-5a1a-4d89-8ec8-e3c6e5482fd0", "value": "768:sH4DdWEdzi4S2ucV+1U1ayDLZdbpf6dsf/myEmtetyyjCIa:RDdWG9R/Vx9LbJ6d8/ReMyjCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265411, "uuid": "b2e23672-bb12-4c0a-a0b0-19c45c03d22d", "value": 52316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265411, "uuid": "ef156c66-918c-4af8-839a-260da53a03f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265411, "uuid": "ff509cf2-39b2-4078-b0cf-03bc76790ce6", "value": "d1531c87cd66233bead152c2770658ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac4d64b-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265446, "uuid": "57add004-43e6-4bf6-bf3e-3e2fb9e711af", "comment": "Malware payload (Mirai)", "value": "cb09239ccfe0f985ab4a76f9e4adc0f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265446, "uuid": "77886959-32c3-4819-bda6-e32f63512a22", "comment": "Malware payload (Mirai)", "value": "ea1fc734aa4ad9380af0ed432175219f4f0552b86b1a85f7626e76cdaece18f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265446, "uuid": "73e75d47-15bd-4fce-97fa-a1e6088e061f", "comment": "Malware payload (Mirai)", "value": "ca2ecab1e667118b61dd171b26886eae24753db3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265446, "uuid": "b340f1ba-fb68-4cb3-b0bf-8080a24f2e7a", "comment": "Malware payload (Mirai)", "value": "393801499fbea85702620cd490c40e44a4c00ea99a7ef4960a5df46c1b7ace703119953d52793bb669119db837a6b826", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265446, "uuid": "8801d0da-4a1c-4ac2-8f50-62be089c009d", "value": "T10833D80AEF654EABDC6FDE3306ED064135CCA54712B53B393074C928F65A54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265446, "uuid": "ff079fa7-48cc-4d38-a8a0-9ea5b0f60b96", "value": "768:vu+dlsjd/d5ZSoPvf0AeczeHUebr0AHadwAASY9W1ZlWvXiUE0XKcGCnIZ:mFXdfpzuUsr06TjWZlW1XKcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265446, "uuid": "c8d55fdd-080a-4ff8-ae62-37d05640db02", "value": 52668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265446, "uuid": "e1cf7853-6ef2-41a8-a009-b2c87d086557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265446, "uuid": "046bfc9c-45dc-455f-9cab-78932e77fdb6", "value": "cb09239ccfe0f985ab4a76f9e4adc0f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddceae2-fbb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713246607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246607, "uuid": "03d2fcd7-753a-401f-80aa-e2b54ff10f42", "comment": "Malware payload (Mirai)", "value": "aa29976e7e7372b7e4a71ffef8f124b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246607, "uuid": "e85753e6-8468-4075-b140-74494d3e69ee", "comment": "Malware payload (Mirai)", "value": "ead04fbc7c099225cbc83c08278f45996fc87361190fc82d2b3becde51d86ea2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246607, "uuid": "70a2cced-dd4e-450c-b860-54ea311ca13a", "comment": "Malware payload (Mirai)", "value": "1a07931f5199df0a26aeb635a16ffc3a27174dc9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713246607, "uuid": "d6e2474a-8b78-4d1f-a7b7-78796968229a", "comment": "Malware payload (Mirai)", "value": "47966035c66ade7641e5dd7fc89723a4b885e77c6ad357d00f8ee94d0e408c0594d000d7ad79d2124b4d97416728793c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246607, "uuid": "e183569c-322d-4b1a-b5e0-16e166e2a22c", "value": "T126042A46EA404B13C0D627B5FADF42453333AB9497EB73069528ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246607, "uuid": "9e654827-6e92-4b85-9ec7-762326431369", "value": "3072:HK/lcIBbBLHcBCkAabwdyqkkUbH/6EBppO/hJjogM/RHyfqs:HK/JBLHElAabwdybkQ1BnO/XMgM/RHyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713246607, "uuid": "bd92f2cf-4a7a-4da0-bec8-cf061ce44f3b", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713246607, "uuid": "561fd150-1299-4d99-a83e-c6e5ced7d87d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713246607, "uuid": "af7f01ac-9a52-49fb-bc31-113189602be1", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa316906-fbb8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248238, "uuid": "9379da46-a77e-4a60-93f6-8b2a27b7fe1b", "comment": "Malware payload (Mirai)", "value": "20fb01926228727e3318a810fcd22faf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248238, "uuid": "faf5cee6-6729-4ac5-9c92-941ff5dfb26e", "comment": "Malware payload (Mirai)", "value": "ed1a910e550fa0ba22149fc7a60397fe56d94d9cc9738d7f12395bbc34dc793b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248238, "uuid": "ca522763-c49c-4baf-8707-610932c9e0c6", "comment": "Malware payload (Mirai)", "value": "cfae9ad23a6dbc69b8e7d97083306785dc67ee81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248238, "uuid": "e3615e53-99f2-4e92-a23a-b025f0bbd923", "comment": "Malware payload (Mirai)", "value": "f4414bd226c1b64c6be1938d7067d9619ebdc7938a754423fa9c5744a98850f7435a85c0a116d2d9c8c7a1d5b0461faf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248238, "uuid": "d9602271-4fae-465c-964c-e196d33812b7", "value": "T1EF14A71E6E228F7DF669873047B74E209B5922D617E1D680E2ACC5105F2439E681FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248238, "uuid": "261c820a-471c-4992-941a-e556d254a270", "value": "3072:sseHi0ePt+mWNg3DEiu0R0sjAym3N6dDB:sseHi7RM53NMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248238, "uuid": "e52f1909-d350-40b9-8c2c-85d2a464a638", "value": 193792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248238, "uuid": "4a46fcd4-a907-4a86-b8ad-35420e583416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248238, "uuid": "441f90aa-83b8-4e15-8277-89b48bf4644e", "value": "20fb01926228727e3318a810fcd22faf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02b04ac-fbd7-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713261455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713261455, "uuid": "6840c31e-59f2-48c2-9bde-f34c5771a07f", "comment": "Malware payload (Formbook)", "value": "4d82cc1b35b8dc9ec7d149f1b8b95e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713261455, "uuid": "37ae69a7-8eb1-4e6d-a85c-48a4403d9ea5", "comment": "Malware payload (Formbook)", "value": "eedd6d6a9ec4bf82ca87e66c1ae5b86983e8479598df71f3602283b93dd07035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713261455, "uuid": "1762c60c-7d80-4086-b665-84bdb9dda07d", "comment": "Malware payload (Formbook)", "value": "a1d363742603070b3fc7d2db4fc431307618b1b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713261455, "uuid": "2c5aae2c-aa61-4680-befc-bbea96259d68", "comment": "Malware payload (Formbook)", "value": "c22e59a9f52d27c4e7ff4c177103972ebc2b58c5f57275f2fc2b3ab5a3a4d425df88676d467fc3f20ff24c3c29845ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713261455, "uuid": "b2b154d8-6afd-4564-95aa-e6950925f853", "value": "T19205F1586ABB9F2ADAFE43F68522182407F1B25F7221E35F4FC6A0D95814FC40952F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713261455, "uuid": "4cc8c4f9-c32c-41b9-97aa-5f2b79f6bbc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713261455, "uuid": "246bc8b0-ec9d-4a9d-9624-0773adff777d", "value": "24576:D29ueLM9QItbS+57TPtSr2h3POtV3lAiwN:D29ueL6tbV57jtSrUPUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713261455, "uuid": "18d40c63-2694-4083-8493-49b74360fdc9", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713261455, "uuid": "67c2f103-99bf-4f25-b1b7-0a8b9e15f519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713261455, "uuid": "d7d11dff-3e7e-4dcb-a163-d5ef35356fd0", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5862953a-fb9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713236800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236800, "uuid": "075c5b48-2a33-426c-baae-fbb5a94bcbb5", "comment": "Malware payload (Mirai)", "value": "1d14376c439546020d4a893ca501d13d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236800, "uuid": "956267e8-d8f3-463f-995d-6554dc2d7b42", "comment": "Malware payload (Mirai)", "value": "ef0dded8d9398fbce795f13bbd527435a41b8d2495169beef7243bb7ddb9e109", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236800, "uuid": "0d7a99b7-7119-444b-965e-e94c7c8b49cc", "comment": "Malware payload (Mirai)", "value": "ffc801cd6e8c0bfbba6d7fd2d9293e5da740b1c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713236800, "uuid": "e290db3f-a6e1-4589-83f3-c85a42910afc", "comment": "Malware payload (Mirai)", "value": "3a65937a3f75db375abe934a149b365fabc5dd5e771f9b12a2e64650c28e33f066e7921ebd2666b4c48bf913ffd95ab6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236800, "uuid": "72a978d0-717e-42e4-aa59-017118930e71", "value": "T10B231996F8829B2AC1D022BAF57E995C3754A7E5D3CF3217CC601B207A8610F1E63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236800, "uuid": "b062d08c-c68c-4971-a9d4-37ce070adbba", "value": "768:FiM7wTpcv2eaWDzbJ+Qxk2ilyrVO8/vMWfq4apYPC64+aBk2f/7LJiiTa77AjZYU:ea2azb0QxkiH/vvfrapwW1Fm7kja10X/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713236800, "uuid": "63ff8f14-771d-412d-be50-0ff692a5bd9e", "value": 47728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713236800, "uuid": "785694e4-1067-4ec4-98b1-eb800fdf9969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713236800, "uuid": "dd333b16-cc20-4540-bd7e-47b1a2ef7c20", "value": "1d14376c439546020d4a893ca501d13d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afc271d-fbc6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713254038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254038, "uuid": "db5733a2-1a3f-4794-a5d7-13d308bf1fc4", "comment": "Malware payload", "value": "5887501ab57ad1752b3199f3a1c9c183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254038, "uuid": "b5e95c9f-f41c-4a80-a50e-24c40b391bdc", "comment": "Malware payload", "value": "ef0e8a810e12e4cb8afd584a94c7cfe849ec4f69c51c42a294ccc85be2e6f67c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254038, "uuid": "6f4df878-2455-46cb-878c-504eb9a625c9", "comment": "Malware payload", "value": "40faf023ef6218d433df319783fc2df5e5ba3f77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713254038, "uuid": "245ab7a6-325b-49ee-b3a5-e041463f00e0", "comment": "Malware payload", "value": "be60c0dd41b245449e701ea8a114f91585cfdd210e7aaf342c1b230037cfdde56e356190b4d2b4165d26ff9cab305753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254038, "uuid": "3baf1a89-6e6e-444d-a7fd-68157425a65a", "value": "T17D646C1633645CEDD5D682388961E224D7B2BCFA4B7393AB3E1076553F37AC12C25E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254038, "uuid": "9acd587a-1d19-46f0-af72-a47089685c02", "value": "3e56ce59a285d4b2a1179b5b63d99a37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254038, "uuid": "2da965d7-6ceb-400d-af00-fd10b7c94427", "value": "6144:Jk+qMRPeDcTERFaxRT4hoXNJWB5uJJsxfsM:e+ER9eJWBYJJsx0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713254038, "uuid": "521ead54-5eac-402b-9104-7abced00e321", "value": 313752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713254038, "uuid": "d83203f2-a05a-4a54-a651-d23b7730665b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713254038, "uuid": "5f65e288-5e29-400e-8439-e65e0c3a1f19", "value": "ksoanz\u8be6\u7ec6_6044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed50453d-fbb8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713248216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248216, "uuid": "f2cd04df-7432-407b-829a-e7e4be24c0c7", "comment": "Malware payload (Mirai)", "value": "c2853de87ffb2e8e704d0f540a22b1bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248216, "uuid": "4b32232e-9f5a-41ef-8042-8148a106c0ce", "comment": "Malware payload (Mirai)", "value": "efa1d9a49f654020c921ae318547bd465acddb0932163a8a8238b972d65facf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248216, "uuid": "c169719f-81d9-455b-b951-f81895c01d54", "comment": "Malware payload (Mirai)", "value": "5715c3dd7081de5d3af15a3c3e988c00857416d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713248216, "uuid": "6969a363-3166-490b-a7a7-f7a1c2beb5d8", "comment": "Malware payload (Mirai)", "value": "a6fcf07eeee447f2290da05a293270f5b23f3a6b9c62c3cfdb67f8ae3fa74e1380210f693d843e697e0e28e765be7ca3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248216, "uuid": "26750f4f-da4e-466d-a2b8-e56f9c3e22c5", "value": "T11F043A45EA414B13C0D72BB9F6DF42453323A7A497EB73069528AFF43F8279E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248216, "uuid": "7a9613f0-78c3-48d2-9062-a0252c659caf", "value": "3072:OqSwFNLWClO1TvknaBn4qfdQSCcQzWo6+6/YpEoGM/Rxb044jSB:rSINLlOBMnaBn4qFQ/Oov6/yJGM/Rxb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713248216, "uuid": "97ac6c5a-e312-400b-93dd-6fdc4613d1af", "value": 184862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713248216, "uuid": "ff507531-7c60-4a64-88bd-dee7675e62a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713248216, "uuid": "87f2a0f1-557c-40dc-a890-e6e37f024b8e", "value": "c2853de87ffb2e8e704d0f540a22b1bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b0486d-fbc4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713253042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253042, "uuid": "91a46d59-f1cb-4dce-b49f-fcff41960935", "comment": "Malware payload (Formbook)", "value": "069f621ff78d521669387724f936f693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253042, "uuid": "5a2381f3-bf38-4e8f-aded-644b56404ae4", "comment": "Malware payload (Formbook)", "value": "efd15711fec91fec88b1b6c704932a4e6697b79f9ea12d2b766b53081c18d438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253042, "uuid": "f1c06fe9-a509-4e9f-8474-d5af372abe94", "comment": "Malware payload (Formbook)", "value": "80eaae5bb96882f5c3e3569cac657f82a47815d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713253042, "uuid": "9f1d82bd-1a64-4d3a-a1d9-133c4c0dadaf", "comment": "Malware payload (Formbook)", "value": "41a9114fb474fab06cbc9609f3d5aed5a1f2f3d68352ea59918cb376b82bfa42e3d9370d62271e1f26883a3503ff7027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253042, "uuid": "e6ed6349-2b87-4dbb-b805-1dd255b44287", "value": "T14AF40208A1EE6F1FEABD87B0553168100BB679BA5537F3870EC594D629B1B848B10F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253042, "uuid": "cdec912f-bae7-438e-b08e-0f830e606e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253042, "uuid": "4ed48fa8-6d0a-471e-9bcf-cda8876d9905", "value": "12288:KxbJfmUudbrI0gwreu+bkyZg3nbwlWMNt3Ce0+BiPQ+BU:SJfFObr5gRkyZgL8Wmt3C9+wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713253042, "uuid": "c9ee31f9-fcc7-48c8-b8d9-c6c5346591a0", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713253042, "uuid": "f567f688-e9c3-4269-8e01-18dee61b2827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713253042, "uuid": "f758ce7c-ca52-4ff2-b33f-7039ec0f64b8", "value": "NEW-ORDER_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879f8380-fbe9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713269091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269091, "uuid": "972e79db-2cf4-442a-8e8c-add81ce7851f", "comment": "Malware payload", "value": "eb4953206b562dfd21b9c11aa4b76daa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269091, "uuid": "acc57b64-b86e-4fe2-9e86-4a89f1ea1b15", "comment": "Malware payload", "value": "f002b4ce98a9e51473831a6e0941c3c5d6301cf6853d9855c13ad2519c45e1c9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269091, "uuid": "8cc4269d-ab33-4135-b044-fcc872b8821b", "comment": "Malware payload", "value": "c337e530e54c0e25554aaae234a428baa4a0119b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713269091, "uuid": "7eef89a9-27be-415c-b20b-142cca87072c", "comment": "Malware payload", "value": "b5f819026cb5e12b0d2a633e9341aa4e0ec7fecad0da8f771b22625be2f5461a6d355f41897cbecfc33a97989e1f3010", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269091, "uuid": "d7ecb6a3-0bce-4adf-8d99-a554aa5ee398", "value": "T1B0260212B3C3C12AC15D02BBF55DFE4E1974AF63473101E776E9396E58F58C2A2B9A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269091, "uuid": "145b097d-8719-4c0d-bbe6-97c8e9037422", "value": "98304:wltRY3ui9+PHp2YGJ0RvNPsux26QECJIMaFYdmRrn:entfsY00R1PNM6QRJIRY6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713269091, "uuid": "a2b9c2c3-b9ad-46f4-ac94-b0fd65b0a393", "value": 4613632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713269091, "uuid": "c8e6b71b-c71e-49bd-889a-2cef6b03cd3f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713269091, "uuid": "163b6d21-f47b-4761-810c-87366da20945", "value": "z69ClienteNFe-Faturada-15042024.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5e232f-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713281553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281553, "uuid": "3701763f-f7ca-4923-80ec-5afb1b38626b", "comment": "Malware payload (GuLoader)", "value": "6f4b299139ced067c08d947b7eca2bc9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281553, "uuid": "026c1915-3ee2-4926-aa02-85f7ba504ff4", "comment": "Malware payload (GuLoader)", "value": "f0834412ca75067757ccfe0f1dc276bb6985220cddf9d482a10e821592839647", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281553, "uuid": "5ffe2d36-4c1b-4c5e-aa9a-eaff09495a72", "comment": "Malware payload (GuLoader)", "value": "b95be344f81547345fba6ae4f7d09940bc1d6147", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281553, "uuid": "743aa121-1126-4044-8474-f2c530cb5e27", "comment": "Malware payload (GuLoader)", "value": "c5abb9dcaae19a18c5e378c21681cfad5a762384dd4efb49ac3e34f7bdbf7a712c474105d665843dd127cac7791fc1f2", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281553, "uuid": "90a6d6fe-06de-424a-b263-7e6a6ee1b631", "value": "T1DF2419F0CF0B36199F4B3EDAAC6445928AF48195051638B5AAD817EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281553, "uuid": "687b1131-7968-45ce-ab71-ea127b9f510f", "value": "6144:KYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfrqxa:P2dOm/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281553, "uuid": "67031f5d-f00a-4321-b33c-bfd7aca568fe", "value": 215505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281553, "uuid": "ce7781b0-4bf9-486c-90fc-7d0d078e24a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281553, "uuid": "99ebc080-c392-41be-ae6d-45db13d14a11", "value": "FACTURA_325673.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2079901-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713281591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281591, "uuid": "9193fef3-c53b-4b4a-9222-493ae9f4dcb5", "comment": "Malware payload (Formbook)", "value": "5c629502f5f297b1473c1288daef4815", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281591, "uuid": "2566d037-8aa4-4ae3-a3e7-6ebf7fa63840", "comment": "Malware payload (Formbook)", "value": "f0faf14409482a52de11a52384c0a7dd0067f13f7063d61fe400e0a5cbf5df8d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281591, "uuid": "466d2606-c003-4fe2-9980-650c20db87dc", "comment": "Malware payload (Formbook)", "value": "c1339b52ef4f18e1bc269d928bbf85387d17b3e4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281591, "uuid": "b8c0df9b-9575-4f2a-84c9-e3d42d07abda", "comment": "Malware payload (Formbook)", "value": "69e4b2621e7e4317c961709bf1b28d34244807464f6ef866c377dd2976e379f2379cbafd2915044f8e3935ffe62ff5fb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281591, "uuid": "7b3f99ea-ce4f-433f-8519-f114fe58350a", "value": "T1392408F08F0B36198F5B3EDAAC6445928AF54195051238B5AAD817EDB383D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281591, "uuid": "cdf8635a-36ac-4d0f-810d-e6c48ee12cdf", "value": "6144:iYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfcqNZ:X2dOtzRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281591, "uuid": "be9c7da5-58a2-4bcc-b04d-cdefdc58be68", "value": 215489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281591, "uuid": "47ea2899-51f1-4db7-b857-3203065e359b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281591, "uuid": "6f1514f0-f1db-46ae-9ba2-6b9e1b7a41fd", "value": "JUSTIFICANTE DE PAGO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2913189-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233998, "uuid": "50cf5b9d-18fc-434b-988a-d03e913289f9", "comment": "Malware payload (Gafgyt)", "value": "b7a441cd1aa38999e7057dea2e7a8017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233998, "uuid": "85812601-b508-4722-b5e0-f1651ced7df5", "comment": "Malware payload (Gafgyt)", "value": "f103eae267680117f56a363cfd38f21f4f723e2fc67c4e8b786a748668f68afb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233998, "uuid": "4a91881b-a680-450a-a94f-f80dd0e4f8c0", "comment": "Malware payload (Gafgyt)", "value": "681171b84e15d062cf7f32fb76593b79c486a429", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233998, "uuid": "3d8f6620-0332-48c6-b8d2-42a709e5ccba", "comment": "Malware payload (Gafgyt)", "value": "e81071de874bd59e73d56e98be5b7f9d00aed1a20026888c99eea5dc72fb3e193f821d30d617551a4441792c48ea0152", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233998, "uuid": "a99b8b2a-4e36-49cd-a3b7-1981d56891c0", "value": "T1E0931ADBEA02CE73C41310F112AA9F219E71F9FB0863D642E7647DB4DD151C26A16FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233998, "uuid": "b339f208-6801-4875-8b6e-b3436b5e9b46", "value": "1536:KZDdQp80ybTeMckScFcEWsEHaQOyS7AUQAVX3zkEgjnNTuPJ33KZqMg6:KZD2xkTefciZ76eScUQAVX3zkEgjnN8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233998, "uuid": "03b2f706-9b10-4b25-bfd3-39f67990a7e3", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233998, "uuid": "9bd9ecec-8201-4b6f-a170-fda9c79254ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233998, "uuid": "bbb21093-560b-465d-ad21-6de4c103adcd", "value": "b7a441cd1aa38999e7057dea2e7a8017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e977d746-fbcb-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713256370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256370, "uuid": "35f02be6-0bee-4f5b-93d7-b16ddcf720db", "comment": "Malware payload (RedLineStealer)", "value": "364fd0dfac8e167c8eb5bc881b5a5ec6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256370, "uuid": "10caca50-c95a-4578-8cbb-254cddf7a45a", "comment": "Malware payload (RedLineStealer)", "value": "f1c0f9de5fce84db6d56ddc770260f24e6ae3dc16cca0f7e7938fee421f404ef", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256370, "uuid": "b87a66f8-ac5e-44bf-996c-9ff9b0e9caee", "comment": "Malware payload (RedLineStealer)", "value": "a390f9bc184652f500066e0529aee03e5f3e0cf4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713256370, "uuid": "8e1d8596-1cb2-4903-93d1-f5a52f57630c", "comment": "Malware payload (RedLineStealer)", "value": "d2df430ac895fe228915c7ad5597440a5e8115e091aef34271979dbe0b190d7ba5ba949546010adfed7989f210a5a10f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256370, "uuid": "3e03ca34-38cc-4954-8167-ce92a6ec8a74", "value": "T15A35AD0273D1C036FFABA2739B66F60556BD78254123852F13982DB9BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256370, "uuid": "c40befaf-6ba6-4f0f-aed8-52f58c6b901d", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256370, "uuid": "409607dd-f4ad-4ca9-8fbf-cbbf1dfa20f3", "value": "24576:mAHnh+eWsN3skA4RV1Hom2KXMmHahxVQVoGPp9urmT2L75:Bh+ZkldoPK8YahKl9NT2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713256370, "uuid": "67597e02-c5e1-4252-864d-4503a341cd71", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713256370, "uuid": "f68822af-82a9-4659-8671-dfff0c078a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713256370, "uuid": "5dff7782-bec4-476b-a3d9-cf06589ee272", "value": "ORDER RFQ QUG24-200379907.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0d863d-fc40-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713306413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306413, "uuid": "40693903-ef80-4e49-b784-161ad24e2183", "comment": "Malware payload", "value": "5b7f24d739a68d14b253c0c387e89052", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306413, "uuid": "651cf430-d58c-4543-94b2-306af0ccb030", "comment": "Malware payload", "value": "f2f72a5365ef3b60ab415562cb3f5255158b80cca6d7682fcc74e2203019e339", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306413, "uuid": "db88e466-ce4d-4b1d-b29c-2a063d0569e8", "comment": "Malware payload", "value": "9d91aaf678cc2170b51d0adab50030fa6f6f0012", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713306413, "uuid": "e26b5a4e-1d9b-420b-87f2-0b6ccafaf60d", "comment": "Malware payload", "value": "c6879e6618284ebb9789fab80f76a922bbf580037389de75bdddcf92c341c56b95400c897442213c5fee1e81062fa1f2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306413, "uuid": "28e43654-168e-477f-85c1-4f7aa75740b7", "value": "T1D5647C52BBC8C13BD29E063645AB97A626357C332B20C5CF6B85386D5E327D2ED35702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306413, "uuid": "2dd9e214-1d7c-4a80-bcf7-659dd2b1710a", "value": "3072:TspAtO9mXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8+11xMyLln:ttO9iRQYpgjpjew5DHyGxcqo8W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713306413, "uuid": "d87e2fa8-90eb-43ad-88fb-705eac53f482", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713306413, "uuid": "adb9523c-3aa4-4a0d-a1f8-abd1e80cf4cd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713306413, "uuid": "65439b71-01df-43ea-aca1-c9b3e303c371", "value": "SecuriteInfo.com.Trojan.Generic.35702255.16709.9631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f432273-fbfc-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713277264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277264, "uuid": "9f86dbe5-e68b-4c10-a912-359ebae201f5", "comment": "Malware payload (RiseProStealer)", "value": "5fe48966c2f11e09fd518e77118d6b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277264, "uuid": "afb4d3a0-4286-40ae-bfb6-1e6a5f169a47", "comment": "Malware payload (RiseProStealer)", "value": "f39af57919d6119847e6ecd6a9495fd0b0996a95b0bdf1d2440b6d6f296b1d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277264, "uuid": "93915386-f06c-4305-b58d-536a7e5315a0", "comment": "Malware payload (RiseProStealer)", "value": "71ac5d567f1485454b0a3b04cece2d40cf8c0fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277264, "uuid": "8072a9db-d2d1-4df5-8e83-09deea87413e", "comment": "Malware payload (RiseProStealer)", "value": "33b845901c61e9be066a93fb19a3c96d5b778d85872e64127d9eb2c379d2be03081b5e2c450d0dd57e6a2c7e35d12d28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277264, "uuid": "d4d09040-396b-4653-9c21-655d0e9f799c", "value": "T1CC163302FF85461BD46B447AD8BB82007A45D41ABF49712B73AA971F3EFB3F2134A152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277264, "uuid": "c1c8133d-a53a-4048-a44a-c3396e268fa3", "value": "2f93cd80e5dfeca07d7e8b0f35545fb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277264, "uuid": "95a3aac7-50cb-4757-807b-c8083c6f5f84", "value": "98304:R+++MEQcFUcyrwHeeLn/I9QJo+W9NKdj5tskdoNr+OqWl:sMN9MeeLn/hJoZNKLtskdoNr+Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713277264, "uuid": "1f5244cd-9ce9-4351-a213-35c3533f0a7d", "value": 4173312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713277264, "uuid": "753907f7-c047-4c0a-9f89-640c11a063fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277264, "uuid": "67281aa4-e03a-4f8c-b44c-07f82f31a9fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c0bce7-fbca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713255827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255827, "uuid": "ef3ff54d-0cc0-41fa-890b-299f8864083a", "comment": "Malware payload (AgentTesla)", "value": "dac025aa7cfe018061874fbd00385a98", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255827, "uuid": "3d9049da-0292-4bfa-bf6a-85ba9f69c598", "comment": "Malware payload (AgentTesla)", "value": "f4f07c6bd1da88ebbcdee2b467d306472052dd5f30dd579104e787c6a2263da9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255827, "uuid": "322fc2bf-f329-4ca9-a5fd-b67de2afa466", "comment": "Malware payload (AgentTesla)", "value": "42b4e26c036684c786ede364338a35d1fcff680d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255827, "uuid": "4c5cf7fa-6bf5-4c97-8dfc-c281d8beed28", "comment": "Malware payload (AgentTesla)", "value": "c36aff76f2b0ce866655acbdc69d4a453cf317f4634cd1f48a6f6c1667329d7b94e944e674c1ed33cab5ffb075cb6448", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255827, "uuid": "a9997ad6-a009-4ca8-86fe-6481650cfd32", "value": "T11C44237CFD206980EB8AAF0A3CF75D518D2AE7F70670E4F850DDF6182C4E892925D4A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255827, "uuid": "612704ed-65bb-45d6-b9a0-5528a4143b70", "value": "6144:mXooyLhQfNBriuQYmI7G6xrfdVnbERcYGNNBVllYSpmf:v1QfNBeu3mIycrfBV7ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255827, "uuid": "4cd5943e-ad2f-49d4-a028-ac4d76e2273a", "value": 261167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255827, "uuid": "9a5eb4bb-df2a-4b2c-b1f5-0bb148feee26", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255827, "uuid": "b173aad6-898e-4c5d-aad3-ffd353791c97", "value": "Proforma Invoice - Well Ergon.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2beb02-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713234043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234043, "uuid": "2e45e58f-7b7c-4729-965e-0c49369efcd4", "comment": "Malware payload (Gafgyt)", "value": "c72b453192fddbda8115074e23769f63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234043, "uuid": "b6dc85ac-8eef-4556-9553-b1ab8b935fda", "comment": "Malware payload (Gafgyt)", "value": "f6d6eef1a695bd58a5c885723de8023217d958c8438d348a1e53adbfc1d237e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234043, "uuid": "71458220-bcdd-47bb-a868-7dd07f8e6b5b", "comment": "Malware payload (Gafgyt)", "value": "9e49f7ffbc2c2258f852b4622268da727a6c93f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713234043, "uuid": "75262854-c6b2-447f-a935-b908999aba1f", "comment": "Malware payload (Gafgyt)", "value": "da33c5f4630765aeb3dd5b1b3399ff8def5048d2f7ac7ef77b581b4fa195279a1528e497674a63589005f67b617d59c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234043, "uuid": "f1877808-5d0d-44da-a0c9-527eabaa541e", "value": "T12EE3971E7E21DF7FF559C37047B38E20969436E626E18185E26CEA081E7138E641FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234043, "uuid": "e8a1b85b-a6b0-4c19-b2d6-12915f7f8eb7", "value": "3072:kP7Y8rAGpYQFm9KcsU2KuhpbIYEOerv3xmtmcZK5hspvIj:kP7Y89pYQFm9KcsU2KuhpiJfGM5hsIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713234043, "uuid": "9259d9df-8382-4958-9f1d-1808c36afe27", "value": 147808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713234043, "uuid": "0fc84ef1-02d4-48c7-a67d-6175ddb43add", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713234043, "uuid": "f8fb56e2-39ab-4389-a1ca-0384d2b8fe46", "value": "c72b453192fddbda8115074e23769f63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ba2a03-fbdb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713263266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713263266, "uuid": "f133436d-f8df-4c24-9673-586c57459015", "comment": "Malware payload (AgentTesla)", "value": "05c74b52814cda8c5d82036058aaea4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713263266, "uuid": "4db76aec-9bf5-43b7-a1a9-061af9370d27", "comment": "Malware payload (AgentTesla)", "value": "f72fe64d564b061125bc41a0e706bd9a701f5bfaa103e0f1e4a53b88083cc3b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713263266, "uuid": "38487cd8-076f-42e8-9e1a-e6ab662d3155", "comment": "Malware payload (AgentTesla)", "value": "38603831b687edaaf52d86f0f0f81950d075e20f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713263266, "uuid": "6c16887a-12d5-4f3e-ade7-9295a25d71de", "comment": "Malware payload (AgentTesla)", "value": "7f316c73874a0709e714db1926a3f9bdba3bc45f2ce2e4f8a104ec4ab80607bb53c76a88f2095cca905151d1405ce999", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713263266, "uuid": "85f5e573-e6c8-4fc8-8859-6b855be26e11", "value": "T1A0F4F0686AF7AF66D5BC07F19421582113F1B55F3572D26F0FCB28EA2A22BC04585F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713263266, "uuid": "bbd92de7-99b6-4574-acec-9b8bd67dcba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713263266, "uuid": "9949db1f-38c2-40ed-9447-638891a1ab1a", "value": "24576:yEy2vUjFYJFil2mne5AVIXarOzPQNqUzw:yEyGfFiQOVkjDoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713263266, "uuid": "1f59b694-948d-48c0-860a-2c6d8231a3c1", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713263266, "uuid": "cf5e49ea-91eb-4dfe-82a0-1d708779e9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713263266, "uuid": "ffeb8297-2685-4ed3-8254-cc0130794a13", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17997.17145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd04faf-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713281580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281580, "uuid": "afff056f-c172-4482-b250-fe74b9e2cdd1", "comment": "Malware payload (AgentTesla)", "value": "d6eac1260b1539ef53c657d43cabeb3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281580, "uuid": "91635f8b-766a-41ce-b18d-4c9131db7e66", "comment": "Malware payload (AgentTesla)", "value": "f80ab240a0e45e8525882a6baf68bffa18ccc38d7bd37f292b9d94ccf1394dd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281580, "uuid": "c2a4399c-6640-460a-88a1-5b671d571e0a", "comment": "Malware payload (AgentTesla)", "value": "64e861d9d65b8f885871f4eb16332d19b6288942", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281580, "uuid": "c3e1e1e1-4d4d-47a6-a962-e6998b7689dc", "comment": "Malware payload (AgentTesla)", "value": "34bf27305ae08d23320852887af6983108f29cb38e90c9030e7e676dd47ffd998d8bb1a7fc5179b79bf53c4fe5810a11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281580, "uuid": "24c709fb-fd9d-43a0-be43-b6c61f841b5c", "value": "T1DA2419F0DF0B36199F4B3EDAAC6445928AF44195051238B5AAD817EDB283D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281580, "uuid": "ef762ef1-2ab8-475d-b90f-a750600def33", "value": "6144:cYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfNqGd:F2dO5Zp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281580, "uuid": "e96620ab-7dbe-4468-9cfa-bcbbe65f75cc", "value": 215758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281580, "uuid": "4c6ce544-e572-4ff4-b9b2-e38dfd004f4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281580, "uuid": "cfefb5a8-44bc-4f9b-a061-aa89f997ce95", "value": "Justificante de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91890e28-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713281563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281563, "uuid": "3418efbc-cf36-4b64-8bfa-b8fcd5e85224", "comment": "Malware payload (Formbook)", "value": "c56fc932b6d7aa5a97f5939187cb3878", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281563, "uuid": "d941dff2-4f75-457b-b732-2e74570496d8", "comment": "Malware payload (Formbook)", "value": "f82794d2852d690d6df6ba682cb8325c8276ab88f2ab0327cba601a63c443b60", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281563, "uuid": "b797cb99-8d54-493c-97c5-c9ea7d94be10", "comment": "Malware payload (Formbook)", "value": "09781da30e8b2695131fabc3bb55563a4ceb0505", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281563, "uuid": "7c304a81-c5b7-4ef2-a617-6c231710cd2a", "comment": "Malware payload (Formbook)", "value": "43707fd0858bf2e30bb2835231f7956492847ff543c4ba795dcf577b36c97051574ec8a549c5f4626a7c9ce86d8ece99", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281563, "uuid": "c28afa2e-e6f6-495b-bac7-fea86b067af7", "value": "T132543AA0CFCA36394F4B2FDABD60459289F88199021224BDE6D907AD7243D6CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281563, "uuid": "42d0a071-9bee-4260-851f-55bf7d9e7095", "value": "6144:LIdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOAx8fz2agF5:EnS2ImcAx+/aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281563, "uuid": "c53e6cd4-cb55-4e4a-8423-a5bdf1ddf5e8", "value": 285190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281563, "uuid": "dfcda949-0482-47b3-aaaa-120ccc611752", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281563, "uuid": "51bd858b-d8b0-4372-9061-317a8788a666", "value": "Arrival Notice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa37f42-fbe1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713265454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265454, "uuid": "2781e746-46f5-4cbd-b14e-930d3a77c001", "comment": "Malware payload (Mirai)", "value": "19fcaa8ec913803bd48e54816980cd0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265454, "uuid": "88370833-2b65-4a4b-af53-444e2c891cb3", "comment": "Malware payload (Mirai)", "value": "f9f36f628d2df9e65b72c8dcaa90a87eff365f374e02d674c837aafe1f65ec33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265454, "uuid": "44e72406-cdcd-4840-aa06-06c958230c81", "comment": "Malware payload (Mirai)", "value": "7cc35335316b9130dfffbf1fe23004cee3839ea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713265454, "uuid": "d0942104-0885-476e-a39c-690d9f4bb04d", "comment": "Malware payload (Mirai)", "value": "cee38efb0e77e2738a1d5c005a94385d44057ec40015db2e8751a260bb8106f1440cec49f819c0707b3acbe21308c133", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265454, "uuid": "3cb8d4f9-2880-464b-b091-02eadaa3561e", "value": "T1DBF25A238EB62E48E25CD1B0B0788F785763E468A65B4FAA5066C7399543DCDF2023F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265454, "uuid": "58560bf1-6c2b-4b72-b498-79c46bd504b0", "value": "768:YgPgnagGncX0zvPXrqLKPgs0azo2Pn7SWCPU1N+fBoYkIL:UtX4XIKPgsnEQGWCP9opS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713265454, "uuid": "15a0539f-7379-4c34-b010-7a24decf798e", "value": 34288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713265454, "uuid": "296c27b9-9bd2-4894-97d6-dfcc48cb97e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713265454, "uuid": "4706a4a7-f57f-4cd8-bef2-17aeed62c86e", "value": "19fcaa8ec913803bd48e54816980cd0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeff6ac7-fc03-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713280324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280324, "uuid": "8096e3f4-1210-4207-be77-835c34a7218b", "comment": "Malware payload (AgentTesla)", "value": "abc774f48c2e514bde4ba275a4314b4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280324, "uuid": "44ea126b-1e3b-4833-a4ba-72a71ab9254c", "comment": "Malware payload (AgentTesla)", "value": "fad3e7058eb2fa88ce97e62a6a243748d6736f9c4e21e4112ed61a40813588b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280324, "uuid": "599302a3-0122-4350-b9ff-3bbd3b2e668e", "comment": "Malware payload (AgentTesla)", "value": "141d5d859afb0340302bd4ee2ca2be9493f39804", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713280324, "uuid": "a1eb8c3d-504d-43d3-ba22-f053ac4e171a", "comment": "Malware payload (AgentTesla)", "value": "9c1af6dc6ecd0fc3fe1505cb0b57b4df6ea5f417ed3aa458f8a448145505943e6d0cd4eb31ed29e30c747dcd357c8f66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280324, "uuid": "a3b68ec1-d292-4f21-bd16-d95475682dd7", "value": "T1ED259D9D3610BADEC96BCE72C9981C20EA206477531BE307A11315EC9A0DB9BEF151F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280324, "uuid": "0681f73e-6429-48c7-bf42-4e4936a073dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280324, "uuid": "9a9567f3-077b-40a2-af07-254c85a34f5e", "value": "24576:kp7jSc9duaYoRV9ii5nHMAXJ2LiMOxckwle5O4i:sGc9VTntVXJKiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713280324, "uuid": "097942c8-1829-4686-ad21-370f00ab5ff0", "value": 1053704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713280324, "uuid": "02abad81-d4b7-4624-b30b-172dfecca17c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713280324, "uuid": "201f3852-bd5b-4c94-8000-ac1e56fb98a1", "value": "e-dekont_html.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed087b1-fc02-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713279653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279653, "uuid": "95257ab3-3c1e-4e44-ad8d-d90793798839", "comment": "Malware payload (AgentTesla)", "value": "fc7ff2dbe62e9856621bb94b6fda9ac3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279653, "uuid": "76f879b4-bc83-48d9-9543-377febbb48bb", "comment": "Malware payload (AgentTesla)", "value": "fbd4a102841baa25dceb0d59e62cbf970e56ce4e301c629916734a727fe20a58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279653, "uuid": "49d64634-85b8-4d25-9d29-6f36ab7b3c51", "comment": "Malware payload (AgentTesla)", "value": "f156f2860eff897d9332c86b42c8089f77c3999f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713279653, "uuid": "e4d9be35-9e3e-4b13-ac88-24f781dcf1b0", "comment": "Malware payload (AgentTesla)", "value": "6e62d6b08979d9782b7c4b4002ee42647af024c394475972103ba142f533cab6dc18ad17a485d298579107a6a2dd6014", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279653, "uuid": "5357287d-6a78-4240-b1df-6f29c665e215", "value": "T11B35AD0273D2C036FFAB92739B6AB60556BC79254133852F13981DB9BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279653, "uuid": "1a104aa8-f128-45e9-a0f8-5b9f5a22c5aa", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279653, "uuid": "5435034f-cab9-4ca3-97d8-44feee04d0cc", "value": "24576:rAHnh+eWsN3skA4RV1Hom2KXMmHaXIvp6JD4wwk65:Gh+ZkldoPK8YaXWpy41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713279653, "uuid": "c6174680-724f-4c97-8330-fc88c8c3e869", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713279653, "uuid": "d632f226-834d-4af6-8969-671bd6d55141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713279653, "uuid": "1b1e3813-abfd-443a-b1a7-21a7a550f4b4", "value": "Confirmaci\u00f3n transferencia interbancaria.00778786778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032a7f6e-fbe8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713268439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268439, "uuid": "e134a2c7-7070-4410-ab60-de2a5d9e1b85", "comment": "Malware payload (AgentTesla)", "value": "018f883769a1feb1fe3646f72a7f438b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268439, "uuid": "6fb29e88-7d9e-4231-95a0-f11533076691", "comment": "Malware payload (AgentTesla)", "value": "fc73f236ff623fd5f81bf35bdd750d5925967fbbc3aeb9ea313e62d5a291e932", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268439, "uuid": "4c0a3d60-4236-4bb4-aa07-9d61cc95c9fe", "comment": "Malware payload (AgentTesla)", "value": "83ac526a23602e779e6175134c670b173ae03367", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713268439, "uuid": "1a067c12-869d-4c1e-be3e-937b34016080", "comment": "Malware payload (AgentTesla)", "value": "b76352e130fa75ac33ff7a69fa855778d64bebade98ea0c62ab97b71aeb439b8a3abcce550084b8035585457fc696799", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268439, "uuid": "bbdc2921-bc5f-4667-8fb1-3407f733b43e", "value": "T1A0E41206B39FEE11D1985736C2C246048374AB072163C38F3FCC218A6997BD55A99FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268439, "uuid": "4aa05249-c567-406f-b464-76cc83d54e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268439, "uuid": "7403a30c-283f-45b6-a324-eb3656990f5e", "value": "12288:G2xOzT37rxFWrrmqJGI5wcRWVDAG0hBTEMxnfavGejuj8BgYWeIh:GNCrv8OwcRWMycAxBgYnIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713268439, "uuid": "1106e6db-1878-43ea-9fcb-71cc74ac41be", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713268439, "uuid": "9273d149-9306-4220-9a72-0d8efd6da2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713268439, "uuid": "c6c6ea21-a886-4618-94a1-90e06e533a03", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f714f2-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713233902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233902, "uuid": "ed38ae9b-a35f-4d55-a854-9aa2281150c9", "comment": "Malware payload (Neshta)", "value": "9762ce69c2bf80bf5ffd1029ac0b11ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233902, "uuid": "d38d1a21-1ec4-4ea7-b0b6-393111f4e2ec", "comment": "Malware payload (Neshta)", "value": "fc7c9c64d0801f66f22ea258673b12b73f392b958cf38dbf14432dcdb3037e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233902, "uuid": "2103a6af-b276-4448-bad2-d9ec96a704e9", "comment": "Malware payload (Neshta)", "value": "49694133876acbe35f5493d99a967089ea1cc17a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233902, "uuid": "f58022e9-5c26-4a79-97b9-fac5845df618", "comment": "Malware payload (Neshta)", "value": "72dc5639b1699a8bd3d40542a0ffdad3a14570ad0cee95a840d2e951462d631e65c0fd3ab49259c35c89d9a76abf347e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233902, "uuid": "bc1ef5fc-c486-4f16-ad26-971bf5a99eab", "value": "T1BAF4120871BBAF6AD77D07B54A2268104B7938B71877D61F0FC160C71A7AB848B41FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233902, "uuid": "824752bb-1db0-4bbe-ae4c-4c1cbab340a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233902, "uuid": "777a1a09-6919-4247-a0df-a016ef025426", "value": "12288:LxyXRz/I7vByWqTBAdLh9pyEpF/6AJdrWZE1uSRHC6ZDV0xhB01/6NIMt4vv+Kyb:L0Q7vByOTzJRWZeRiMV0DBLNIMaGKy3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233902, "uuid": "a833a5f1-bfd7-4b7c-a8a3-c2174d777de4", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233902, "uuid": "71cf5d88-301e-449e-ae54-c62fdb5e68da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233902, "uuid": "281d2822-0ab4-4b02-bdfc-cef437733593", "value": "SecuriteInfo.com.Win32.CrypterX-gen.29753.1239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7d5b6e-fc06-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713281503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281503, "uuid": "7ac0c224-b65a-4cff-b8f8-d5a47f0b9abf", "comment": "Malware payload (RemcosRAT)", "value": "1dc1fa973594e14e2b517f281400941f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281503, "uuid": "54a1f2f7-2faa-4c16-aeb3-9e2f20338d0d", "comment": "Malware payload (RemcosRAT)", "value": "fd363c89da6fb751baac4db6bc4d1cc302c88e1efeba1bfab397a627d4c1eead", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281503, "uuid": "faedc9ab-ce15-4646-bd2c-bc5c2809b878", "comment": "Malware payload (RemcosRAT)", "value": "1565eb8c6dc5248ecd19cfe4ff1cb6c33541ed1e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713281503, "uuid": "4b6e90f2-babe-4e36-b817-58885e52a7d7", "comment": "Malware payload (RemcosRAT)", "value": "fc0e702db150905967a243127187fdae0169b8dbde3c24b0934bdb5e53316ecd9d21673ded177baef685a25ca0adde7e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281503, "uuid": "888af791-6541-4e1e-94a9-71c680dd1bcc", "value": "T16664E051FB80871AE45547758DFB4BAB5325FC41AF924A0F314CB31D3DB03A85E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281503, "uuid": "4ae6fcd2-b9a5-430e-b804-6d6a498546a3", "value": "6144:xLunJatY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVX2MIMflDClBnPlWjIKw8:xmJaU3bVX2MIuVC7ntWjIKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713281503, "uuid": "d160301e-ecac-41a8-b16c-3fe2611953e4", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713281503, "uuid": "0fa4a0e5-1161-4b61-a6af-8da4789de4ee", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713281503, "uuid": "f5b649aa-366b-485e-86fd-706e0339a2b7", "value": "OFFER DETAIL 75645.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51718d3-fbc8-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713255021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255021, "uuid": "d7f33ee7-b1c8-47e6-b293-75efc83db7fe", "comment": "Malware payload (LummaStealer)", "value": "3d03e50e7acc908a73cac1928347d0c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255021, "uuid": "07b820ab-0ad0-4c66-8510-1e01ffb87b9f", "comment": "Malware payload (LummaStealer)", "value": "fd6158af16fde7ad1e8152d53991bedf566b38f54266f0f03c5c73560e486568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255021, "uuid": "6f5bde20-e1e9-4296-a17f-1f8cfb2c1bea", "comment": "Malware payload (LummaStealer)", "value": "8c059a014a22d80ebbccdd2e3a3bc1e8933fd696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713255021, "uuid": "9d9e64e0-3ebe-4c73-8110-f8c415fe4ca1", "comment": "Malware payload (LummaStealer)", "value": "f9e624a7329863fb7a1530951ed227594ba624e7bdc4fc97f46ac26251af0846b02e7b515abbffdcf632ee8988129df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255021, "uuid": "3d6e60c1-afb2-4bc8-967b-276a40494330", "value": "T1F6462373525A4080E6F8883A9A277DC471FB47BA8E41A8BD70E7B9C534329F5F603947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255021, "uuid": "15a01fd5-aac9-4c34-baae-75a337620172", "value": "89c8abd38fd3ffc06ee06d01f9b3cbbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255021, "uuid": "c556387f-d3a6-4901-ba9e-1e69be7efd3d", "value": "98304:mZUP3t/11NgjBWsbMqSCuc7ntoHEVAyXIRYa6SQQ+5utaO7TGbTys483U+DfvHZN:cUP3tdDCWtFkVxST+3ssN5Z4euyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713255021, "uuid": "1b031904-9107-42cd-925f-9f4d0766f206", "value": 5719040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713255021, "uuid": "7c6aa94b-b405-4d91-9218-c86033b73b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713255021, "uuid": "c449564c-d35d-45be-b72b-6101697e1d25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06be38a6-fc30-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713299369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713299369, "uuid": "2abb775a-cc17-4a14-a495-e1040756df58", "comment": "Malware payload", "value": "1b532fd7cbde856162611c2af516ec33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713299369, "uuid": "f1561508-851e-45da-bb2b-2d58b20b9ae9", "comment": "Malware payload", "value": "fe6d639360c8882b05fc9028ed5233c63dcb8f3e638812bc10bfa41bbea1d96b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713299369, "uuid": "3f4c6f32-8977-45bb-98d8-593389890f82", "comment": "Malware payload", "value": "ffb770b825984182a4fab752f35e1d4b34b3e06e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713299369, "uuid": "fdb5a454-cacd-4b45-a376-db4bc5e96de4", "comment": "Malware payload", "value": "18f670060ac9aed8e6e5df9629541fa0cfd04bf9f9241a4925222e21855c65642a0dac1539e26e9b77e883cb0edc446b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713299369, "uuid": "82b9c11b-ed7a-4830-8059-78465e32449d", "value": "T1CFB533ABD88F21ABE740073E06E6DC39D2BCD2DB5D26109C73AD0999F6D1740F94079A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713299369, "uuid": "9b717fa0-1b5a-45e3-8c62-57b83cb8cce7", "value": "24a52ec5a436811bf54ba16ffd526ae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713299369, "uuid": "a11a46a6-d79d-4665-9520-7840f2c55468", "value": "49152:MtUnfFw18DqBl2ppjSx+m0isxNMlbGRieDpoaR:6UnfFw1Hl2Svggw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713299369, "uuid": "964036bb-c0e2-42eb-a682-b51f2434d47f", "value": 2454432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713299369, "uuid": "b1582f08-5684-4c5f-beb3-0abccb57f2be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713299369, "uuid": "5b3f0c6a-0c7e-4d21-b462-022d98b4eb72", "value": "SecuriteInfo.com.BScope.Adware.MyWebSearch.26467.22406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abda63e4-fbe6-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713267863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267863, "uuid": "577f7a1e-5e9f-4aee-96f7-29e781593f10", "comment": "Malware payload (Mirai)", "value": "b088f02c804f90b7113409b3117d4ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267863, "uuid": "9181eecd-70ee-43c2-906b-de095dfdac42", "comment": "Malware payload (Mirai)", "value": "fe8137792f3aad898cd72338ecede6f41cbd823ca70485bdc0dd580ed0bceeeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267863, "uuid": "072f2a8b-b7e5-4c50-a602-65090da9e4b3", "comment": "Malware payload (Mirai)", "value": "e711bcc01d936fee940bfd850d444af8db71e908", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713267863, "uuid": "d63a784f-2839-478f-b597-6e9d7a78ac65", "comment": "Malware payload (Mirai)", "value": "241ee2d970e8e2db3c84bef776b9d0b6438a163fafe0f53dae7fbec4a715000caff328179c00c287af61394b1d9cf4f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267863, "uuid": "b0855240-1d0e-42be-95df-d24ac90bdeb4", "value": "T1BB53E7C1BC41A629C7E01777F9AF559E3300A7C9E1DA72178C240BA47A8B94F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267863, "uuid": "6e3fd2b1-68fb-472a-8e9a-ecb75f346287", "value": "1536:jffgHhV2gKLExnNrnDKbr/l33eZto9aocOK:jffgHhV2aOF3w9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713267863, "uuid": "1c4d9b16-47f7-4cae-9a35-0c3677c658c7", "value": 64832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713267863, "uuid": "2d5bed52-27f0-46d5-bfe6-48cce631403f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713267863, "uuid": "2f5169a4-a5cd-4f81-a6b7-b64a889c6ff4", "value": "b088f02c804f90b7113409b3117d4ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ced1380-fbfe-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713277958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277958, "uuid": "dfd7f15c-89f7-4564-b998-5e3f5569cfad", "comment": "Malware payload (RiseProStealer)", "value": "3143d8834657c3348958f11ec96d5cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277958, "uuid": "fc4d3be1-77ed-4d39-8560-2e82669c2f64", "comment": "Malware payload (RiseProStealer)", "value": "fed4b8157c4471160e3ff8221e2be9bc21b85dde8769c3cbe65ff9a20361ecc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277958, "uuid": "7d337f7f-1b9a-4aaf-8178-3d65a654d1e7", "comment": "Malware payload (RiseProStealer)", "value": "97e43ab9cbdfe320f97c722248feb4c0f8112011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713277958, "uuid": "9cf164de-e3eb-4b2b-a1d9-01bc1e077321", "comment": "Malware payload (RiseProStealer)", "value": "14d823f220d26f2aa82bdba318244e06eff58988baf4fc3f18398cbb6ee558344e10968d0070f2b1afe427e47de08053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277958, "uuid": "0d41d098-0e24-4f2e-b928-d63d156d1c7e", "value": "T14365232271C2C0B7D469193108B1EAB14F3EFE342E545997639D536A6F201C19BBBEE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277958, "uuid": "ee740efa-0143-4b03-9275-661026c22f3a", "value": "b09f4628c9b8d8436d8b37442f32d236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277958, "uuid": "c3328f35-a5b0-458c-8afe-fee6fdb0a0fd", "value": "24576:Ogn/o/5w4sDWEshvKBVyeNe6LSGVQOaKvBcQwr1uiEwck9ZcyM43tn+d2YPZjOiM:O2/yLsWhK3yeNTLSXCBDwr1uiEwckjcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713277958, "uuid": "c539d9db-2de5-48c9-860f-acb347b17812", "value": 1484288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713277958, "uuid": "a62b0066-bf0c-4a78-954e-52e27b04bfe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713277958, "uuid": "1d1b2e99-7182-4959-8253-2ff2ab289200", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5a0d33-fb97-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713233937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233937, "uuid": "a82051ae-05f9-4e1f-9a1d-0cea0fcd64a1", "comment": "Malware payload (Gafgyt)", "value": "c4a3048c16c4654858d1994d9338df86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233937, "uuid": "0db7da2e-0af9-4fdc-aa4a-6cd76eb9a26b", "comment": "Malware payload (Gafgyt)", "value": "ffdfddb2cfc227b0d7cdffd2000bda3af934bf5e885e6ac2ed3a5a8c2ab2b051", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233937, "uuid": "8e63dac6-dbb9-4348-9191-de2c3e2e645f", "comment": "Malware payload (Gafgyt)", "value": "ddef61656d20101f4fa7de0af1724bc579dd8ca7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713233937, "uuid": "7ac3496a-da06-45f3-9dad-7e0a6208fd49", "comment": "Malware payload (Gafgyt)", "value": "138ad309cdd49567d0fd5624b08bdc9afda381b76bf7a7d31b877fb621ca6d2567b1b21178395d835cf192dae0a3b49b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233937, "uuid": "6784e813-456a-4619-abf2-c4028fae5221", "value": "T1A5B32956BD018F07C2C315B7BB9E47483B2667F9D2EF3203E935AF61378A4D60926990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233937, "uuid": "92e58c52-4f3e-4746-bcdf-379e3956a2ee", "value": "1536:KaFa0qcB9hXOYS3lno47XGFGrIov1CHVrwOgA23vRbPREtrX9Qv85hmpyaNq:KiP9h+YOZGgUouViZbalM85hmpyMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713233937, "uuid": "a3c3bb27-cd57-41f2-a37b-cd4c563eb943", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713233937, "uuid": "86640c23-5a4a-417b-91a4-16edf6a6aaa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713233937, "uuid": "5591c62e-8b4d-41f3-b114-69be739c4d0b", "value": "c4a3048c16c4654858d1994d9338df86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910eadee-fc37-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1713302608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302608, "uuid": "f8246e87-207a-4a90-b9a7-a99f169393f2", "comment": "Malware payload (MarsStealer)", "value": "3f2f75660ddca3660f254222ec2e54d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302608, "uuid": "087a1805-f032-4613-9a32-72e5ce32c0af", "comment": "Malware payload (MarsStealer)", "value": "ffe8a2116f63f9d5cdb408f3d1e8f476ea595b7323bc95808e33b45084f2e14f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302608, "uuid": "afd607e5-53f1-47c4-8570-94def96fe6b7", "comment": "Malware payload (MarsStealer)", "value": "9e5710c00fc26b4d26d95c644040f56b652708b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713302608, "uuid": "13e6d838-e834-411e-b4e5-6b3c3453c5d0", "comment": "Malware payload (MarsStealer)", "value": "30b519cdc1a7caf1aebdf63a3b19f3a498cc37e2aaf1ccd606fa8d0728823272fcf10cc7433a825e16926bf440d8e2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302608, "uuid": "1b074efe-c3b6-4bc3-a0d5-1b73810030bf", "value": "T138F3E1A949C8517CC2FA6E78A58E3F7BB06F3E2D99CA5567090AB0C10C118D7AFC741D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302608, "uuid": "1938f9f4-7747-4a86-88e6-193544e2ebc1", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302608, "uuid": "07a4b97a-ee78-4c91-8195-000c93759456", "value": "3072:UBFZpghu/EVdJQFs5bebsLybLHFSaRWRZLdYWg/FzRBpJSp8Bb8EG:GZwucVd8sJGsqLlSkmBo/l8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713302608, "uuid": "79e77918-8e4b-4ef7-85a2-05b5218575aa", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713302608, "uuid": "8ebba5d4-995e-4311-85d5-e5dc51b42f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713302608, "uuid": "833726c8-7389-4457-8481-0cf0db719c58", "value": "ffe8a2116f63f9d5cdb408f3d1e8f476ea595b7323bc95808e33b45084f2e14f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }